@stapel/auth-react 1.0.0

package/dist/model/queries.js

@@ -0,0 +1,87 @@
+import { useQuery } from "@tanstack/react-query";
+import { useAuthApi } from "./context.js";
+import { authQueryKeys } from "./queryKeys.js";
+/**
+ * Read hooks over the auth API. Staleness follows core's query defaults;
+ * override per call site via `options` where a page needs fresher data (e.g.
+ * `sessions` after a revoke). Keys are namespaced (see `authQueryKeys`).
+ */
+/** Login-method feature matrix — call on the sign-in page (auth-sa.md §"capabilities"). */
+export function useCapabilities() {
+    const api = useAuthApi();
+    return useQuery({
+        queryKey: authQueryKeys.capabilities(),
+        queryFn: () => api.capabilities(),
+        staleTime: 5 * 60_000,
+    });
+}
+/** Current user (auth-sa.md §14). Enabled only when a session exists. */
+export function useMe(enabled = true) {
+    const api = useAuthApi();
+    return useQuery({
+        queryKey: authQueryKeys.me(),
+        queryFn: () => api.me(),
+        enabled,
+    });
+}
+/** Security settings snapshot (auth-sa.md §10). */
+export function useSecurityStatus() {
+    const api = useAuthApi();
+    return useQuery({
+        queryKey: authQueryKeys.securityStatus(),
+        queryFn: () => api.securityStatus(),
+    });
+}
+/** Password-change tabs (auth-sa.md §4). */
+export function usePasswordMethods() {
+    const api = useAuthApi();
+    return useQuery({
+        queryKey: authQueryKeys.passwordMethods(),
+        queryFn: () => api.passwordMethods(),
+    });
+}
+/** Active sessions (auth-sa.md §12). */
+export function useSessions() {
+    const api = useAuthApi();
+    return useQuery({
+        queryKey: authQueryKeys.sessions(),
+        queryFn: () => api.sessions(),
+    });
+}
+/** Registered passkeys (auth-sa.md §17). */
+export function usePasskeys() {
+    const api = useAuthApi();
+    return useQuery({
+        queryKey: authQueryKeys.passkeys(),
+        queryFn: () => api.passkeys(),
+    });
+}
+/** A page of the security audit log (auth-sa.md §16). */
+export function useAuditLog(page = 1) {
+    const api = useAuthApi();
+    return useQuery({
+        queryKey: authQueryKeys.audit(page),
+        queryFn: () => api.auditLog(page),
+    });
+}
+/** Pending delayed authenticator change (auth-sa.md §9). */
+export function useDelayedChangeStatus(channel) {
+    const api = useAuthApi();
+    return useQuery({
+        queryKey: authQueryKeys.delayedChange(channel),
+        queryFn: () => api.changeDelayedStatus(channel),
+    });
+}
+/**
+ * SSO domain lookup (auth-sa.md §18). Disabled until `domain` is a non-empty
+ * value — call after the user finishes typing their email.
+ */
+export function useSsoLookup(domain) {
+    const api = useAuthApi();
+    return useQuery({
+        queryKey: authQueryKeys.ssoLookup(domain),
+        queryFn: () => api.ssoLookup(domain),
+        enabled: domain.length > 0,
+    });
+}
+//# sourceMappingURL=queries.js.map

package/dist/model/queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../src/model/queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAejD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;GAIG;AAEH,2FAA2F;AAC3F,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,aAAa,CAAC,YAAY,EAAE;QACtC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE;QACjC,SAAS,EAAE,CAAC,GAAG,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,KAAK,CACnB,OAAO,GAAG,IAAI;IAEd,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE;QAC5B,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE;QACvB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,iBAAiB;IAI/B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,aAAa,CAAC,cAAc,EAAE;QACxC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB;IAIhC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,aAAa,CAAC,eAAe,EAAE;QACzC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,EAAE;KACrC,CAAC,CAAC;AACL,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,WAAW;IAIzB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,WAAW;IAIzB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,WAAW,CACzB,IAAI,GAAG,CAAC;IAER,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QACnC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,sBAAsB,CACpC,OAAmB;IAEnB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9C,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc;IAEd,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;QACzC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC;QACpC,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC"}

