@ttt-productions/auth-core 1.6.15 → 1.6.17

package/dist/index.js

@@ -1,13 +1,5 @@
-// Pure root: contracts, claims parsing, normalized errors, environment helpers.
-// Nothing here imports firebase/auth at runtime.
-//
-// Client auth runtime (onAuthStateChanged wrapper, getAuthUser) lives behind
-// "@ttt-productions/auth-core/client". Admin/Functions helpers live behind
-// "@ttt-productions/auth-core/server". React hooks live behind
-// "@ttt-productions/auth-core/react".
-export * from "./claims.js";
-export * from "./errors.js";
-export * from "./env.js";
-export * from "./acceptance.js";
-export * from "./email-verification.js";
+export * from './errors.js';
+export * from './env.js';
+export * from './acceptance.js';
+export * from './email-verification.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iDAAiD;AACjD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,+DAA+D;AAC/D,sCAAsC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC","sourcesContent":["// Pure root: contracts, claims parsing, normalized errors, environment helpers.\n// Nothing here imports firebase/auth at runtime.\n//\n// Client auth runtime (onAuthStateChanged wrapper, getAuthUser) lives behind\n// \"@ttt-productions/auth-core/client\". Admin/Functions helpers live behind\n// \"@ttt-productions/auth-core/server\". React hooks live behind\n// \"@ttt-productions/auth-core/react\".\nexport * from \"./claims.js\";\nexport * from \"./errors.js\";\nexport * from \"./env.js\";\nexport * from \"./acceptance.js\";\nexport * from \"./email-verification.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC","sourcesContent":["export * from './errors.js';\nexport * from './env.js';\nexport * from './acceptance.js';\nexport * from './email-verification.js';\n"]}

package/dist/react/AuthProvider.d.ts

@@ -1,10 +1,10 @@
-import { type ReactNode } from "react";
-import type { AuthProviderConfig, AuthContextValue } from "./types.js";
+import { type ReactNode } from 'react';
+import type { AuthProviderConfig, AuthContextValue } from './types.js';
 export declare const AuthContext: import("react").Context<AuthContextValue<any> | null>;
 interface AuthProviderProps<TClaims> {
     config: AuthProviderConfig<TClaims>;
     children: ReactNode;
 }
-export declare function AuthProvider<TClaims = Record<string, unknown>>({ config, children }: AuthProviderProps<TClaims>): import("react").JSX.Element;
+export declare function AuthProvider<TClaims = Record<string, unknown>>({ config, children, }: AuthProviderProps<TClaims>): import("react").JSX.Element;
 export {};
 //# sourceMappingURL=AuthProvider.d.ts.map

package/dist/react/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAIf,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAavE,eAAO,MAAM,WAAW,uDAAoD,CAAC;AAE7E,UAAU,iBAAiB,CAAC,OAAO;IACjC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,CAAC,OAAO,CAAC,+BA8HjD"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAIf,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAQvE,eAAO,MAAM,WAAW,uDAAoD,CAAC;AAE7E,UAAU,iBAAiB,CAAC,OAAO;IACjC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC9D,MAAM,EACN,QAAQ,GACT,EAAE,iBAAiB,CAAC,OAAO,CAAC,+BAwG5B"}

package/dist/react/AuthProvider.js

@@ -1,27 +1,18 @@
-"use client";
+'use client';
 import { jsx as _jsx } from "react/jsx-runtime";
-import { createContext, useEffect, useRef, useState, useCallback, useMemo, } from "react";
-import { useAuthState } from "./useAuthState.js";
-import { getIdTokenClaims } from "../claims.js";
+import { createContext, useEffect, useRef, useState, useCallback, useMemo, } from 'react';
+import { useAuthState } from './useAuthState.js';
+import { getIdTokenClaims } from '../client/claims.js';
 export const AuthContext = createContext(null);
-export function AuthProvider({ config, children }) {
+export function AuthProvider({ config, children, }) {
     const { user, loading: authLoading } = useAuthState(config.auth);
-    // Claims are held with the session they were read for and derived at render (below), so a
-    // render can never pair one account's `user` with another account's claims, and a read that
-    // settles after the session changed (a late refresh, a slow initial read) is dropped.
     const [resolved, setResolved] = useState(null);
     const generationRef = useRef(0);
     const appliedGenerationRef = useRef(0);
     const currentUserRef = useRef(user);
     currentUserRef.current = user;
-    // Stable config ref so effects don't re-fire on config object identity changes
     const configRef = useRef(config);
     configRef.current = config;
-    /**
-     * Read `forUser`'s claims under a new generation and apply them only if `forUser` is still
-     * the signed-in session and no newer read has applied. A failed read leaves the session's
-     * claims as they are, or settles an unread session on the default claims.
-     */
     const readClaims = useCallback(async (forUser, read, context) => {
         const generation = ++generationRef.current;
         try {
@@ -29,7 +20,11 @@ export function AuthProvider({ config, children }) {
             if (currentUserRef.current !== forUser || generation <= appliedGenerationRef.current)
                 return;
             appliedGenerationRef.current = generation;
-            setResolved({ user: forUser, generation, claims: configRef.current.parseClaims(raw ?? {}) });
+            setResolved({
+                user: forUser,
+                generation,
+                claims: configRef.current.parseClaims(raw ?? {}),
+            });
         }
         catch (err) {
             if (currentUserRef.current !== forUser)
@@ -40,9 +35,6 @@ export function AuthProvider({ config, children }) {
                 : { user: forUser, generation, claims: configRef.current.defaultClaims });
         }
     }, []);
-    // --- Optional readiness gate (see AuthProviderConfig.readyGate) ---
-    // Open immediately when no gate is configured; otherwise held closed until the
-    // gate settles. Fail-open: a rejected gate is reported and then treated as open.
     const [gateOpen, setGateOpen] = useState(() => !config.readyGate);
     useEffect(() => {
         const gate = configRef.current.readyGate;
@@ -51,16 +43,15 @@ export function AuthProvider({ config, children }) {
         let cancelled = false;
         Promise.resolve()
             .then(() => gate())
-            .catch((err) => configRef.current.onError?.(err, "readyGate"))
+            .catch((err) => configRef.current.onError?.(err, 'readyGate'))
             .finally(() => {
             if (!cancelled)
                 setGateOpen(true);
         });
-        return () => { cancelled = true; };
-        // Mount-only by design (reads only the stable configRef): the gate is a
-        // one-time client readiness signal.
+        return () => {
+            cancelled = true;
+        };
     }, []);
-    // --- Claims fetching ---
     useEffect(() => {
         if (authLoading)
             return;
@@ -70,28 +61,19 @@ export function AuthProvider({ config, children }) {
             return;
         }
         configRef.current.onAuthStateChange?.(user);
-        void readClaims(user, async () => ((await getIdTokenClaims(user)) ?? {}), "getIdTokenClaims");
+        void readClaims(user, async () => ((await getIdTokenClaims(user)) ?? {}), 'getIdTokenClaims');
     }, [user, authLoading, readClaims]);
-    // --- refreshClaims ---
     const refreshClaims = useCallback(async () => {
-        // The LIVE signed-in user, never the one this render saw: a caller can hold this callback from
-        // before its own sign-in (a registration's submit handler creates the account and then asks for
-        // the claims the server just set), and a refresh of that render's `null` user would do nothing —
-        // leaving the new account on its pre-claim token until the hourly refresh.
+        // `auth.currentUser`, not this render's user: a caller can hold this callback from before its own sign-in.
         const liveUser = configRef.current.auth.currentUser;
         if (!liveUser)
             return;
-        await readClaims(liveUser, async () => ((await liveUser.getIdTokenResult(true)).claims ?? {}), "refreshClaims");
+        await readClaims(liveUser, async () => ((await liveUser.getIdTokenResult(true)).claims ?? {}), 'refreshClaims');
     }, [readClaims]);
-    // --- Derived at render: only the current session's claims are ever exposed ---
     const sessionClaims = user && resolved?.user === user ? resolved : null;
     const claimsLoading = authLoading || (user !== null && sessionClaims === null);
-    // While the gate is closed a restored session is held back from consumers: a uid-keyed
-    // subscription opened before the gate's readiness signal is rejected once and dies, so no
-    // consumer may see a uid (or that session's claims) until the gate opens or fails open.
     const exposedUser = gateOpen ? user : null;
     const claims = exposedUser && sessionClaims ? sessionClaims.claims : config.defaultClaims;
-    // --- Context value ---
     const loading = authLoading || claimsLoading || !gateOpen;
     const value = useMemo(() => ({
         user: exposedUser,
@@ -102,6 +84,6 @@ export function AuthProvider({ config, children }) {
         isAuthenticated: !!exposedUser,
         refreshClaims,
     }), [exposedUser, claims, loading, authLoading, claimsLoading, refreshClaims]);
-    return (_jsx(AuthContext.Provider, { value: value, children: children }));
+    return _jsx(AuthContext.Provider, { value: value, children: children });
 }
 //# sourceMappingURL=AuthProvider.js.map

