@ttt-productions/auth-core 1.6.16 → 1.6.17

package/dist/react/redirect-storage.js

@@ -1,7 +1,4 @@
-// The post-login redirect path lives in localStorage. A browser that blocks site data throws
-// on the storage access itself (FRONTEND-010), so every access here is guarded: a blocked read
-// is "nothing saved", and a blocked write keeps the value in memory for the page's life so a
-// same-page sign-in still lands on it. Outside a browser every call is a no-op.
+// A browser that blocks site data throws on the storage access itself (RULE-STD-FRONTEND-010).
 const memory = new Map();
 function inBrowser() {
     return typeof window !== 'undefined';
@@ -22,9 +19,7 @@ export function readRedirectPath(key) {
         if (saved !== null)
             return saved;
     }
-    catch {
-        // Blocked store: fall through to the page-life copy.
-    }
+    catch { }
     return memory.get(key) ?? null;
 }
 export function saveRedirectPath(key, path) {
@@ -37,9 +32,7 @@ export function saveRedirectPath(key, path) {
             memory.delete(key);
             return;
         }
-        catch {
-            // Blocked store: keep the page-life copy below.
-        }
+        catch { }
     }
     memory.set(key, path);
 }
@@ -50,8 +43,6 @@ export function clearRedirectPath(key) {
     try {
         storage()?.removeItem(key);
     }
-    catch {
-        // Blocked store: nothing was persisted there.
-    }
+    catch { }
 }
 //# sourceMappingURL=redirect-storage.js.map

package/dist/react/redirect-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-storage.js","sourceRoot":"","sources":["../../src/react/redirect-storage.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,+FAA+F;AAC/F,6FAA6F;AAC7F,gFAAgF;AAEhF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzC,SAAS,SAAS;IAChB,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC;AACvC,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAY;IACxD,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC","sourcesContent":["// The post-login redirect path lives in localStorage. A browser that blocks site data throws\n// on the storage access itself (FRONTEND-010), so every access here is guarded: a blocked read\n// is \"nothing saved\", and a blocked write keeps the value in memory for the page's life so a\n// same-page sign-in still lands on it. Outside a browser every call is a no-op.\n\nconst memory = new Map<string, string>();\n\nfunction inBrowser(): boolean {\n  return typeof window !== 'undefined';\n}\n\nfunction storage(): Storage | null {\n  try {\n    return window.localStorage;\n  } catch {\n    return null;\n  }\n}\n\nexport function readRedirectPath(key: string): string | null {\n  if (!inBrowser()) return null;\n  try {\n    const saved = storage()?.getItem(key) ?? null;\n    if (saved !== null) return saved;\n  } catch {\n    // Blocked store: fall through to the page-life copy.\n  }\n  return memory.get(key) ?? null;\n}\n\nexport function saveRedirectPath(key: string, path: string): void {\n  if (!inBrowser()) return;\n  const store = storage();\n  if (store) {\n    try {\n      store.setItem(key, path);\n      memory.delete(key);\n      return;\n    } catch {\n      // Blocked store: keep the page-life copy below.\n    }\n  }\n  memory.set(key, path);\n}\n\nexport function clearRedirectPath(key: string): void {\n  if (!inBrowser()) return;\n  memory.delete(key);\n  try {\n    storage()?.removeItem(key);\n  } catch {\n    // Blocked store: nothing was persisted there.\n  }\n}\n"]}
+{"version":3,"file":"redirect-storage.js","sourceRoot":"","sources":["../../src/react/redirect-storage.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAE/F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzC,SAAS,SAAS;IAChB,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC;AACvC,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAY;IACxD,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO;IACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["// A browser that blocks site data throws on the storage access itself (RULE-STD-FRONTEND-010).\n\nconst memory = new Map<string, string>();\n\nfunction inBrowser(): boolean {\n  return typeof window !== 'undefined';\n}\n\nfunction storage(): Storage | null {\n  try {\n    return window.localStorage;\n  } catch {\n    return null;\n  }\n}\n\nexport function readRedirectPath(key: string): string | null {\n  if (!inBrowser()) return null;\n  try {\n    const saved = storage()?.getItem(key) ?? null;\n    if (saved !== null) return saved;\n  } catch {}\n  return memory.get(key) ?? null;\n}\n\nexport function saveRedirectPath(key: string, path: string): void {\n  if (!inBrowser()) return;\n  const store = storage();\n  if (store) {\n    try {\n      store.setItem(key, path);\n      memory.delete(key);\n      return;\n    } catch {}\n  }\n  memory.set(key, path);\n}\n\nexport function clearRedirectPath(key: string): void {\n  if (!inBrowser()) return;\n  memory.delete(key);\n  try {\n    storage()?.removeItem(key);\n  } catch {}\n}\n"]}

package/dist/react/types.d.ts

@@ -1,40 +1,19 @@
 import type { Auth, User } from 'firebase/auth';
 export interface AuthProviderConfig<TClaims = Record<string, unknown>> {
     auth: Auth;
-    /** Transform raw ID token claims into app claims shape */
     parseClaims: (raw: Record<string, unknown>) => TClaims;
-    /** Default claims when no user or claims unavailable */
     defaultClaims: TClaims;
-    /** Called on Firebase auth state change (for monitoring, analytics) */
     onAuthStateChange?: (user: User | null) => void;
-    /** Called on errors (for Sentry) */
     onError?: (error: unknown, context: string) => void;
-    /**
-     * Optional readiness gate awaited before the provider reports `loading: false`.
-     * Use when data consumers keyed on `user` must not mount until some async
-     * client readiness completes first — e.g. an App Check / attestation token,
-     * without which every data subscription opened at mount is rejected once and
-     * dies. While it is closed the context exposes `user: null`,
-     * `isAuthenticated: false` and the default claims, so no uid-keyed consumer can
-     * mount early. The gate FAILS OPEN: a rejection is reported via `onError('readyGate')`
-     * and the provider proceeds, so a broken gate degrades to today's behavior
-     * rather than bricking the app. Called once on mount (client only).
-     */
     readyGate?: () => Promise<unknown>;
 }
 export interface AuthContextValue<TClaims = Record<string, unknown>> {
-    /** Firebase User */
     user: User | null;
-    /** Parsed custom claims */
     claims: TClaims;
-    /** True until auth + claims resolved */
     loading: boolean;
-    /** Individual loading states */
     authLoading: boolean;
     claimsLoading: boolean;
-    /** Convenience: !!user */
     isAuthenticated: boolean;
-    /** Force refresh claims from Firebase */
     refreshClaims: () => Promise<void>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/react/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,kBAAkB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE,IAAI,EAAE,IAAI,CAAC;IAEX,0DAA0D;IAC1D,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IAEvD,wDAAwD;IACxD,aAAa,EAAE,OAAO,CAAC;IAEvB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAEhD,oCAAoC;IACpC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAEpD;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,oBAAoB;IACpB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAElB,2BAA2B;IAC3B,MAAM,EAAE,OAAO,CAAC;IAEhB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IAEjB,gCAAgC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IAEvB,0BAA0B;IAC1B,eAAe,EAAE,OAAO,CAAC;IAEzB,yCAAyC;IACzC,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,kBAAkB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE,IAAI,EAAE,IAAI,CAAC;IAEX,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IAEvD,aAAa,EAAE,OAAO,CAAC;IAEvB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAEhD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAEpD,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAElB,MAAM,EAAE,OAAO,CAAC;IAEhB,OAAO,EAAE,OAAO,CAAC;IAEjB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IAEvB,eAAe,EAAE,OAAO,CAAC;IAEzB,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC"}