package/dist/model/queryKeys.d.ts

@@ -0,0 +1,13 @@
+export declare const authQueryKeys: {
+    readonly all: readonly ["auth"];
+    capabilities(): readonly ["auth", "capabilities"];
+    me(): readonly ["auth", "me"];
+    securityStatus(): readonly ["auth", "security", "status"];
+    passwordMethods(): readonly ["auth", "password", "methods"];
+    sessions(): readonly ["auth", "sessions"];
+    passkeys(): readonly ["auth", "passkeys"];
+    audit(page: number): readonly ["auth", "audit", number];
+    delayedChange(channel: string): readonly ["auth", "change", "delayed", string];
+    ssoLookup(domain: string): readonly ["auth", "sso", "lookup", string];
+};
+//# sourceMappingURL=queryKeys.d.ts.map

package/dist/model/queryKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryKeys.d.ts","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,aAAa,EAAE;IAC1B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,YAAY,IAAI,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAClD,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9B,cAAc,IAAI,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC1D,eAAe,IAAI,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5D,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1C,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/E,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;CAYvE,CAAC"}

package/dist/model/queryKeys.js

@@ -0,0 +1,21 @@
+/**
+ * Namespaced TanStack Query keys (frontend-standard §2 — "ключи неймспейснуты").
+ * Everything under the `"auth"` root so a host can invalidate the whole module
+ * or match a single resource. Persist scope is per-user via core's query
+ * runtime (`setPersistUser`). Explicit tuple return types satisfy
+ * `--isolatedDeclarations`.
+ */
+const ROOT = "auth";
+export const authQueryKeys = {
+    all: [ROOT],
+    capabilities: () => [ROOT, "capabilities"],
+    me: () => [ROOT, "me"],
+    securityStatus: () => [ROOT, "security", "status"],
+    passwordMethods: () => [ROOT, "password", "methods"],
+    sessions: () => [ROOT, "sessions"],
+    passkeys: () => [ROOT, "passkeys"],
+    audit: (page) => [ROOT, "audit", page],
+    delayedChange: (channel) => [ROOT, "change", "delayed", channel],
+    ssoLookup: (domain) => [ROOT, "sso", "lookup", domain],
+};
+//# sourceMappingURL=queryKeys.js.map

package/dist/model/queryKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryKeys.js","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,MAAe,CAAC;AAE7B,MAAM,CAAC,MAAM,aAAa,GAWtB;IACF,GAAG,EAAE,CAAC,IAAI,CAAC;IACX,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC;IAC1C,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;IACtB,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC;IAClD,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC;IACpD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;IAClC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;IAClC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;IACtC,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;IAChE,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;CACvD,CAAC"}

package/dist/model/runtime.d.ts

@@ -0,0 +1,39 @@
+import type { Analytics, PersistStorage, StapelClient } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { VerificationController } from "../flows/verificationFlow.js";
+import type { AuthSession, TeardownReason } from "./session.js";
+/**
+ * The wired auth runtime — the one place the flagship seams are connected
+ * (frontend-standard §2). It builds a {@link StapelClient} whose `getToken` /
+ * `onAuthRefresh` come from the {@link AuthSession} and whose
+ * `onVerificationChallenge` is the {@link VerificationController}'s handler, so
+ * the step-up factor flow and token rotation "just work" for every request.
+ *
+ * The returned `client` is what the host injects into core's
+ * `StapelConfigProvider` (as the default or the `"auth"` module client),
+ * preserving the client-injection fork seam of §7.2.
+ */
+export interface AuthRuntime {
+    readonly client: StapelClient;
+    readonly api: AuthApi;
+    readonly session: AuthSession;
+    readonly verification: VerificationController;
+    readonly analytics: Analytics | null;
+}
+export interface CreateAuthRuntimeOptions {
+    /** e.g. `/auth/api` or `https://app.example.com/auth/api`. */
+    readonly baseUrl: string;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly storage?: PersistStorage;
+    readonly analytics?: Analytics | null;
+    /** Cookie mode (httponly JWT cookies) vs header/bearer. Default false. */
+    readonly cookieMode?: boolean;
+    /** Called after a session teardown (revoked/expired/logout). */
+    readonly onTeardown?: (reason: TeardownReason) => void;
+    /** Extra headers merged into every request (e.g. a captcha or tenant id). */
+    readonly defaultHeaders?: Record<string, string>;
+    /** THIN WebAuthn binding for the passkey verification factor. */
+    readonly webauthnGet?: (options: Record<string, unknown>) => Promise<unknown>;
+}
+export declare function createAuthRuntime(options: CreateAuthRuntimeOptions): AuthRuntime;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/model/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/model/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAIjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;IACvD,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/E;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,wBAAwB,GAChC,WAAW,CA4Cb"}