package/dist/react/AuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EACL,aAAa,EACb,SAAS,EACT,MAAM,EACN,QAAQ,EACR,WAAW,EACX,OAAO,GAER,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAchD,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAA+B,IAAI,CAAC,CAAC;AAO7E,MAAM,UAAU,YAAY,CAC1B,EAAE,MAAM,EAAE,QAAQ,EAA8B;IAEhD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEjE,0FAA0F;IAC1F,4FAA4F;IAC5F,sFAAsF;IACtF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAiC,IAAI,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAc,IAAI,CAAC,CAAC;IACjD,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;IAE9B,+EAA+E;IAC/E,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC;IAE3B;;;;OAIG;IACH,MAAM,UAAU,GAAG,WAAW,CAC5B,KAAK,EAAE,OAAa,EAAE,IAAmD,EAAE,OAAe,EAAE,EAAE;QAC5F,MAAM,UAAU,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,IAAI,cAAc,CAAC,OAAO,KAAK,OAAO,IAAI,UAAU,IAAI,oBAAoB,CAAC,OAAO;gBAAE,OAAO;YAC7F,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;YAC1C,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO;YAC/C,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAC3B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,qEAAqE;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;aAClB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;aAC7D,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,wEAAwE;QACxE,oCAAoC;IACtC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,0BAA0B;IAC1B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,WAAW;YAAE,OAAO;QAExB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,UAAU,CACb,IAAI,EACJ,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAA4B,EAC7E,kBAAkB,CACnB,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAEpC,wBAAwB;IACxB,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,+FAA+F;QAC/F,gGAAgG;QAChG,iGAAiG;QACjG,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,UAAU,CACd,QAAQ,EACR,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAA4B,EAC7F,eAAe,CAChB,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,gFAAgF;IAChF,MAAM,aAAa,GAAG,IAAI,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,aAAa,GAAG,WAAW,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,CAAC,CAAC;IAE/E,uFAAuF;IACvF,0FAA0F;IAC1F,wFAAwF;IACxF,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,IAAI,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;IAE1F,wBAAwB;IACxB,MAAM,OAAO,GAAG,WAAW,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC;IAE1D,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC;QACL,IAAI,EAAE,WAAW;QACjB,MAAM;QACN,OAAO;QACP,WAAW;QACX,aAAa;QACb,eAAe,EAAE,CAAC,CAAC,WAAW;QAC9B,aAAa;KACd,CAAC,EACF,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAC1E,CAAC;IAEF,OAAO,CACL,KAAC,WAAW,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAC/B,QAAQ,GACY,CACxB,CAAC;AACJ,CAAC","sourcesContent":["\"use client\";\n\nimport {\n  createContext,\n  useEffect,\n  useRef,\n  useState,\n  useCallback,\n  useMemo,\n  type ReactNode,\n} from \"react\";\nimport type { User } from \"firebase/auth\";\nimport { useAuthState } from \"./useAuthState.js\";\nimport { getIdTokenClaims } from \"../claims.js\";\nimport type { AuthProviderConfig, AuthContextValue } from \"./types.js\";\n\n/**\n * Claims resolved for one signed-in session. `user` is the Firebase `User` instance (it carries\n * the uid and is replaced on every sign-in), and `generation` orders the reads that produced it.\n */\ninterface ResolvedClaims<TClaims> {\n  user: User;\n  generation: number;\n  claims: TClaims;\n}\n\n \nexport const AuthContext = createContext<AuthContextValue<any> | null>(null);\n\ninterface AuthProviderProps<TClaims> {\n  config: AuthProviderConfig<TClaims>;\n  children: ReactNode;\n}\n\nexport function AuthProvider<TClaims = Record<string, unknown>>(\n  { config, children }: AuthProviderProps<TClaims>,\n) {\n  const { user, loading: authLoading } = useAuthState(config.auth);\n\n  // Claims are held with the session they were read for and derived at render (below), so a\n  // render can never pair one account's `user` with another account's claims, and a read that\n  // settles after the session changed (a late refresh, a slow initial read) is dropped.\n  const [resolved, setResolved] = useState<ResolvedClaims<TClaims> | null>(null);\n  const generationRef = useRef(0);\n  const appliedGenerationRef = useRef(0);\n  const currentUserRef = useRef<User | null>(user);\n  currentUserRef.current = user;\n\n  // Stable config ref so effects don't re-fire on config object identity changes\n  const configRef = useRef(config);\n  configRef.current = config;\n\n  /**\n   * Read `forUser`'s claims under a new generation and apply them only if `forUser` is still\n   * the signed-in session and no newer read has applied. A failed read leaves the session's\n   * claims as they are, or settles an unread session on the default claims.\n   */\n  const readClaims = useCallback(\n    async (forUser: User, read: () => Promise<Record<string, unknown> | null>, context: string) => {\n      const generation = ++generationRef.current;\n      try {\n        const raw = await read();\n        if (currentUserRef.current !== forUser || generation <= appliedGenerationRef.current) return;\n        appliedGenerationRef.current = generation;\n        setResolved({ user: forUser, generation, claims: configRef.current.parseClaims(raw ?? {}) });\n      } catch (err) {\n        if (currentUserRef.current !== forUser) return;\n        configRef.current.onError?.(err, context);\n        setResolved((prev) =>\n          prev && prev.user === forUser\n            ? prev\n            : { user: forUser, generation, claims: configRef.current.defaultClaims },\n        );\n      }\n    },\n    [],\n  );\n\n  // --- Optional readiness gate (see AuthProviderConfig.readyGate) ---\n  // Open immediately when no gate is configured; otherwise held closed until the\n  // gate settles. Fail-open: a rejected gate is reported and then treated as open.\n  const [gateOpen, setGateOpen] = useState(() => !config.readyGate);\n  useEffect(() => {\n    const gate = configRef.current.readyGate;\n    if (!gate) return;\n    let cancelled = false;\n    Promise.resolve()\n      .then(() => gate())\n      .catch((err) => configRef.current.onError?.(err, \"readyGate\"))\n      .finally(() => {\n        if (!cancelled) setGateOpen(true);\n      });\n    return () => { cancelled = true; };\n    // Mount-only by design (reads only the stable configRef): the gate is a\n    // one-time client readiness signal.\n  }, []);\n\n  // --- Claims fetching ---\n  useEffect(() => {\n    if (authLoading) return;\n\n    if (!user) {\n      setResolved(null);\n      configRef.current.onAuthStateChange?.(null);\n      return;\n    }\n\n    configRef.current.onAuthStateChange?.(user);\n    void readClaims(\n      user,\n      async () => ((await getIdTokenClaims(user)) ?? {}) as Record<string, unknown>,\n      \"getIdTokenClaims\",\n    );\n  }, [user, authLoading, readClaims]);\n\n  // --- refreshClaims ---\n  const refreshClaims = useCallback(async () => {\n    // The LIVE signed-in user, never the one this render saw: a caller can hold this callback from\n    // before its own sign-in (a registration's submit handler creates the account and then asks for\n    // the claims the server just set), and a refresh of that render's `null` user would do nothing —\n    // leaving the new account on its pre-claim token until the hourly refresh.\n    const liveUser = configRef.current.auth.currentUser;\n    if (!liveUser) return;\n    await readClaims(\n      liveUser,\n      async () => ((await liveUser.getIdTokenResult(true)).claims ?? {}) as Record<string, unknown>,\n      \"refreshClaims\",\n    );\n  }, [readClaims]);\n\n  // --- Derived at render: only the current session's claims are ever exposed ---\n  const sessionClaims = user && resolved?.user === user ? resolved : null;\n  const claimsLoading = authLoading || (user !