package/dist/react/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Auth, User } from 'firebase/auth';\n\nexport interface AuthProviderConfig<TClaims = Record<string, unknown>> {\n  auth: Auth;\n\n  /** Transform raw ID token claims into app claims shape */\n  parseClaims: (raw: Record<string, unknown>) => TClaims;\n\n  /** Default claims when no user or claims unavailable */\n  defaultClaims: TClaims;\n\n  /** Called on Firebase auth state change (for monitoring, analytics) */\n  onAuthStateChange?: (user: User | null) => void;\n\n  /** Called on errors (for Sentry) */\n  onError?: (error: unknown, context: string) => void;\n\n  /**\n   * Optional readiness gate awaited before the provider reports `loading: false`.\n   * Use when data consumers keyed on `user` must not mount until some async\n   * client readiness completes first — e.g. an App Check / attestation token,\n   * without which every data subscription opened at mount is rejected once and\n   * dies. While it is closed the context exposes `user: null`,\n   * `isAuthenticated: false` and the default claims, so no uid-keyed consumer can\n   * mount early. The gate FAILS OPEN: a rejection is reported via `onError('readyGate')`\n   * and the provider proceeds, so a broken gate degrades to today's behavior\n   * rather than bricking the app. Called once on mount (client only).\n   */\n  readyGate?: () => Promise<unknown>;\n}\n\nexport interface AuthContextValue<TClaims = Record<string, unknown>> {\n  /** Firebase User */\n  user: User | null;\n\n  /** Parsed custom claims */\n  claims: TClaims;\n\n  /** True until auth + claims resolved */\n  loading: boolean;\n\n  /** Individual loading states */\n  authLoading: boolean;\n  claimsLoading: boolean;\n\n  /** Convenience: !!user */\n  isAuthenticated: boolean;\n\n  /** Force refresh claims from Firebase */\n  refreshClaims: () => Promise<void>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Auth, User } from 'firebase/auth';\n\nexport interface AuthProviderConfig<TClaims = Record<string, unknown>> {\n  auth: Auth;\n\n  parseClaims: (raw: Record<string, unknown>) => TClaims;\n\n  defaultClaims: TClaims;\n\n  onAuthStateChange?: (user: User | null) => void;\n\n  onError?: (error: unknown, context: string) => void;\n\n  readyGate?: () => Promise<unknown>;\n}\n\nexport interface AuthContextValue<TClaims = Record<string, unknown>> {\n  user: User | null;\n\n  claims: TClaims;\n\n  loading: boolean;\n\n  authLoading: boolean;\n  claimsLoading: boolean;\n\n  isAuthenticated: boolean;\n\n  refreshClaims: () => Promise<void>;\n}\n"]}

package/dist/react/useAuth.d.ts

@@ -1,7 +1,3 @@
 import type { AuthContextValue } from './types.js';
-/**
- * Access the auth context. Must be used within an AuthProvider.
- * Generic param lets each app specify its own claims type.
- */
 export declare function useAuth<TClaims = Record<string, unknown>>(): AuthContextValue<TClaims>;
 //# sourceMappingURL=useAuth.d.ts.map

package/dist/react/useAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/react/useAuth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,CAMtF"}
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/react/useAuth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,wBAAgB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,CAMtF"}

package/dist/react/useAuth.js

@@ -1,10 +1,6 @@
 'use client';
 import { useContext } from 'react';
 import { AuthContext } from './AuthProvider.js';
-/**
- * Access the auth context. Must be used within an AuthProvider.
- * Generic param lets each app specify its own claims type.
- */
 export function useAuth() {
     const ctx = useContext(AuthContext);
     if (!ctx) {

package/dist/react/useAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.js","sourceRoot":"","sources":["../../src/react/useAuth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD;;;GAGG;AACH,MAAM,UAAU,OAAO;IACrB,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAgC,CAAC;AAC1C,CAAC","sourcesContent":["'use client';\n\nimport { useContext } from 'react';\nimport { AuthContext } from './AuthProvider.js';\nimport type { AuthContextValue } from './types.js';\n\n/**\n * Access the auth context. Must be used within an AuthProvider.\n * Generic param lets each app specify its own claims type.\n */\nexport function useAuth<TClaims = Record<string, unknown>>(): AuthContextValue<TClaims> {\n  const ctx = useContext(AuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within an AuthProvider');\n  }\n  return ctx as AuthContextValue<TClaims>;\n}\n"]}
+{"version":3,"file":"useAuth.js","sourceRoot":"","sources":["../../src/react/useAuth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,MAAM,UAAU,OAAO;IACrB,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAgC,CAAC;AAC1C,CAAC","sourcesContent":["'use client';\n\nimport { useContext } from 'react';\nimport { AuthContext } from './AuthProvider.js';\nimport type { AuthContextValue } from './types.js';\n\nexport function useAuth<TClaims = Record<string, unknown>>(): AuthContextValue<TClaims> {\n  const ctx = useContext(AuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within an AuthProvider');\n  }\n  return ctx as AuthContextValue<TClaims>;\n}\n"]}