package/dist/model/runtime.js

@@ -0,0 +1,44 @@
+import { createStapelClient } from "@stapel/core";
+import { createAuthApi } from "../api/authApi.js";
+import { createVerificationController, } from "../flows/verificationFlow.js";
+import { createAuthSession } from "./session.js";
+export function createAuthRuntime(options) {
+    const analytics = options.analytics ?? null;
+    // `api` is assigned after the client exists; session/verification reference
+    // it lazily through the holder, breaking the client↔session/verification
+    // wiring cycle without a reassigned `let`.
+    const holder = { current: null };
+    const getApi = () => {
+        if (holder.current === null) {
+            throw new Error("auth runtime used before initialization");
+        }
+        return holder.current;
+    };
+    const session = createAuthSession({
+        api: getApi,
+        ...(options.storage !== undefined ? { storage: options.storage } : {}),
+        cookieMode: options.cookieMode ?? false,
+        ...(options.onTeardown !== undefined ? { onTeardown: options.onTeardown } : {}),
+    });
+    const verification = createVerificationController({
+        api: getApi,
+        analytics,
+        ...(options.webauthnGet !== undefined
+            ? { webauthnGet: options.webauthnGet }
+            : {}),
+    });
+    const client = createStapelClient({
+        baseUrl: options.baseUrl,
+        ...(options.fetch !== undefined ? { fetch: options.fetch } : {}),
+        getToken: () => session.getAccessToken(),
+        onAuthRefresh: () => session.onAuthRefresh(),
+        onVerificationChallenge: verification.handler,
+        ...(options.defaultHeaders !== undefined
+            ? { defaultHeaders: options.defaultHeaders }
+            : {}),
+    });
+    const api = createAuthApi(client);
+    holder.current = api;
+    return { client, api, session, verification, analytics };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/model/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/model/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EACL,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAsCjD,MAAM,UAAU,iBAAiB,CAC/B,OAAiC;IAEjC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAE5C,4EAA4E;IAC5E,yEAAyE;IACzE,2CAA2C;IAC3C,MAAM,MAAM,GAAgC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAY,EAAE;QAC3B,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,GAAG,EAAE,MAAM;QACX,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;QACvC,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,4BAA4B,CAAC;QAChD,GAAG,EAAE,MAAM;QACX,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;YACtC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE;QACxC,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE;QAC5C,uBAAuB,EAAE,YAAY,CAAC,OAAO;QAC7C,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC;IAErB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC"}