== null && sessionClaims === null);\n\n  // While the gate is closed a restored session is held back from consumers: a uid-keyed\n  // subscription opened before the gate's readiness signal is rejected once and dies, so no\n  // consumer may see a uid (or that session's claims) until the gate opens or fails open.\n  const exposedUser = gateOpen ? user : null;\n  const claims = exposedUser && sessionClaims ? sessionClaims.claims : config.defaultClaims;\n\n  // --- Context value ---\n  const loading = authLoading || claimsLoading || !gateOpen;\n\n  const value = useMemo<AuthContextValue<TClaims>>(\n    () => ({\n      user: exposedUser,\n      claims,\n      loading,\n      authLoading,\n      claimsLoading,\n      isAuthenticated: !!exposedUser,\n      refreshClaims,\n    }),\n    [exposedUser, claims, loading, authLoading, claimsLoading, refreshClaims],\n  );\n\n  return (\n    <AuthContext.Provider value={value}>\n      {children}\n    </AuthContext.Provider>\n  );\n}\n"]}
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EACL,aAAa,EACb,SAAS,EACT,MAAM,EACN,QAAQ,EACR,WAAW,EACX,OAAO,GAER,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAA+B,IAAI,CAAC,CAAC;AAO7E,MAAM,UAAU,YAAY,CAAoC,EAC9D,MAAM,EACN,QAAQ,GACmB;IAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAiC,IAAI,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAc,IAAI,CAAC,CAAC;IACjD,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;IAE9B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC;IAE3B,MAAM,UAAU,GAAG,WAAW,CAC5B,KAAK,EAAE,OAAa,EAAE,IAAmD,EAAE,OAAe,EAAE,EAAE;QAC5F,MAAM,UAAU,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,IAAI,cAAc,CAAC,OAAO,KAAK,OAAO,IAAI,UAAU,IAAI,oBAAoB,CAAC,OAAO;gBAClF,OAAO;YACT,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;YAC1C,WAAW,CAAC;gBACV,IAAI,EAAE,OAAO;gBACb,UAAU;gBACV,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO;YAC/C,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1C,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAC3B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;aAClB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;aAC7D,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,WAAW;YAAE,OAAO;QAExB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,UAAU,CACb,IAAI,EACJ,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAA4B,EAC7E,kBAAkB,CACnB,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAEpC,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,2GAA2G;QAC3G,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,UAAU,CACd,QAAQ,EACR,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAA4B,EAC7F,eAAe,CAChB,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,aAAa,GAAG,IAAI,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,aAAa,GAAG,WAAW,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,CAAC,CAAC;IAE/E,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,IAAI,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;IAE1F,MAAM,OAAO,GAAG,WAAW,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC;IAE1D,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC;QACL,IAAI,EAAE,WAAW;QACjB,MAAM;QACN,OAAO;QACP,WAAW;QACX,aAAa;QACb,eAAe,EAAE,CAAC,CAAC,WAAW;QAC9B,aAAa;KACd,CAAC,EACF,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAC1E,CAAC;IAEF,OAAO,KAAC,WAAW,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAAwB,CAAC;AAC/E,CAAC","sourcesContent":["'use client';\n\nimport {\n  createContext,\n  useEffect,\n  useRef,\n  useState,\n  useCallback,\n  useMemo,\n  type ReactNode,\n} from 'react';\nimport type { User } from 'firebase/auth';\nimport { useAuthState } from './useAuthState.js';\nimport { getIdTokenClaims } from '../client/claims.js';\nimport type { AuthProviderConfig, AuthContextValue } from './types.js';\n\ninterface ResolvedClaims<TClaims> {\n  user: User;\n  generation: number;\n  claims: TClaims;\n}\n\nexport const AuthContext = createContext<AuthContextValue<any> | null>(null);\n\ninterface AuthProviderProps<TClaims> {\n  config: AuthProviderConfig<TClaims>;\n  children: ReactNode;\n}\n\nexport function AuthProvider<TClaims = Record<string, unknown>>({\n  config,\n  children,\n}: AuthProviderProps<TClaims>) {\n  const { user, loading: authLoading } = useAuthState(config.auth);\n\n  const [resolved, setResolved] = useState<ResolvedClaims<TClaims> | null>(null);\n  const generationRef = useRef(0);\n  const appliedGenerationRef = useRef(0);\n  const currentUserRef = useRef<User | null>(user);\n  currentUserRef.current = user;\n\n  const configRef = useRef(config);\n  configRef.current = config;\n\n  const readClaims = useCallback(\n    async (forUser: User, read: () => Promise<Record<string, unknown> | null>, context: string) => {\n      const generation = ++generationRef.current;\n      try {\n        const raw = await read();\n        if (currentUserRef.current !== forUser || generation <= appliedGenerationRef.current)\n          return;\n        appliedGenerationRef.current = generation;\n        setResolved({\n          user: forUser,\n          generation,\n          claims: configRef.current.parseClaims(raw ?? {}),\n        });\n      } catch (err) {\n        if (currentUserRef.current !== forUser) return;\n        configRef.current.onError?.(err, context);\n        setResolved((prev) =>\n          prev && prev.user === forUser\n            ? prev\n            : { user: forUser, generation, claims: configRef.current.defaultClaims },\n        );\n      }\n    },\n    [],\n  );\n\n  const [gateOpen, setGateOpen] = useState(() => !config.readyGate);\n  useEffect(() => {\n    const gate = configRef.current.readyGate;\n    if (!gate) return;\n    let cancelled = false;\n    Promise.resolve()\n      .then(() => gate())\n      .catch((err) => configRef.current.onError?.(err, 'readyGate'))\n      .finally(() => {\n        if (!cancelled) setGateOpen(true);\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, []);\n\n  useEffect(() => {\n    if (authLoading) return;\n\n    if (!user) {\n      setResolved(null);\n      configRef.current.onAuthStateChange?.(null);\n      return;\n    }\n\n    configRef.current.onAuthStateChange?.(user);\n    void readClaims(\n      user,\n      async () => ((await getIdTokenClaims(user)) ?? {}) as Record<string, unknown>,\n      'getIdTokenClaims',\n    );\n  }, [user, authLoading, readClaims]);\n\n  const refreshClaims = useCallback(async () => {\n    // `auth.currentUser`, not this render's user: a caller can hold this callback from before its own sign-in.\n    const liveUser = configRef.current.auth.currentUser;\n    if (!liveUser) return;\n    await readClaims(\n      liveUser,\n      async () => ((await liveUser.getIdTokenResult(true)).claims ?? {}) as Record<string, unknown>,\n      'refreshClaims',\n    );\n  }, [readClaims]);\n\n  const sessionClaims = user && resolved?.user === user ? resolved : null;\n  const claimsLoading = authLoading || (user !== null && sessionClaims === null);\n\n  const exposedUser = gateOpen ? user : null;\n  const claims = exposedUser && sessionClaims ? sessionClaims.claims : config.defaultClaims;\n\n  const loading = authLoading || claimsLoading || !gateOpen;\n\n  const value = useMemo<AuthContextValue<TClaims>>(\n    () => ({\n      user: exposedUser,\n      claims,\n      loading,\n      authLoading,\n      claimsLoading,\n      isAuthenticated: !!exposedUser,\n      refreshClaims,\n    }),\n    [exposedUser, claims, loading, authLoading, claimsLoading, refreshClaims],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n"]}