package/dist/react/useAuthGuard.d.ts

@@ -1,50 +1,17 @@
 export interface AuthGuardConfig {
-    /**
-     * Routes accessible without authentication, matched by PREFIX
-     * (`pathname.startsWith(entry)`), so `'/share/'` covers every `/share/:id`
-     * beneath it and `'/terms'` covers `/terms/anything`. This is the SOLE source of public
-     * routes — the hook has no built-in defaults and no app-specific literals, so
-     * a consumer that needs a dynamic public section must list its prefix here.
-     */
     publicRoutes: string[];
-    /** Routes that redirect authenticated users away (login, register) */
     authRedirectRoutes: string[];
-    /** Where unauthenticated users go */
     loginRoute: string;
-    /** Where authenticated users go from authRedirectRoutes */
     defaultRoute: string;
-    /** Special root path handling */
     rootRedirect?: {
         authenticated: string;
         unauthenticated: string;
     };
-    /** localStorage key for post-login redirect */
     redirectKey?: string;
-    /** Navigation function (e.g. router.replace) */
     replace: (path: string) => void;
-    /** Current path */
     pathname: string;
-    /** From useAuth() */
     loading: boolean;
-    /** From useAuth() */
     isAuthenticated: boolean;
 }
-/**
- * Handles route protection. Call in app shell component.
- *
- * - Does nothing while loading.
- * - Redirects unauthenticated users from protected routes to loginRoute.
- * - Redirects authenticated users from authRedirectRoutes to defaultRoute.
- * - Saves attempted path for post-login redirect — a visitor's deep link only. When a
- *   session ends (an observed signed-in → signed-out transition: a sign-out, a forced
- *   sign-out, an expiry, another tab), the path it ended on is NOT saved and any saved
- *   path is cleared, so the next account to sign in on this device never lands on the
- *   previous account's page.
- *
- * "Public" is decided ENTIRELY by `config.publicRoutes` (prefix match). The hook
- * carries no built-in or implicit public route: every route a consumer wants
- * reachable while signed out — including a dynamic section like `/share/:id` — is
- * listed by that consumer as a prefix.
- */
 export declare function useAuthGuard(config: AuthGuardConfig): void;
 //# sourceMappingURL=useAuthGuard.d.ts.map

package/dist/react/useAuthGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthGuard.d.ts","sourceRoot":"","sources":["../../src/react/useAuthGuard.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sEAAsE;IACtE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,YAAY,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,mBAAmB;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,qBAAqB;IACrB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAsF1D"}
+{"version":3,"file":"useAuthGuard.d.ts","sourceRoot":"","sources":["../../src/react/useAuthGuard.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAID,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAyE1D"}

package/dist/react/useAuthGuard.js

@@ -2,38 +2,11 @@
 import { useEffect, useRef } from 'react';
 import { clearRedirectPath, readRedirectPath, saveRedirectPath } from './redirect-storage.js';
 const DEFAULT_REDIRECT_KEY = 'auth_redirect_path';
-/**
- * Handles route protection. Call in app shell component.
- *
- * - Does nothing while loading.
- * - Redirects unauthenticated users from protected routes to loginRoute.
- * - Redirects authenticated users from authRedirectRoutes to defaultRoute.
- * - Saves attempted path for post-login redirect — a visitor's deep link only. When a
- *   session ends (an observed signed-in → signed-out transition: a sign-out, a forced
- *   sign-out, an expiry, another tab), the path it ended on is NOT saved and any saved
- *   path is cleared, so the next account to sign in on this device never lands on the
- *   previous account's page.
- *
- * "Public" is decided ENTIRELY by `config.publicRoutes` (prefix match). The hook
- * carries no built-in or implicit public route: every route a consumer wants
- * reachable while signed out — including a dynamic section like `/share/:id` — is
- * listed by that consumer as a prefix.
- */
 export function useAuthGuard(config) {
     const { publicRoutes, authRedirectRoutes, loginRoute, defaultRoute, rootRedirect, redirectKey = DEFAULT_REDIRECT_KEY, replace, pathname, loading, isAuthenticated, } = config;
-    // The auth-route redirect below is SINGLE-SHOT per auth-route visit. That branch
-    // CONSUMES redirectKey and issues a navigation, but the navigation commits
-    // asynchronously (the router fetches the target route first), so this effect can
-    // legitimately re-run while pathname still reads the auth route (an auth-state
-    // re-render, a loading flap). A re-run then finds the key already gone and
-    // re-replaces to defaultRoute, CLOBBERING the in-flight saved-path navigation —
-    // a deep link that routed through login then landed on defaultRoute instead of
-    // the saved path. The latch resets whenever the pathname is off the auth-route set.
+    // The router commits a navigation asynchronously, so this effect can re-run on the auth route
+    // after the key is consumed; the latch stops a second replace clobbering it.
     const authRouteRedirected = useRef(false);
-    // The last settled authentication state this guard observed (null before the first), and
-    // the pathname a session ended on. The effect can re-run on that same pathname before the
-    // login navigation commits, so the "do not save" decision is held for that pathname rather
-    // than for one run.
     const lastAuthenticated = useRef(null);
     const sessionEndedOn = useRef(null);
     useEffect(() => {
@@ -50,21 +23,18 @@ export function useAuthGuard(config) {
         if (!authRedirectRoutes.includes(pathname)) {
             authRouteRedirected.current = false;
         }
-        // Root path special handling
         if (rootRedirect && pathname === '/') {
             replace(isAuthenticated ? rootRedirect.authenticated : rootRedirect.unauthenticated);
             return;
         }
         const isPublic = publicRoutes.some((r) => pathname.startsWith(r));
         const isAuthRedirect = authRedirectRoutes.includes(pathname);
-        // Unauthenticated on protected route -> save a visitor's path, go to login
         if (!isAuthenticated && !isPublic) {
             if (sessionEndedOn.current === null)
                 saveRedirectPath(redirectKey, pathname);
             replace(loginRoute);
             return;
         }
-        // Authenticated user on auth-only route (login, register, etc.)
         if (isAuthenticated && isAuthRedirect) {
             if (authRouteRedirected.current)
                 return;