package/dist/model/session.d.ts

@@ -0,0 +1,50 @@
+import type { PersistStorage } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { AuthResponse, AuthTokens, StapelUser } from "../api/types.js";
+/**
+ * Why a session teardown fired (auth-sa.md §13, §19.3):
+ *  - `revoked`  — refresh token replayed/blacklisted (`error.401.refresh_revoked`);
+ *    a stolen-token signal, hard logout.
+ *  - `expired`  — refresh failed for any other reason (TTL, network).
+ *  - `logout`   — explicit user logout.
+ */
+export type TeardownReason = "revoked" | "expired" | "logout";
+export interface AuthSessionState {
+    readonly user: StapelUser | null;
+    readonly tokens: AuthTokens | null;
+    readonly status: "anonymous" | "authenticated";
+}
+export interface AuthSession {
+    getState(): AuthSessionState;
+    subscribe(listener: () => void): () => void;
+    /** For `createStapelClient({ getToken })`. Header mode only; cookie mode → null. */
+    getAccessToken(): string | null;
+    /** For `createStapelClient({ onAuthRefresh })`. Dedups + breaks recursion. */
+    onAuthRefresh(): Promise<string | null>;
+    /** Commit a session from any AuthResponse (login/register/merge/modify). */
+    adopt(response: AuthResponse): void;
+    /** Store a bare token pair (e.g. QR `login_request` fulfilment). */
+    setTokens(tokens: AuthTokens): void;
+    /** Explicit logout: revoke server-side, then tear down locally. */
+    logout(): Promise<void>;
+    /** Load a persisted session (call once on mount). */
+    restore(): Promise<void>;
+}
+export interface AuthSessionOptions {
+    /** Lazy to break the client↔session wiring cycle (see README). */
+    readonly api: AuthApi | (() => AuthApi);
+    /** Persist backend. Default: core's IndexedDB→localStorage→memory. */
+    readonly storage?: PersistStorage;
+    /** Persist key. Default `"stapel-auth:session"`. */
+    readonly persistKey?: string;
+    /**
+     * Cookie mode: the backend sets httponly JWT cookies, so no bearer token is
+     * attached and refresh uses `GET /token/refresh/` (cookie). `getAccessToken`
+     * returns null. Default `false` (header/bearer mode).
+     */
+    readonly cookieMode?: boolean;
+    /** Notified after a teardown so the host can purge caches / redirect. */
+    readonly onTeardown?: (reason: TeardownReason) => void;
+}
+export declare function createAuthSession(options: AuthSessionOptions): AuthSession;
+//# sourceMappingURL=session.d.ts.map

package/dist/model/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/model/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,eAAe,CAAC;CAChD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,IAAI,gBAAgB,CAAC;IAC7B,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5C,oFAAoF;IACpF,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,8EAA8E;IAC9E,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,oEAAoE;IACpE,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,mEAAmE;IACnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,qDAAqD;IACrD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC;IACxC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;CACxD;AAID,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAmI1E"}

package/dist/model/session.js

@@ -0,0 +1,124 @@
+import { StapelApiError } from "@stapel/core";
+const REFRESH_REVOKED = "error.401.refresh_revoked";
+export function createAuthSession(options) {
+    const persistKey = options.persistKey ?? "stapel-auth:session";
+    const cookieMode = options.cookieMode ?? false;
+    const resolveApi = () => typeof options.api === "function" ? options.api() : options.api;
+    let state = {
+        user: null,
+        tokens: null,
+        status: "anonymous",
+    };
+    const listeners = new Set();
+    // Recursion guard: while the refresh network call is in flight, its own 401
+    // must NOT re-enter refresh (that call goes through the same client).
+    let refreshing = false;
+    let inFlight = null;
+    function notify() {
+        for (const listener of listeners)
+            listener();
+    }
+    function setState(next) {
+        state = next;
+        notify();
+    }
+    function persist() {
+        // Only persist when a storage backend is configured; otherwise the session
+        // stays in memory for the page lifetime.
+        const storage = options.storage;
+        if (storage) {
+            void storage.set(persistKey, { user: state.user, tokens: state.tokens });
+        }
+    }
+    function adopt(response) {
+        setState({
+            user: response.user,
+            tokens: response.tokens,
+            status: "authenticated",
+        });
+        persist();
+    }
+    function setTokens(tokens) {
+        setState({ ...state, tokens, status: "authenticated" });
+        persist();
+    }
+    function clearLocal() {
+        setState({ user: null, tokens: null, status: "anonymous" });
+        const storage = options.storage;
+        if (storage)
+            void storage.del(persistKey);
+    }
+    function teardown(reason) {
+        clearLocal();
+        options.onTeardown?.(reason);
+    }
+    async function doRefresh() {
+        const refreshToken = state.tokens?.refresh ?? null;
+        if (!cookieMode && refreshToken === null) {
+            teardown("expired");
+            return null;
+        }
+        refreshing = true;
+        try {
+            const r = await resolveApi().tokenRefresh(cookieMode ? undefined : (refreshToken ?? undefined));
+            setTokens({ access: r.access, refresh: r.refresh });
+            return r.access;
+        }
+        catch (error) {
+            const code = error instanceof StapelApiError ? error.code : "";
+            teardown(code === REFRESH_REVOKED ? "revoked" : "expired");
+            return null;
+        }
+        finally {
+            refreshing = false;
+        }
+    }
+    function onAuthRefresh() {
+        if (refreshing)
+            return Promise.resolve(null);
+        if (inFlight)
+            return inFlight;
+        inFlight = doRefresh().finally(() => {
+            inFlight = null;
+        });
+        return inFlight;
+    }
+    async function logout() {
+        try {
+            await resolveApi().logout();
+        }
+        catch {
+            // Best-effort — tear down locally regardless.
+        }
+        teardown("logout");
+    }
+    async function restore() {
+        const storage = options.storage;
+        if (!storage)
+            return;
+        const stored = (await storage.get(persistKey));
+        if (stored && (stored.tokens !== null || stored.user !== null)) {
+            setState({
+                user: stored.user,
+                tokens: stored.tokens,
+                status: stored.tokens !== null ? "authenticated" : "anonymous",
+            });
+        }
+    }
+    return {
+        getState: () => state,
+        subscribe: (listener) => {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+        getAccessToken: () => (cookieMode ? null : (state.tokens?.access ?? null)),
+        onAuthRefresh,
+        adopt,
+        setTokens,
+        logout,
+        restore,
+    };
+}
+//# sourceMappingURL=session.js.map