package/dist/react/index.d.ts

@@ -1,9 +1,9 @@
-export type { AuthState } from "./useAuthState.js";
-export { useAuthState } from "./useAuthState.js";
-export type { AuthProviderConfig, AuthContextValue } from "./types.js";
-export { AuthProvider } from "./AuthProvider.js";
-export { AuthContext } from "./AuthProvider.js";
-export { useAuth } from "./useAuth.js";
-export { useAuthGuard } from "./useAuthGuard.js";
-export type { AuthGuardConfig } from "./useAuthGuard.js";
+export type { AuthState } from './useAuthState.js';
+export { useAuthState } from './useAuthState.js';
+export type { AuthProviderConfig, AuthContextValue } from './types.js';
+export { AuthProvider } from './AuthProvider.js';
+export { AuthContext } from './AuthProvider.js';
+export { useAuth } from './useAuth.js';
+export { useAuthGuard } from './useAuthGuard.js';
+export type { AuthGuardConfig } from './useAuthGuard.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/react/index.js

@@ -1,7 +1,7 @@
-"use client";
-export { useAuthState } from "./useAuthState.js";
-export { AuthProvider } from "./AuthProvider.js";
-export { AuthContext } from "./AuthProvider.js";
-export { useAuth } from "./useAuth.js";
-export { useAuthGuard } from "./useAuthGuard.js";
+'use client';
+export { useAuthState } from './useAuthState.js';
+export { AuthProvider } from './AuthProvider.js';
+export { AuthContext } from './AuthProvider.js';
+export { useAuth } from './useAuth.js';
+export { useAuthGuard } from './useAuthGuard.js';
 //# sourceMappingURL=index.js.map

package/dist/react/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/react/index.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC","sourcesContent":["\"use client\";\n\nexport type { AuthState } from \"./useAuthState.js\";\nexport { useAuthState } from \"./useAuthState.js\";\nexport type { AuthProviderConfig, AuthContextValue } from \"./types.js\";\nexport { AuthProvider } from \"./AuthProvider.js\";\nexport { AuthContext } from \"./AuthProvider.js\";\nexport { useAuth } from \"./useAuth.js\";\nexport { useAuthGuard } from \"./useAuthGuard.js\";\nexport type { AuthGuardConfig } from \"./useAuthGuard.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/react/index.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC","sourcesContent":["'use client';\n\nexport type { AuthState } from './useAuthState.js';\nexport { useAuthState } from './useAuthState.js';\nexport type { AuthProviderConfig, AuthContextValue } from './types.js';\nexport { AuthProvider } from './AuthProvider.js';\nexport { AuthContext } from './AuthProvider.js';\nexport { useAuth } from './useAuth.js';\nexport { useAuthGuard } from './useAuthGuard.js';\nexport type { AuthGuardConfig } from './useAuthGuard.js';\n"]}

package/dist/react/redirect-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-storage.d.ts","sourceRoot":"","sources":["../../src/react/redirect-storage.ts"],"names":[],"mappings":"AAmBA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAahE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQnD"}
+{"version":3,"file":"redirect-storage.d.ts","sourceRoot":"","sources":["../../src/react/redirect-storage.ts"],"names":[],"mappings":"AAgBA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO3D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAWhE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAMnD"}

package/dist/react/redirect-storage.js

@@ -1,10 +1,7 @@
-// The post-login redirect path lives in localStorage. A browser that blocks site data throws
-// on the storage access itself (FRONTEND-010), so every access here is guarded: a blocked read
-// is "nothing saved", and a blocked write keeps the value in memory for the page's life so a
-// same-page sign-in still lands on it. Outside a browser every call is a no-op.
+// A browser that blocks site data throws on the storage access itself (RULE-STD-FRONTEND-010).
 const memory = new Map();
 function inBrowser() {
-    return typeof window !== "undefined";
+    return typeof window !== 'undefined';
 }
 function storage() {
     try {
@@ -22,9 +19,7 @@ export function readRedirectPath(key) {
         if (saved !== null)
             return saved;
     }
-    catch {
-        // Blocked store: fall through to the page-life copy.
-    }
+    catch { }
     return memory.get(key) ?? null;
 }
 export function saveRedirectPath(key, path) {
@@ -37,9 +32,7 @@ export function saveRedirectPath(key, path) {
             memory.delete(key);
             return;
         }
-        catch {
-            // Blocked store: keep the page-life copy below.
-        }
+        catch { }
     }
     memory.set(key, path);
 }
@@ -50,8 +43,6 @@ export function clearRedirectPath(key) {
     try {
         storage()?.removeItem(key);
     }
-    catch {
-        // Blocked store: nothing was persisted there.
-    }
+    catch { }
 }
 //# sourceMappingURL=redirect-storage.js.map