package/dist/react/useAuthGuard.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthGuard.js","sourceRoot":"","sources":["../../src/react/useAuthGuard.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AA+B9F,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,MAAM,EACJ,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,GAAG,oBAAoB,EAClC,OAAO,EACP,QAAQ,EACR,OAAO,EACP,eAAe,GAChB,GAAG,MAAM,CAAC;IAEX,iFAAiF;IACjF,2EAA2E;IAC3E,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,gFAAgF;IAChF,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,mBAAmB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE1C,yFAAyF;IACzF,0FAA0F;IAC1F,2FAA2F;IAC3F,oBAAoB;IACpB,MAAM,iBAAiB,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAEnD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO;YAAE,OAAO;QAEpB,IAAI,iBAAiB,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3D,cAAc,CAAC,OAAO,GAAG,QAAQ,CAAC;YAClC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,eAAe,IAAI,cAAc,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAClE,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,iBAAiB,CAAC,OAAO,GAAG,eAAe,CAAC;QAE5C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,mBAAmB,CAAC,OAAO,GAAG,KAAK,CAAC;QACtC,CAAC;QAED,6BAA6B;QAC7B,IAAI,YAAY,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE7D,2EAA2E;QAC3E,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,cAAc,CAAC,OAAO,KAAK,IAAI;gBAAE,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC7E,OAAO,CAAC,UAAU,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,gEAAgE;QAChE,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,mBAAmB,CAAC,OAAO;gBAAE,OAAO;YACxC,mBAAmB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,IAAI,MAAM,GAAG,YAAY,CAAC;YAC1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;YACD,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,EAAE;QACD,OAAO;QACP,eAAe;QACf,QAAQ;QACR,YAAY;QACZ,kBAAkB;QAClB,UAAU;QACV,YAAY;QACZ,YAAY;QACZ,WAAW;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["'use client';\n\nimport { useEffect, useRef } from 'react';\nimport { clearRedirectPath, readRedirectPath, saveRedirectPath } from './redirect-storage.js';\n\nexport interface AuthGuardConfig {\n  /**\n   * Routes accessible without authentication, matched by PREFIX\n   * (`pathname.startsWith(entry)`), so `'/share/'` covers every `/share/:id`\n   * beneath it and `'/terms'` covers `/terms/anything`. This is the SOLE source of public\n   * routes — the hook has no built-in defaults and no app-specific literals, so\n   * a consumer that needs a dynamic public section must list its prefix here.\n   */\n  publicRoutes: string[];\n  /** Routes that redirect authenticated users away (login, register) */\n  authRedirectRoutes: string[];\n  /** Where unauthenticated users go */\n  loginRoute: string;\n  /** Where authenticated users go from authRedirectRoutes */\n  defaultRoute: string;\n  /** Special root path handling */\n  rootRedirect?: { authenticated: string; unauthenticated: string };\n  /** localStorage key for post-login redirect */\n  redirectKey?: string;\n  /** Navigation function (e.g. router.replace) */\n  replace: (path: string) => void;\n  /** Current path */\n  pathname: string;\n  /** From useAuth() */\n  loading: boolean;\n  /** From useAuth() */\n  isAuthenticated: boolean;\n}\n\nconst DEFAULT_REDIRECT_KEY = 'auth_redirect_path';\n\n/**\n * Handles route protection. Call in app shell component.\n *\n * - Does nothing while loading.\n * - Redirects unauthenticated users from protected routes to loginRoute.\n * - Redirects authenticated users from authRedirectRoutes to defaultRoute.\n * - Saves attempted path for post-login redirect — a visitor's deep link only. When a\n *   session ends (an observed signed-in → signed-out transition: a sign-out, a forced\n *   sign-out, an expiry, another tab), the path it ended on is NOT saved and any saved\n *   path is cleared, so the next account to sign in on this device never lands on the\n *   previous account's page.\n *\n * \"Public\" is decided ENTIRELY by `config.publicRoutes` (prefix match). The hook\n * carries no built-in or implicit public route: every route a consumer wants\n * reachable while signed out — including a dynamic section like `/share/:id` — is\n * listed by that consumer as a prefix.\n */\nexport function useAuthGuard(config: AuthGuardConfig): void {\n  const {\n    publicRoutes,\n    authRedirectRoutes,\n    loginRoute,\n    defaultRoute,\n    rootRedirect,\n    redirectKey = DEFAULT_REDIRECT_KEY,\n    replace,\n    pathname,\n    loading,\n    isAuthenticated,\n  } = config;\n\n  // The auth-route redirect below is SINGLE-SHOT per auth-route visit. That branch\n  // CONSUMES redirectKey and issues a navigation, but the navigation commits\n  // asynchronously (the router fetches the target route first), so this effect can\n  // legitimately re-run while pathname still reads the auth route (an auth-state\n  // re-render, a loading flap). A re-run then finds the key already gone and\n  // re-replaces to defaultRoute, CLOBBERING the in-flight saved-path navigation —\n  // a deep link that routed through login then landed on defaultRoute instead of\n  // the saved path. The latch resets whenever the pathname is off the auth-route set.\n  const authRouteRedirected = useRef(false);\n\n  // The last settled authentication state this guard observed (null before the first), and\n  // the pathname a session ended on. The effect can re-run on that same pathname before the\n  // login navigation commits, so the \"do not save\" decision is held for that pathname rather\n  // than for one run.\n  const lastAuthenticated = useRef<boolean | null>(null);\n  const sessionEndedOn = useRef<string | null>(null);\n\n  useEffect(() => {\n    if (loading) return;\n\n    if (lastAuthenticated.current === true && !isAuthenticated) {\n      sessionEndedOn.current = pathname;\n      clearRedirectPath(redirectKey);\n    } else if (isAuthenticated || sessionEndedOn.current !== pathname) {\n      sessionEndedOn.current = null;\n    }\n    lastAuthenticated.current = isAuthenticated;\n\n    if (!authRedirectRoutes.includes(pathname)) {\n      authRouteRedirected.current = false;\n    }\n\n    // Root path special handling\n    if (rootRedirect && pathname === '/') {\n      replace(isAuthenticated ? rootRedirect.authenticated : rootRedirect.unauthenticated);\n      return;\n    }\n\n    const isPublic = publicRoutes.some((r) => pathname.startsWith(r));\n    const isAuthRedirect = authRedirectRoutes.includes(pathname);\n\n    // Unauthenticated on protected route -> save a visitor's path, go to login\n    if (!isAuthenticated && !isPublic) {\n      if (sessionEndedOn.current === null) saveRedirectPath(redirectKey, pathname);\n      replace(loginRoute);\n      return;\n    }\n\n    // Authenticated user on auth-only route (login, register, etc.)\n    if (isAuthenticated && isAuthRedirect) {\n      if (authRouteRedirected.current) return;\n      authRouteRedirected.current = true;\n      let target = defaultRoute;\n      const saved = readRedirectPath(redirectKey);\n      if (saved && !authRedirectRoutes.includes(saved)) {\n        target = saved;\n      }\n      clearRedirectPath(redirectKey);\n      replace(target);\n    }\n  }, [\n    loading,\n    isAuthenticated,\n    pathname,\n    publicRoutes,\n    authRedirectRoutes,\n    loginRoute,\n    defaultRoute,\n    rootRedirect,\n    redirectKey,\n    replace,\n  ]);\n}\n"]}
+{"version":3,"file":"useAuthGuard.js","sourceRoot":"","sources":["../../src/react/useAuthGuard.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAe9F,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAElD,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,MAAM,EACJ,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,GAAG,oBAAoB,EAClC,OAAO,EACP,QAAQ,EACR,OAAO,EACP,eAAe,GAChB,GAAG,MAAM,CAAC;IAEX,8FAA8F;IAC9F,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,iBAAiB,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAEnD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO;YAAE,OAAO;QAEpB,IAAI,iBAAiB,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3D,cAAc,CAAC,OAAO,GAAG,QAAQ,CAAC;YAClC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,eAAe,IAAI,cAAc,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAClE,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,iBAAiB,CAAC,OAAO,GAAG,eAAe,CAAC;QAE5C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,mBAAmB,CAAC,OAAO,GAAG,KAAK,CAAC;QACtC,CAAC;QAED,IAAI,YAAY,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,cAAc,CAAC,OAAO,KAAK,IAAI;gBAAE,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC7E,OAAO,CAAC,UAAU,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,mBAAmB,CAAC,OAAO;gBAAE,OAAO;YACxC,mBAAmB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,IAAI,MAAM,GAAG,YAAY,CAAC;YAC1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;YACD,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,EAAE;QACD,OAAO;QACP,eAAe;QACf,QAAQ;QACR,YAAY;QACZ,kBAAkB;QAClB,UAAU;QACV,YAAY;QACZ,YAAY;QACZ,WAAW;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["'use client';\n\nimport { useEffect, useRef } from 'react';\nimport { clearRedirectPath, readRedirectPath, saveRedirectPath } from './redirect-storage.js';\n\nexport interface AuthGuardConfig {\n  publicRoutes: string[];\n  authRedirectRoutes: string[];\n  loginRoute: string;\n  defaultRoute: string;\n  rootRedirect?: { authenticated: string; unauthenticated: string };\n  redirectKey?: string;\n  replace: (path: string) => void;\n  pathname: string;\n  loading: boolean;\n  isAuthenticated: boolean;\n}\n\nconst DEFAULT_REDIRECT_KEY = 'auth_redirect_path';\n\nexport function useAuthGuard(config: AuthGuardConfig): void {\n  const {\n    publicRoutes,\n    authRedirectRoutes,\n    loginRoute,\n    defaultRoute,\n    rootRedirect,\n    redirectKey = DEFAULT_REDIRECT_KEY,\n    replace,\n    pathname,\n    loading,\n    isAuthenticated,\n  } = config;\n\n  // The router commits a navigation asynchronously, so this effect can re-run on the auth route\n  // after the key is consumed; the latch stops a second replace clobbering it.\n  const authRouteRedirected = useRef(false);\n\n  const lastAuthenticated = useRef<boolean | null>(null);\n  const sessionEndedOn = useRef<string | null>(null);\n\n  useEffect(() => {\n    if (loading) return;\n\n    if (lastAuthenticated.current === true && !isAuthenticated) {\n      sessionEndedOn.current = pathname;\n      clearRedirectPath(redirectKey);\n    } else if (isAuthenticated || sessionEndedOn.current !== pathname) {\n      sessionEndedOn.current = null;\n    }\n    lastAuthenticated.current = isAuthenticated;\n\n    if (!authRedirectRoutes.includes(pathname)) {\n      authRouteRedirected.current = false;\n    }\n\n    if (rootRedirect && pathname === '/') {\n      replace(isAuthenticated ? rootRedirect.authenticated : rootRedirect.unauthenticated);\n      return;\n    }\n\n    const isPublic = publicRoutes.some((r) => pathname.startsWith(r));\n    const isAuthRedirect = authRedirectRoutes.includes(pathname);\n\n    if (!isAuthenticated && !isPublic) {\n      if (sessionEndedOn.current === null) saveRedirectPath(redirectKey, pathname);\n      replace(loginRoute);\n      return;\n    }\n\n    if (isAuthenticated && isAuthRedirect) {\n      if (authRouteRedirected.current) return;\n      authRouteRedirected.current = true;\n      let target = defaultRoute;\n      const saved = readRedirectPath(redirectKey);\n      if (saved && !authRedirectRoutes.includes(saved)) {\n        target = saved;\n      }\n      clearRedirectPath(redirectKey);\n      replace(target);\n    }\n  }, [\n    loading,\n    isAuthenticated,\n    pathname,\n    publicRoutes,\n    authRedirectRoutes,\n    loginRoute,\n    defaultRoute,\n    rootRedirect,\n    redirectKey,\n    replace,\n  ]);\n}\n"]}