package/dist/model/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/model/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAsD9C,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAEpD,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAY,EAAE,CAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAElE,IAAI,KAAK,GAAqB;QAC5B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;KACpB,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAExC,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,QAAQ,GAAkC,IAAI,CAAC;IAEnD,SAAS,MAAM;QACb,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,SAAS,QAAQ,CAAC,IAAsB;QACtC,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,EAAE,CAAC;IACX,CAAC;IAED,SAAS,OAAO;QACd,2EAA2E;QAC3E,yCAAyC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,SAAS,KAAK,CAAC,QAAsB;QACnC,QAAQ,CAAC;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,SAAS,SAAS,CAAC,MAAkB;QACnC,QAAQ,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,SAAS,UAAU;QACjB,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO;YAAE,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS,QAAQ,CAAC,MAAsB;QACtC,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;QACnD,IAAI,CAAC,UAAU,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YACzC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,UAAU,EAAE,CAAC,YAAY,CACvC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,SAAS,CAAC,CACrD,CAAC;YACF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,QAAQ,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IAED,SAAS,aAAa;QACpB,IAAI,UAAU;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,QAAQ,GAAG,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC;YACH,MAAM,UAAU,EAAE,CAAC,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,OAAO;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAEhC,CAAC;QACd,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC/D,QAAQ,CAAC;gBACP,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;QACrB,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE;YACtB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC;QACJ,CAAC;QACD,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;QAC1E,aAAa;QACb,KAAK;QACL,SAAS;QACT,MAAM;QACN,OAAO;KACR,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@stapel/auth-react",
+  "version": "1.0.0",
+  "description": "Headless React flow pair for stapel-auth: typed API client, TanStack Query hooks, flow machines (OTP, password, OAuth, TOTP, sessions, passkeys, QR, magic links, SSO), and the step-up verification factor flow. Zero visual opinion.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/usestapel/stapel-react.git",
+    "directory": "packages/auth-react"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "tsconfig.json",
+    "README.md",
+    "MODULE.md",
+    "CHANGELOG.md"
+  ],
+  "size-limit": [
+    {
+      "path": "dist/index.js",
+      "limit": "10 KB"
+    }
+  ],
+  "peerDependencies": {
+    "@tanstack/react-query": "^5.0.0",
+    "react": ">=19",
+    "@stapel/core": "^0.2.0"
+  },
+  "devDependencies": {
+    "@size-limit/preset-small-lib": "^11.2.0",
+    "@tanstack/react-query": "^5.81.0",
+    "@testing-library/react": "^16.3.0",
+    "@types/react": "^19.1.0",
+    "@types/react-dom": "^19.1.0",
+    "jsdom": "^26.1.0",
+    "msw": "^2.10.2",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "size-limit": "^11.2.0",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4",
+    "@stapel/core": "^0.2.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "lint": "eslint .",
+    "size": "size-limit"
+  }
+}