package/dist/react/redirect-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-storage.js","sourceRoot":"","sources":["../../src/react/redirect-storage.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,+FAA+F;AAC/F,6FAA6F;AAC7F,gFAAgF;AAEhF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzC,SAAS,SAAS;IAChB,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC;AACvC,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAY;IACxD,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC","sourcesContent":["// The post-login redirect path lives in localStorage. A browser that blocks site data throws\n// on the storage access itself (FRONTEND-010), so every access here is guarded: a blocked read\n// is \"nothing saved\", and a blocked write keeps the value in memory for the page's life so a\n// same-page sign-in still lands on it. Outside a browser every call is a no-op.\n\nconst memory = new Map<string, string>();\n\nfunction inBrowser(): boolean {\n  return typeof window !== \"undefined\";\n}\n\nfunction storage(): Storage | null {\n  try {\n    return window.localStorage;\n  } catch {\n    return null;\n  }\n}\n\nexport function readRedirectPath(key: string): string | null {\n  if (!inBrowser()) return null;\n  try {\n    const saved = storage()?.getItem(key) ?? null;\n    if (saved !== null) return saved;\n  } catch {\n    // Blocked store: fall through to the page-life copy.\n  }\n  return memory.get(key) ?? null;\n}\n\nexport function saveRedirectPath(key: string, path: string): void {\n  if (!inBrowser()) return;\n  const store = storage();\n  if (store) {\n    try {\n      store.setItem(key, path);\n      memory.delete(key);\n      return;\n    } catch {\n      // Blocked store: keep the page-life copy below.\n    }\n  }\n  memory.set(key, path);\n}\n\nexport function clearRedirectPath(key: string): void {\n  if (!inBrowser()) return;\n  memory.delete(key);\n  try {\n    storage()?.removeItem(key);\n  } catch {\n    // Blocked store: nothing was persisted there.\n  }\n}\n"]}
+{"version":3,"file":"redirect-storage.js","sourceRoot":"","sources":["../../src/react/redirect-storage.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAE/F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzC,SAAS,SAAS;IAChB,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC;AACvC,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAY;IACxD,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["// A browser that blocks site data throws on the storage access itself (RULE-STD-FRONTEND-010).\n\nconst memory = new Map<string, string>();\n\nfunction inBrowser(): boolean {\n  return typeof window !== 'undefined';\n}\n\nfunction storage(): Storage | null {\n  try {\n    return window.localStorage;\n  } catch {\n    return null;\n  }\n}\n\nexport function readRedirectPath(key: string): string | null {\n  if (!inBrowser()) return null;\n  try {\n    const saved = storage()?.getItem(key) ?? null;\n    if (saved !== null) return saved;\n  } catch {}\n  return memory.get(key) ?? null;\n}\n\nexport function saveRedirectPath(key: string, path: string): void {\n  if (!inBrowser()) return;\n  const store = storage();\n  if (store) {\n    try {\n      store.setItem(key, path);\n      memory.delete(key);\n      return;\n    } catch {}\n  }\n  memory.set(key, path);\n}\n\nexport function clearRedirectPath(key: string): void {\n  if (!inBrowser()) return;\n  memory.delete(key);\n  try {\n    storage()?.removeItem(key);\n  } catch {}\n}\n"]}

package/dist/react/types.d.ts

@@ -1,40 +1,19 @@
-import type { Auth, User } from "firebase/auth";
+import type { Auth, User } from 'firebase/auth';
 export interface AuthProviderConfig<TClaims = Record<string, unknown>> {
     auth: Auth;
-    /** Transform raw ID token claims into app claims shape */
     parseClaims: (raw: Record<string, unknown>) => TClaims;
-    /** Default claims when no user or claims unavailable */
     defaultClaims: TClaims;
-    /** Called on Firebase auth state change (for monitoring, analytics) */
     onAuthStateChange?: (user: User | null) => void;
-    /** Called on errors (for Sentry) */
     onError?: (error: unknown, context: string) => void;
-    /**
-     * Optional readiness gate awaited before the provider reports `loading: false`.
-     * Use when data consumers keyed on `user` must not mount until some async
-     * client readiness completes first — e.g. an App Check / attestation token,
-     * without which every data subscription opened at mount is rejected once and
-     * dies. While it is closed the context exposes `user: null`,
-     * `isAuthenticated: false` and the default claims, so no uid-keyed consumer can
-     * mount early. The gate FAILS OPEN: a rejection is reported via `onError('readyGate')`
-     * and the provider proceeds, so a broken gate degrades to today's behavior
-     * rather than bricking the app. Called once on mount (client only).
-     */
     readyGate?: () => Promise<unknown>;
 }
 export interface AuthContextValue<TClaims = Record<string, unknown>> {
-    /** Firebase User */
     user: User | null;
-    /** Parsed custom claims */
     claims: TClaims;
-    /** True until auth + claims resolved */
     loading: boolean;
-    /** Individual loading states */
     authLoading: boolean;
     claimsLoading: boolean;
-    /** Convenience: !!user */
     isAuthenticated: boolean;
-    /** Force refresh claims from Firebase */
     refreshClaims: () => Promise<void>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/react/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,kBAAkB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE,IAAI,EAAE,IAAI,CAAC;IAEX,0DAA0D;IAC1D,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IAEvD,wDAAwD;IACxD,aAAa,EAAE,OAAO,CAAC;IAEvB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAEhD,oCAAoC;IACpC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAEpD;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,oBAAoB;IACpB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAElB,2BAA2B;IAC3B,MAAM,EAAE,OAAO,CAAC;IAEhB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IAEjB,gCAAgC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IAEvB,0BAA0B;IAC1B,eAAe,EAAE,OAAO,CAAC;IAEzB,yCAAyC;IACzC,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,kBAAkB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE,IAAI,EAAE,IAAI,CAAC;IAEX,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IAEvD,aAAa,EAAE,OAAO,CAAC;IAEvB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAEhD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAEpD,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAElB,MAAM,EAAE,OAAO,CAAC;IAEhB,OAAO,EAAE,OAAO,CAAC;IAEjB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IAEvB,eAAe,EAAE,OAAO,CAAC;IAEzB,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC"}

package/dist/react/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Auth, User } from \"firebase/auth\";\n\nexport interface AuthProviderConfig<TClaims = Record<string, unknown>> {\n  auth: Auth;\n\n  /** Transform raw ID token claims into app claims shape */\n  parseClaims: (raw: Record<string, unknown>) => TClaims;\n\n  /** Default claims when no user or claims unavailable */\n  defaultClaims: TClaims;\n\n  /** Called on Firebase auth state change (for monitoring, analytics) */\n  onAuthStateChange?: (user: User | null) => void;\n\n  /** Called on errors (for Sentry) */\n  onError?: (error: unknown, context: string) => void;\n\n  /**\n   * Optional readiness gate awaited before the provider reports `loading: false`.\n   * Use when data consumers keyed on `user` must not mount until some async\n   * client readiness completes first — e.g. an App Check / attestation token,\n   * without which every data subscription opened at mount is rejected once and\n   * dies. While it is closed the context exposes `user: null`,\n   * `isAuthenticated: false` and the default claims, so no uid-keyed consumer can\n   * mount early. The gate FAILS OPEN: a rejection is reported via `onError('readyGate')`\n   * and the provider proceeds, so a broken gate degrades to today's behavior\n   * rather than bricking the app. Called once on mount (client only).\n   */\n  readyGate?: () => Promise<unknown>;\n}\n\nexport interface AuthContextValue<TClaims = Record<string, unknown>> {\n  /** Firebase User */\n  user: User | null;\n\n  /** Parsed custom claims */\n  claims: TClaims;\n\n  /** True until auth + claims resolved */\n  loading: boolean;\n\n  /** Individual loading states */\n  authLoading: boolean;\n  claimsLoading: boolean;\n\n  /** Convenience: !!user */\n  isAuthenticated: boolean;\n\n  /** Force refresh claims from Firebase */\n  refreshClaims: () => Promise<void>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Auth, User } from 'firebase/auth';\n\nexport interface AuthProviderConfig<TClaims = Record<string, unknown>> {\n  auth: Auth;\n\n  parseClaims: (raw: Record<string, unknown>) => TClaims;\n\n  defaultClaims: TClaims;\n\n  onAuthStateChange?: (user: User | null) => void;\n\n  onError?: (error: unknown, context: string) => void;\n\n  readyGate?: () => Promise<unknown>;\n}\n\nexport interface AuthContextValue<TClaims = Record<string, unknown>> {\n  user: User | null;\n\n  claims: TClaims;\n\n  loading: boolean;\n\n  authLoading: boolean;\n  claimsLoading: boolean;\n\n  isAuthenticated: boolean;\n\n  refreshClaims: () => Promise<void>;\n}\n"]}