package/dist/react/useAuthState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthState.d.ts","sourceRoot":"","sources":["../../src/react/useAuthState.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CA8BlD"}
+{"version":3,"file":"useAuthState.d.ts","sourceRoot":"","sources":["../../src/react/useAuthState.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CA0BlD"}

package/dist/react/useAuthState.js

@@ -1,14 +1,10 @@
 import { useEffect, useState } from 'react';
 import { onAuthStateChanged } from '../client/auth.js';
 export function useAuthState(auth) {
-    // Initialize state based on current auth status to avoid initial flash
     const [user, setUser] = useState(() => auth.currentUser);
     const [loading, setLoading] = useState(() => auth.currentUser === null);
     const [error, setError] = useState(null);
     useEffect(() => {
-        // Only set loading if we don't have a user and haven't loaded yet
-        // This prevents the "flash" when a user is already signed in (e.g. hydration)
-        // or when simply refreshing the token.
         if (auth.currentUser === null) {
             setLoading(true);
         }

package/dist/react/useAuthState.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthState.js","sourceRoot":"","sources":["../../src/react/useAuthState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAQvD,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,uEAAuE;IACvE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAc,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAU,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,kEAAkE;QAClE,8EAA8E;QAC9E,uCAAuC;QACvC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,CAC9B,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE;YACJ,OAAO,CAAC,CAAC,CAAC,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;YACJ,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CACF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC","sourcesContent":["import { useEffect, useState } from 'react';\nimport type { Auth, User } from 'firebase/auth';\nimport { onAuthStateChanged } from '../client/auth.js';\n\nexport type AuthState = {\n  user: User | null;\n  loading: boolean;\n  error: unknown | null;\n};\n\nexport function useAuthState(auth: Auth): AuthState {\n  // Initialize state based on current auth status to avoid initial flash\n  const [user, setUser] = useState<User | null>(() => auth.currentUser);\n  const [loading, setLoading] = useState<boolean>(() => auth.currentUser === null);\n  const [error, setError] = useState<unknown | null>(null);\n\n  useEffect(() => {\n    // Only set loading if we don't have a user and haven't loaded yet\n    // This prevents the \"flash\" when a user is already signed in (e.g. hydration)\n    // or when simply refreshing the token.\n    if (auth.currentUser === null) {\n      setLoading(true);\n    }\n\n    const unsub = onAuthStateChanged(\n      auth,\n      (u) => {\n        setUser(u);\n        setError(null);\n        setLoading(false);\n      },\n      (e) => {\n        setError(e);\n        setLoading(false);\n      },\n    );\n    return unsub;\n  }, [auth]);\n\n  return { user, loading, error };\n}\n"]}
+{"version":3,"file":"useAuthState.js","sourceRoot":"","sources":["../../src/react/useAuthState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAQvD,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAc,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAU,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,CAC9B,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE;YACJ,OAAO,CAAC,CAAC,CAAC,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;YACJ,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CACF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC","sourcesContent":["import { useEffect, useState } from 'react';\nimport type { Auth, User } from 'firebase/auth';\nimport { onAuthStateChanged } from '../client/auth.js';\n\nexport type AuthState = {\n  user: User | null;\n  loading: boolean;\n  error: unknown | null;\n};\n\nexport function useAuthState(auth: Auth): AuthState {\n  const [user, setUser] = useState<User | null>(() => auth.currentUser);\n  const [loading, setLoading] = useState<boolean>(() => auth.currentUser === null);\n  const [error, setError] = useState<unknown | null>(null);\n\n  useEffect(() => {\n    if (auth.currentUser === null) {\n      setLoading(true);\n    }\n\n    const unsub = onAuthStateChanged(\n      auth,\n      (u) => {\n        setUser(u);\n        setError(null);\n        setLoading(false);\n      },\n      (e) => {\n        setError(e);\n        setLoading(false);\n      },\n    );\n    return unsub;\n  }, [auth]);\n\n  return { user, loading, error };\n}\n"]}

package/dist/refusal.d.ts

@@ -1,8 +1,2 @@
-/**
- * The `details` of `err` when it is a `failed-precondition` error in either spelling —
- * server-side or client-side callable error alike — otherwise `undefined`. Each recognizer then
- * asks whether those details are its own refusal's, so refusals are told apart by
- * `details.reason`, never by message text.
- */
 export declare function failedPreconditionDetails(err: unknown): unknown;
 //# sourceMappingURL=refusal.d.ts.map

package/dist/refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM/D"}
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAKA,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM/D"}

package/dist/refusal.js

@@ -1,19 +1,7 @@
-// The code both structured `assertAuth` refusals carry — the acceptance refusal
-// (./acceptance.ts) and the email-verification refusal (./email-verification.ts) — and the one
-// place their recognizers read it. Internal: the root exports the recognizers, not this.
-// Pure: no Firebase runtime.
-// The HttpsError code, as the server (`failed-precondition`) and the Firebase client SDK
-// (`functions/failed-precondition`) spell it.
 const FAILED_PRECONDITION_CODES = new Set([
     'failed-precondition',
     'functions/failed-precondition',
 ]);
-/**
- * The `details` of `err` when it is a `failed-precondition` error in either spelling —
- * server-side or client-side callable error alike — otherwise `undefined`. Each recognizer then
- * asks whether those details are its own refusal's, so refusals are told apart by
- * `details.reason`, never by message text.
- */
 export function failedPreconditionDetails(err) {
     if (!err || typeof err !== 'object')
         return undefined;

package/dist/refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+FAA+F;AAC/F,yFAAyF;AACzF,6BAA6B;AAE7B,yFAAyF;AACzF,8CAA8C;AAC9C,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,qBAAqB;IACrB,+BAA+B;CAChC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,CAAC,GAAG,GAA4C,CAAC;IACvD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,CAAC,CAAC,CAAC,CAAC,OAAO;QACX,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC","sourcesContent":["// The code both structured `assertAuth` refusals carry — the acceptance refusal\n// (./acceptance.ts) and the email-verification refusal (./email-verification.ts) — and the one\n// place their recognizers read it. Internal: the root exports the recognizers, not this.\n// Pure: no Firebase runtime.\n\n// The HttpsError code, as the server (`failed-precondition`) and the Firebase client SDK\n// (`functions/failed-precondition`) spell it.\nconst FAILED_PRECONDITION_CODES: ReadonlySet<string> = new Set([\n  'failed-precondition',\n  'functions/failed-precondition',\n]);\n\n/**\n * The `details` of `err` when it is a `failed-precondition` error in either spelling —\n * server-side or client-side callable error alike — otherwise `undefined`. Each recognizer then\n * asks whether those details are its own refusal's, so refusals are told apart by\n * `details.reason`, never by message text.\n */\nexport function failedPreconditionDetails(err: unknown): unknown {\n  if (!err || typeof err !== 'object') return undefined;\n  const e = err as { code?: unknown; details?: unknown };\n  return typeof e.code === 'string' && FAILED_PRECONDITION_CODES.has(e.code)\n    ? e.details\n    : undefined;\n}\n"]}
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,qBAAqB;IACrB,+BAA+B;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,CAAC,GAAG,GAA4C,CAAC;IACvD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,CAAC,CAAC,CAAC,CAAC,OAAO;QACX,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC","sourcesContent":["const FAILED_PRECONDITION_CODES: ReadonlySet<string> = new Set([\n  'failed-precondition',\n  'functions/failed-precondition',\n]);\n\nexport function failedPreconditionDetails(err: unknown): unknown {\n  if (!err || typeof err !== 'object') return undefined;\n  const e = err as { code?: unknown; details?: unknown };\n  return typeof e.code === 'string' && FAILED_PRECONDITION_CODES.has(e.code)\n    ? e.details\n    : undefined;\n}\n"]}

package/dist/server/assertAuth.d.ts

@@ -1,3 +1,3 @@
 import type { AssertAuthConfig, AssertAuthFn } from './types.js';
-export declare function createAssertAuth<TUser, TAdmin = void>(config: AssertAuthConfig<TUser, TAdmin>): AssertAuthFn<TUser, TAdmin>;
+export declare function createAssertAuth<TUser, TAdmin = void, TAdminOptions = never>(config: AssertAuthConfig<TUser, TAdmin, TAdminOptions>): AssertAuthFn<TUser, TAdmin, TAdminOptions>;
 //# sourceMappingURL=assertAuth.d.ts.map

package/dist/server/assertAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assertAuth.d.ts","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAiC,MAAM,YAAY,CAAC;AAEhG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EACnD,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,GACtC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAkF7B"}
+{"version":3,"file":"assertAuth.d.ts","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAiC,MAAM,YAAY,CAAC;AAEhG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,aAAa,GAAG,KAAK,EAC1E,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,GACrD,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAuE5C"}