package/dist/react/useAuth.d.ts

@@ -1,7 +1,3 @@
-import type { AuthContextValue } from "./types.js";
-/**
- * Access the auth context. Must be used within an AuthProvider.
- * Generic param lets each app specify its own claims type.
- */
+import type { AuthContextValue } from './types.js';
 export declare function useAuth<TClaims = Record<string, unknown>>(): AuthContextValue<TClaims>;
 //# sourceMappingURL=useAuth.d.ts.map

package/dist/react/useAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/react/useAuth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,CAMtF"}
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/react/useAuth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,wBAAgB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,CAMtF"}

package/dist/react/useAuth.js

@@ -1,14 +1,10 @@
-"use client";
-import { useContext } from "react";
-import { AuthContext } from "./AuthProvider.js";
-/**
- * Access the auth context. Must be used within an AuthProvider.
- * Generic param lets each app specify its own claims type.
- */
+'use client';
+import { useContext } from 'react';
+import { AuthContext } from './AuthProvider.js';
 export function useAuth() {
     const ctx = useContext(AuthContext);
     if (!ctx) {
-        throw new Error("useAuth must be used within an AuthProvider");
+        throw new Error('useAuth must be used within an AuthProvider');
     }
     return ctx;
 }

package/dist/react/useAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.js","sourceRoot":"","sources":["../../src/react/useAuth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD;;;GAGG;AACH,MAAM,UAAU,OAAO;IACrB,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAgC,CAAC;AAC1C,CAAC","sourcesContent":["\"use client\";\n\nimport { useContext } from \"react\";\nimport { AuthContext } from \"./AuthProvider.js\";\nimport type { AuthContextValue } from \"./types.js\";\n\n/**\n * Access the auth context. Must be used within an AuthProvider.\n * Generic param lets each app specify its own claims type.\n */\nexport function useAuth<TClaims = Record<string, unknown>>(): AuthContextValue<TClaims> {\n  const ctx = useContext(AuthContext);\n  if (!ctx) {\n    throw new Error(\"useAuth must be used within an AuthProvider\");\n  }\n  return ctx as AuthContextValue<TClaims>;\n}\n"]}
+{"version":3,"file":"useAuth.js","sourceRoot":"","sources":["../../src/react/useAuth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,MAAM,UAAU,OAAO;IACrB,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAgC,CAAC;AAC1C,CAAC","sourcesContent":["'use client';\n\nimport { useContext } from 'react';\nimport { AuthContext } from './AuthProvider.js';\nimport type { AuthContextValue } from './types.js';\n\nexport function useAuth<TClaims = Record<string, unknown>>(): AuthContextValue<TClaims> {\n  const ctx = useContext(AuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within an AuthProvider');\n  }\n  return ctx as AuthContextValue<TClaims>;\n}\n"]}

package/dist/react/useAuthGuard.d.ts

@@ -1,50 +1,17 @@
 export interface AuthGuardConfig {
-    /**
-     * Routes accessible without authentication, matched by PREFIX
-     * (`pathname.startsWith(entry)`), so `'/share/'` covers every `/share/:id`
-     * beneath it and `'/terms'` covers `/terms/anything`. This is the SOLE source of public
-     * routes — the hook has no built-in defaults and no app-specific literals, so
-     * a consumer that needs a dynamic public section must list its prefix here.
-     */
     publicRoutes: string[];
-    /** Routes that redirect authenticated users away (login, register) */
     authRedirectRoutes: string[];
-    /** Where unauthenticated users go */
     loginRoute: string;
-    /** Where authenticated users go from authRedirectRoutes */
     defaultRoute: string;
-    /** Special root path handling */
     rootRedirect?: {
         authenticated: string;
         unauthenticated: string;
     };
-    /** localStorage key for post-login redirect */
     redirectKey?: string;
-    /** Navigation function (e.g. router.replace) */
     replace: (path: string) => void;
-    /** Current path */
     pathname: string;
-    /** From useAuth() */
     loading: boolean;
-    /** From useAuth() */
     isAuthenticated: boolean;
 }
-/**
- * Handles route protection. Call in app shell component.
- *
- * - Does nothing while loading.
- * - Redirects unauthenticated users from protected routes to loginRoute.
- * - Redirects authenticated users from authRedirectRoutes to defaultRoute.
- * - Saves attempted path for post-login redirect — a visitor's deep link only. When a
- *   session ends (an observed signed-in → signed-out transition: a sign-out, a forced
- *   sign-out, an expiry, another tab), the path it ended on is NOT saved and any saved
- *   path is cleared, so the next account to sign in on this device never lands on the
- *   previous account's page.
- *
- * "Public" is decided ENTIRELY by `config.publicRoutes` (prefix match). The hook
- * carries no built-in or implicit public route: every route a consumer wants
- * reachable while signed out — including a dynamic section like `/share/:id` — is
- * listed by that consumer as a prefix.
- */
 export declare function useAuthGuard(config: AuthGuardConfig): void;
 //# sourceMappingURL=useAuthGuard.d.ts.map

package/dist/react/useAuthGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthGuard.d.ts","sourceRoot":"","sources":["../../src/react/useAuthGuard.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sEAAsE;IACtE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,YAAY,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,mBAAmB;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,qBAAqB;IACrB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAsF1D"}
+{"version":3,"file":"useAuthGuard.d.ts","sourceRoot":"","sources":["../../src/react/useAuthGuard.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAID,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAyE1D"}