package/dist/server/assertAuth.js

@@ -1,27 +1,13 @@
-// Factory that produces an assertAuth function bound to a consuming app's
-// Firestore paths, user shape, and admin check.
-//
-// Every Cloud Functions callable in the consuming app should invoke the
-// returned assertAuth as its first executable line. The check order is:
-//   1. Authentication
-//   2. Email verification
-//   3. User doc Firestore read (when status check is needed)
-//   4. Status check (suspended / banned)
-//   5. Acceptance-level gate (only when config.acceptance is set)
-//   6. Admin check (delegated to config.requireAdmin)
 import { ACCEPTANCE_REQUIRED_REASON, normalizeAcceptanceLevel } from '../acceptance.js';
 import { EMAIL_VERIFICATION_REQUIRED_REASON } from '../email-verification.js';
 import { AuthAssertionError } from './authError.js';
 export function createAssertAuth(config) {
     return async function assertAuth(request, requirements = {}) {
-        // 1. Authentication check (always first)
         if (!request.auth) {
             throw new AuthAssertionError('unauthenticated', 'You must be authenticated');
         }
         const uid = request.auth.uid;
         const token = request.auth.token;
-        // 2. Email verification check. The refusal carries its reason in `details`, so the client
-        // recognizes it structurally (`isEmailVerificationRequiredError`), never by the message.
         if (requirements.emailVerified === true && requirements.allowUnverified !== true) {
             if (token.email_verified !== true) {
                 throw new AuthAssertionError('failed-precondition', 'Email must be verified', {
@@ -29,11 +15,9 @@ export function createAssertAuth(config) {
                 });
             }
         }
-        // 3. User doc Firestore read (skipped when allowAnyStatus is set)
         const db = config.firestore();
         const userSnap = requirements.allowAnyStatus !== true ? await db.doc(config.userProfilePath(uid)).get() : null;
         let userDoc;
-        // 4. Status check (default: block suspended + banned; skipped if allowAnyStatus)
         if (requirements.allowAnyStatus !== true) {
             if (!userSnap || !userSnap.exists) {
                 throw new AuthAssertionError('not-found', 'User profile not found');
@@ -48,10 +32,6 @@ export function createAssertAuth(config) {
             }
             userDoc = userData;
         }
-        // 5. Acceptance-level gate. Runs only when the app configured one and the callable did
-        // not opt out. The required level comes from the app's cheap (cached) reader and the
-        // accepted level from the verified token, so the gate adds no per-call Firestore read.
-        // It sits after the status check so a banned caller still gets the standing refusal.
         if (config.acceptance !== undefined && requirements.allowUnaccepted !== true) {
             const requiredLevel = normalizeAcceptanceLevel(await config.acceptance.requiredLevel());
             if (requiredLevel > 0) {
@@ -61,12 +41,10 @@ export function createAssertAuth(config) {
                 }
             }
         }
-        // 6. Admin check (delegates to config.requireAdmin)
         let adminResult;
         if (requirements.admin !== undefined) {
             adminResult = await config.requireAdmin(uid, token, requirements.admin);
         }
-        // 7. Return context with whatever docs were fetched
         const ctx = { uid, token };
         if (userDoc !== undefined) {
             ctx.userDoc = userDoc;