package/dist/react/useAuthGuard.js

@@ -1,39 +1,12 @@
-"use client";
-import { useEffect, useRef } from "react";
-import { clearRedirectPath, readRedirectPath, saveRedirectPath } from "./redirect-storage.js";
-const DEFAULT_REDIRECT_KEY = "auth_redirect_path";
-/**
- * Handles route protection. Call in app shell component.
- *
- * - Does nothing while loading.
- * - Redirects unauthenticated users from protected routes to loginRoute.
- * - Redirects authenticated users from authRedirectRoutes to defaultRoute.
- * - Saves attempted path for post-login redirect — a visitor's deep link only. When a
- *   session ends (an observed signed-in → signed-out transition: a sign-out, a forced
- *   sign-out, an expiry, another tab), the path it ended on is NOT saved and any saved
- *   path is cleared, so the next account to sign in on this device never lands on the
- *   previous account's page.
- *
- * "Public" is decided ENTIRELY by `config.publicRoutes` (prefix match). The hook
- * carries no built-in or implicit public route: every route a consumer wants
- * reachable while signed out — including a dynamic section like `/share/:id` — is
- * listed by that consumer as a prefix.
- */
+'use client';
+import { useEffect, useRef } from 'react';
+import { clearRedirectPath, readRedirectPath, saveRedirectPath } from './redirect-storage.js';
+const DEFAULT_REDIRECT_KEY = 'auth_redirect_path';
 export function useAuthGuard(config) {
     const { publicRoutes, authRedirectRoutes, loginRoute, defaultRoute, rootRedirect, redirectKey = DEFAULT_REDIRECT_KEY, replace, pathname, loading, isAuthenticated, } = config;
-    // The auth-route redirect below is SINGLE-SHOT per auth-route visit. That branch
-    // CONSUMES redirectKey and issues a navigation, but the navigation commits
-    // asynchronously (the router fetches the target route first), so this effect can
-    // legitimately re-run while pathname still reads the auth route (an auth-state
-    // re-render, a loading flap). A re-run then finds the key already gone and
-    // re-replaces to defaultRoute, CLOBBERING the in-flight saved-path navigation —
-    // a deep link that routed through login then landed on defaultRoute instead of
-    // the saved path. The latch resets whenever the pathname is off the auth-route set.
+    // The router commits a navigation asynchronously, so this effect can re-run on the auth route
+    // after the key is consumed; the latch stops a second replace clobbering it.
     const authRouteRedirected = useRef(false);
-    // The last settled authentication state this guard observed (null before the first), and
-    // the pathname a session ended on. The effect can re-run on that same pathname before the
-    // login navigation commits, so the "do not save" decision is held for that pathname rather
-    // than for one run.
     const lastAuthenticated = useRef(null);
     const sessionEndedOn = useRef(null);
     useEffect(() => {
@@ -50,21 +23,18 @@ export function useAuthGuard(config) {
         if (!authRedirectRoutes.includes(pathname)) {
             authRouteRedirected.current = false;
         }
-        // Root path special handling
-        if (rootRedirect && pathname === "/") {
+        if (rootRedirect && pathname === '/') {
             replace(isAuthenticated ? rootRedirect.authenticated : rootRedirect.unauthenticated);
             return;
         }
         const isPublic = publicRoutes.some((r) => pathname.startsWith(r));
         const isAuthRedirect = authRedirectRoutes.includes(pathname);
-        // Unauthenticated on protected route -> save a visitor's path, go to login
         if (!isAuthenticated && !isPublic) {
             if (sessionEndedOn.current === null)
                 saveRedirectPath(redirectKey, pathname);
             replace(loginRoute);
             return;
         }
-        // Authenticated user on auth-only route (login, register, etc.)
         if (isAuthenticated && isAuthRedirect) {
             if (authRouteRedirected.current)
                 return;

package/dist/react/useAuthGuard.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthGuard.js","sourceRoot":"","sources":["../../src/react/useAuthGuard.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AA+B9F,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,MAAM,EACJ,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,GAAG,oBAAoB,EAClC,OAAO,EACP,QAAQ,EACR,OAAO,EACP,eAAe,GAChB,GAAG,MAAM,CAAC;IAEX,iFAAiF;IACjF,2EAA2E;IAC3E,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,gFAAgF;IAChF,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,mBAAmB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE1C,yFAAyF;IACzF,0FAA0F;IAC1F,2FAA2F;IAC3F,oBAAoB;IACpB,MAAM,iBAAiB,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAEnD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO;YAAE,OAAO;QAEpB,IAAI,iBAAiB,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3D,cAAc,CAAC,OAAO,GAAG,QAAQ,CAAC;YAClC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,eAAe,IAAI,cAAc,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAClE,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,iBAAiB,CAAC,OAAO,GAAG,eAAe,CAAC;QAE5C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,mBAAmB,CAAC,OAAO,GAAG,KAAK,CAAC;QACtC,CAAC;QAED,6BAA6B;QAC7B,IAAI,YAAY,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE7D,2EAA2E;QAC3E,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,cAAc,CAAC,OAAO,KAAK,IAAI;gBAAE,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC7E,OAAO,CAAC,UAAU,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,gEAAgE;QAChE,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,mBAAmB,CAAC,OAAO;gBAAE,OAAO;YACxC,mBAAmB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,IAAI,MAAM,GAAG,YAAY,CAAC;YAC1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;YACD,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,EAAE;QACD,OAAO;QACP,eAAe;QACf,QAAQ;QACR,YAAY;QACZ,kBAAkB;QAClB,UAAU;QACV,YAAY;QACZ,YAAY;QACZ,WAAW;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["\"use client\";\n\nimport { useEffect, useRef } from \"react\";\nimport { clearRedirectPath, readRedirectPath, saveRedirectPath } from \"./redirect-storage.js\";\n\nexport interface AuthGuardConfig {\n  /**\n   * Routes accessible without authentication, matched by PREFIX\n   * (`pathname.startsWith(entry)`), so `'/share/'` covers every `/share/:id`\n   * beneath it and `'/terms'` covers `/terms/anything`. This is the SOLE source of public\n   * routes — the hook has no built-in defaults and no app-specific literals, so\n   * a consumer that needs a dynamic public section must list its prefix here.\n   */\n  publicRoutes: string[];\n  /** Routes that redirect authenticated users away (login, register) */\n  authRedirectRoutes: string[];\n  /** Where unauthenticated users go */\n  loginRoute: string;\n  /** Where authenticated users go from authRedirectRoutes */\n  defaultRoute: string;\n  /** Special root path handling */\n  rootRedirect?: { authenticated: string; unauthenticated: string };\n  /** localStorage key for post-login redirect */\n  redirectKey?: string;\n  /** Navigation function (e.g. router.replace) */\n  replace: (path: string) => void;\n  /** Current path */\n  pathname: string;\n  /** From useAuth() */\n  loading: boolean;\n  /** From useAuth() */\n  isAuthenticated: boolean;\n}\n\nconst DEFAULT_REDIRECT_KEY = \"auth_redirect_path\";\n\n/**\n * Handles route protection. Call in app shell component.\n *\n * - Does nothing while loading.\n * - Redirects unauthenticated users from protected routes to loginRoute.\n * - Redirects authenticated users from authRedirectRoutes to defaultRoute.\n * - Saves attempted path for post-login redirect — a visitor's deep link only. When a\n *   session ends (an observed signed-in → signed-out transition: a sign-out, a forced\n *   sign-out, an expiry, another tab), the path it ended on is NOT saved and any saved\n *   path is cleared, so the next account to sign in on this device never lands on the\n *   previous account's page.\n *\n * \"Public\" is decided ENTIRELY by `config.publicRoutes` (prefix match). The hook\n * carries no built-in or implicit public route: every route a consumer wants\n * reachable while signed out — including a dynamic section like `/share/:id` — is\n * listed by that consumer as a prefix.\n */\nexport function useAuthGuard(config: AuthGuardConfig): void {\n  const {\n    publicRoutes,\n    authRedirectRoutes,\n    loginRoute,\n    defaultRoute,\n    rootRedirect,\n    redirectKey = DEFAULT_REDIRECT_KEY,\n    replace,\n    pathname,\n    loading,\n    isAuthenticated,\n  } = config;\n\n  // The auth-route redirect below is SINGLE-SHOT per auth-route visit. That branch\n  // CONSUMES redirectKey and issues a navigation, but the navigation commits\n  // asynchronously (the router fetches the target route first), so this effect can\n  // legitimately re-run while pathname still reads the auth route (an auth-state\n  // re-render, a loading flap). A re-run then finds the key already gone and\n  // re-replaces to defaultRoute, CLOBBERING the in-flight saved-path navigation —\n  // a deep link that routed through login then landed on defaultRoute instead of\n  // the saved path. The latch resets whenever the pathname is off the auth-route set.\n  const authRouteRedirected = useRef(false);\n\n  // The last settled authentication state this guard observed (null before the first), and\n  // the pathname a session ended on. The effect can re-run on that same pathname before the\n  // login navigation commits, so the \"do not save\" decision is held for that pathname rather\n  // than for one run.\n  const lastAuthenticated = useRef<boolean | null>(null);\n  const sessionEndedOn = useRef<string | null>(null);\n\n  useEffect(() => {\n    if (loading) return;\n\n    if (lastAuthenticated.current === true && !isAuthenticated) {\n      sessionEndedOn.current = pathname;\n      clearRedirectPath(redirectKey);\n    } else if (isAuthenticated || sessionEndedOn.current !== pathname) {\n      sessionEndedOn.current = null;\n    }\n    lastAuthenticated.current = isAuthenticated;\n\n    if (!authRedirectRoutes.includes(pathname)) {\n      authRouteRedirected.current = false;\n    }\n\n    // Root path special handling\n    if (rootRedirect && pathname === \"/\") {\n      replace(isAuthenticated ? rootRedirect.authenticated : rootRedirect.unauthenticated);\n      return;\n    }\n\n    const isPublic = publicRoutes.some((r) => pathname.startsWith(r));\n    const isAuthRedirect = authRedirectRoutes.includes(pathname);\n\n    // Unauthenticated on protected route -> save a visitor's path, go to login\n    if (!isAuthenticated && !isPublic) {\n      if (sessionEndedOn.current === null) saveRedirectPath(redirectKey, pathname);\n      replace(loginRoute);\n      return;\n    }\n\n    // Authenticated user on auth-only route (login, register, etc.)\n    if (isAuthenticated && isAuthRedirect) {\n      if (authRouteRedirected.current) return;\n      authRouteRedirected.current = true;\n      let target = defaultRoute;\n      const saved = readRedirectPath(redirectKey);\n      if (saved && !authRedirectRoutes.includes(saved)) {\n        target = saved;\n      }\n      clearRedirectPath(redirectKey);\n      replace(target);\n    }\n  }, [\n    loading,\n    isAuthenticated,\n    pathname,\n    publicRoutes,\n    authRedirectRoutes,\n    loginRoute,\n    defaultRoute,\n    rootRedirect,\n    redirectKey,\n    replace,\n  ]);\n}\n"]}
+{"version":3,"file":"useAuthGuard.js","sourceRoot":"","sources":["../../src/react/useAuthGuard.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAe9F,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAElD,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,MAAM,EACJ,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,GAAG,oBAAoB,EAClC,OAAO,EACP,QAAQ,EACR,OAAO,EACP,eAAe,GAChB,GAAG,MAAM,CAAC;IAEX,8FAA8F;IAC9F,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,iBAAiB,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAEnD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO;YAAE,OAAO;QAEpB,IAAI,iBAAiB,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3D,cAAc,CAAC,OAAO,GAAG,QAAQ,CAAC;YAClC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,eAAe,IAAI,cAAc,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAClE,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,iBAAiB,CAAC,OAAO,GAAG,eAAe,CAAC;QAE5C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,mBAAmB,CAAC,OAAO,GAAG,KAAK,CAAC;QACtC,CAAC;QAED,IAAI,YAAY,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,cAAc,CAAC,OAAO,KAAK,IAAI;gBAAE,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC7E,OAAO,CAAC,UAAU,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,mBAAmB,CAAC,OAAO;gBAAE,OAAO;YACxC,mBAAmB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,IAAI,MAAM,GAAG,YAAY,CAAC;YAC1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;YACD,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,EAAE;QACD,OAAO;QACP,eAAe;QACf,QAAQ;QACR,YAAY;QACZ,kBAAkB;QAClB,UAAU;QACV,YAAY;QACZ,YAAY;QACZ,WAAW;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["'use client';\n\nimport { useEffect, useRef } from 'react';\nimport { clearRedirectPath, readRedirectPath, saveRedirectPath } from './redirect-storage.js';\n\nexport interface AuthGuardConfig {\n  publicRoutes: string[];\n  authRedirectRoutes: string[];\n  loginRoute: string;\n  defaultRoute: string;\n  rootRedirect?: { authenticated: string; unauthenticated: string };\n  redirectKey?: string;\n  replace: (path: string) => void;\n  pathname: string;\n  loading: boolean;\n  isAuthenticated: boolean;\n}\n\nconst DEFAULT_REDIRECT_KEY = 'auth_redirect_path';\n\nexport function useAuthGuard(config: AuthGuardConfig): void {\n  const {\n    publicRoutes,\n    authRedirectRoutes,\n    loginRoute,\n    defaultRoute,\n    rootRedirect,\n    redirectKey = DEFAULT_REDIRECT_KEY,\n    replace,\n    pathname,\n    loading,\n    isAuthenticated,\n  } = config;\n\n  // The router commits a navigation asynchronously, so this effect can re-run on the auth route\n  // after the key is consumed; the latch stops a second replace clobbering it.\n  const authRouteRedirected = useRef(false);\n\n  const lastAuthenticated = useRef<boolean | null>(null);\n  const sessionEndedOn = useRef<string | null>(null);\n\n  useEffect(() => {\n    if (loading) return;\n\n    if (lastAuthenticated.current === true && !isAuthenticated) {\n      sessionEndedOn.current = pathname;\n      clearRedirectPath(redirectKey);\n    } else if (isAuthenticated || sessionEndedOn.current !== pathname) {\n      sessionEndedOn.current = null;\n    }\n    lastAuthenticated.current = isAuthenticated;\n\n    if (!authRedirectRoutes.includes(pathname)) {\n      authRouteRedirected.current = false;\n    }\n\n    if (rootRedirect && pathname === '/') {\n      replace(isAuthenticated ? rootRedirect.authenticated : rootRedirect.unauthenticated);\n      return;\n    }\n\n    const isPublic = publicRoutes.some((r) => pathname.startsWith(r));\n    const isAuthRedirect = authRedirectRoutes.includes(pathname);\n\n    if (!isAuthenticated && !isPublic) {\n      if (sessionEndedOn.current === null) saveRedirectPath(redirectKey, pathname);\n      replace(loginRoute);\n      return;\n    }\n\n    if (isAuthenticated && isAuthRedirect) {\n      if (authRouteRedirected.current) return;\n      authRouteRedirected.current = true;\n      let target = defaultRoute;\n      const saved = readRedirectPath(redirectKey);\n      if (saved && !authRedirectRoutes.includes(saved)) {\n        target = saved;\n      }\n      clearRedirectPath(redirectKey);\n      replace(target);\n    }\n  }, [\n    loading,\n    isAuthenticated,\n    pathname,\n    publicRoutes,\n    authRedirectRoutes,\n    loginRoute,\n    defaultRoute,\n    rootRedirect,\n    redirectKey,\n    replace,\n  ]);\n}\n"]}

package/dist/react/useAuthState.d.ts

@@ -1,4 +1,4 @@
-import type { Auth, User } from "firebase/auth";
+import type { Auth, User } from 'firebase/auth';
 export type AuthState = {
     user: User | null;
     loading: boolean;

package/dist/react/useAuthState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthState.d.ts","sourceRoot":"","sources":["../../src/react/useAuthState.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CA8BlD"}
+{"version":3,"file":"useAuthState.d.ts","sourceRoot":"","sources":["../../src/react/useAuthState.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CA0BlD"}