package/dist/server/assertAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"assertAuth.js","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,sBAAsB;AACtB,0BAA0B;AAC1B,6DAA6D;AAC7D,yCAAyC;AACzC,kEAAkE;AAClE,sDAAsD;AAGtD,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,UAAU,gBAAgB,CAC9B,MAAuC;IAEvC,OAAO,KAAK,UAAU,UAAU,CAC9B,OAAwB,EACxB,eAAiC,EAAE;QAEnC,yCAAyC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAEjC,0FAA0F;QAC1F,yFAAyF;QACzF,IAAI,YAAY,CAAC,aAAa,KAAK,IAAI,IAAI,YAAY,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACjF,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wBAAwB,EAAE;oBAC5E,MAAM,EAAE,kCAAkC;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GACZ,YAAY,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEhG,IAAI,OAA0B,CAAC;QAE/B,iFAAiF;QACjF,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAW,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;YACvF,CAAC;YACD,IAAI,MAAM,KAAK,WAAW,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACnE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;QAED,uFAAuF;QACvF,qFAAqF;QACrF,uFAAuF;QACvF,qFAAqF;QACrF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,YAAY,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7E,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;YACxF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,wBAAwB,CAC3C,KAAiC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC/D,CAAC;gBACF,IAAI,aAAa,GAAG,aAAa,EAAE,CAAC;oBAClC,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,0DAA0D,EAC1D,EAAE,MAAM,EAAE,0BAA0B,EAAE,aAAa,EAAE,aAAa,EAAE,CACrE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,WAA+B,CAAC;QACpC,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,WAAW,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,oDAAoD;QACpD,MAAM,GAAG,GAA+B,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,GAAG,CAAC,KAAK,GAAG,WAAqB,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Factory that produces an assertAuth function bound to a consuming app's\n// Firestore paths, user shape, and admin check.\n//\n// Every Cloud Functions callable in the consuming app should invoke the\n// returned assertAuth as its first executable line. The check order is:\n//   1. Authentication\n//   2. Email verification\n//   3. User doc Firestore read (when status check is needed)\n//   4. Status check (suspended / banned)\n//   5. Acceptance-level gate (only when config.acceptance is set)\n//   6. Admin check (delegated to config.requireAdmin)\n\nimport type { CallableRequest } from 'firebase-functions/v2/https';\nimport { ACCEPTANCE_REQUIRED_REASON, normalizeAcceptanceLevel } from '../acceptance.js';\nimport { EMAIL_VERIFICATION_REQUIRED_REASON } from '../email-verification.js';\nimport { AuthAssertionError } from './authError.js';\nimport type { AssertAuthConfig, AssertAuthFn, AuthContext, AuthRequirements } from './types.js';\n\nexport function createAssertAuth<TUser, TAdmin = void>(\n  config: AssertAuthConfig<TUser, TAdmin>,\n): AssertAuthFn<TUser, TAdmin> {\n  return async function assertAuth(\n    request: CallableRequest,\n    requirements: AuthRequirements = {},\n  ): Promise<AuthContext<TUser, TAdmin>> {\n    // 1. Authentication check (always first)\n    if (!request.auth) {\n      throw new AuthAssertionError('unauthenticated', 'You must be authenticated');\n    }\n\n    const uid = request.auth.uid;\n    const token = request.auth.token;\n\n    // 2. Email verification check. The refusal carries its reason in `details`, so the client\n    // recognizes it structurally (`isEmailVerificationRequiredError`), never by the message.\n    if (requirements.emailVerified === true && requirements.allowUnverified !== true) {\n      if (token.email_verified !== true) {\n        throw new AuthAssertionError('failed-precondition', 'Email must be verified', {\n          reason: EMAIL_VERIFICATION_REQUIRED_REASON,\n        });\n      }\n    }\n\n    // 3. User doc Firestore read (skipped when allowAnyStatus is set)\n    const db = config.firestore();\n    const userSnap =\n      requirements.allowAnyStatus !== true ? await db.doc(config.userProfilePath(uid)).get() : null;\n\n    let userDoc: TUser | undefined;\n\n    // 4. Status check (default: block suspended + banned; skipped if allowAnyStatus)\n    if (requirements.allowAnyStatus !== true) {\n      if (!userSnap || !userSnap.exists) {\n        throw new AuthAssertionError('not-found', 'User profile not found');\n      }\n      const userData = userSnap.data() as TUser;\n      const status = config.getUserStatus(userData);\n      if (status === 'banned') {\n        throw new AuthAssertionError('permission-denied', 'Account is not in good standing');\n      }\n      if (status === 'suspended' && requirements.allowSuspended !== true) {\n        throw new AuthAssertionError('permission-denied', 'Account is not in good standing');\n      }\n      userDoc = userData;\n    }\n\n    // 5. Acceptance-level gate. Runs only when the app configured one and the callable did\n    // not opt out. The required level comes from the app's cheap (cached) reader and the\n    // accepted level from the verified token, so the gate adds no per-call Firestore read.\n    // It sits after the status check so a banned caller still gets the standing refusal.\n    if (config.acceptance !== undefined && requirements.allowUnaccepted !== true) {\n      const requiredLevel = normalizeAcceptanceLevel(await config.acceptance.requiredLevel());\n      if (requiredLevel > 0) {\n        const acceptedLevel = normalizeAcceptanceLevel(\n          (token as Record<string, unknown>)[config.acceptance.claimKey],\n        );\n        if (acceptedLevel < requiredLevel) {\n          throw new AuthAssertionError(\n            'failed-precondition',\n            'The current documents must be accepted before continuing',\n            { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel, acceptedLevel },\n          );\n        }\n      }\n    }\n\n    // 6. Admin check (delegates to config.requireAdmin)\n    let adminResult: TAdmin | undefined;\n    if (requirements.admin !== undefined) {\n      adminResult = await config.requireAdmin(uid, token, requirements.admin);\n    }\n\n    // 7. Return context with whatever docs were fetched\n    const ctx: AuthContext<TUser, TAdmin> = { uid, token };\n    if (userDoc !== undefined) {\n      ctx.userDoc = userDoc;\n    }\n    if (requirements.admin !== undefined) {\n      ctx.admin = adminResult as TAdmin;\n    }\n    return ctx;\n  };\n}\n"]}
+{"version":3,"file":"assertAuth.js","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,UAAU,gBAAgB,CAC9B,MAAsD;IAEtD,OAAO,KAAK,UAAU,UAAU,CAC9B,OAAwB,EACxB,eAAgD,EAAE;QAElD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAEjC,IAAI,YAAY,CAAC,aAAa,KAAK,IAAI,IAAI,YAAY,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACjF,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wBAAwB,EAAE;oBAC5E,MAAM,EAAE,kCAAkC;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GACZ,YAAY,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEhG,IAAI,OAA0B,CAAC;QAE/B,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAW,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;YACvF,CAAC;YACD,IAAI,MAAM,KAAK,WAAW,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACnE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,YAAY,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7E,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;YACxF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,wBAAwB,CAC3C,KAAiC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC/D,CAAC;gBACF,IAAI,aAAa,GAAG,aAAa,EAAE,CAAC;oBAClC,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,0DAA0D,EAC1D,EAAE,MAAM,EAAE,0BAA0B,EAAE,aAAa,EAAE,aAAa,EAAE,CACrE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,WAA+B,CAAC;QACpC,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,WAAW,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,GAAG,GAA+B,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,GAAG,CAAC,KAAK,GAAG,WAAqB,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { CallableRequest } from 'firebase-functions/v2/https';\nimport { ACCEPTANCE_REQUIRED_REASON, normalizeAcceptanceLevel } from '../acceptance.js';\nimport { EMAIL_VERIFICATION_REQUIRED_REASON } from '../email-verification.js';\nimport { AuthAssertionError } from './authError.js';\nimport type { AssertAuthConfig, AssertAuthFn, AuthContext, AuthRequirements } from './types.js';\n\nexport function createAssertAuth<TUser, TAdmin = void, TAdminOptions = never>(\n  config: AssertAuthConfig<TUser, TAdmin, TAdminOptions>,\n): AssertAuthFn<TUser, TAdmin, TAdminOptions> {\n  return async function assertAuth(\n    request: CallableRequest,\n    requirements: AuthRequirements<TAdminOptions> = {},\n  ): Promise<AuthContext<TUser, TAdmin>> {\n    if (!request.auth) {\n      throw new AuthAssertionError('unauthenticated', 'You must be authenticated');\n    }\n\n    const uid = request.auth.uid;\n    const token = request.auth.token;\n\n    if (requirements.emailVerified === true && requirements.allowUnverified !== true) {\n      if (token.email_verified !== true) {\n        throw new AuthAssertionError('failed-precondition', 'Email must be verified', {\n          reason: EMAIL_VERIFICATION_REQUIRED_REASON,\n        });\n      }\n    }\n\n    const db = config.firestore();\n    const userSnap =\n      requirements.allowAnyStatus !== true ? await db.doc(config.userProfilePath(uid)).get() : null;\n\n    let userDoc: TUser | undefined;\n\n    if (requirements.allowAnyStatus !== true) {\n      if (!userSnap || !userSnap.exists) {\n        throw new AuthAssertionError('not-found', 'User profile not found');\n      }\n      const userData = userSnap.data() as TUser;\n      const status = config.getUserStatus(userData);\n      if (status === 'banned') {\n        throw new AuthAssertionError('permission-denied', 'Account is not in good standing');\n      }\n      if (status === 'suspended' && requirements.allowSuspended !== true) {\n        throw new AuthAssertionError('permission-denied', 'Account is not in good standing');\n      }\n      userDoc = userData;\n    }\n\n    if (config.acceptance !== undefined && requirements.allowUnaccepted !== true) {\n      const requiredLevel = normalizeAcceptanceLevel(await config.acceptance.requiredLevel());\n      if (requiredLevel > 0) {\n        const acceptedLevel = normalizeAcceptanceLevel(\n          (token as Record<string, unknown>)[config.acceptance.claimKey],\n        );\n        if (acceptedLevel < requiredLevel) {\n          throw new AuthAssertionError(\n            'failed-precondition',\n            'The current documents must be accepted before continuing',\n            { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel, acceptedLevel },\n          );\n        }\n      }\n    }\n\n    let adminResult: TAdmin | undefined;\n    if (requirements.admin !== undefined) {\n      adminResult = await config.requireAdmin(uid, token, requirements.admin);\n    }\n\n    const ctx: AuthContext<TUser, TAdmin> = { uid, token };\n    if (userDoc !== undefined) {\n      ctx.userDoc = userDoc;\n    }\n    if (requirements.admin !== undefined) {\n      ctx.admin = adminResult as TAdmin;\n    }\n    return ctx;\n  };\n}\n"]}

package/dist/server/authError.d.ts

@@ -1,54 +1,6 @@
 import type { AcceptanceRequiredDetails } from '../acceptance.js';
 import type { EmailVerificationRequiredDetails } from '../email-verification.js';
-/**
- * Typed failure channel for `createAssertAuth`.
- *
- * Every EXPECTED auth outcome (not signed in, email unverified, missing profile,
- * account not in good standing) throws an `AuthAssertionError` whose `code` is
- * deliberately the matching `HttpsError` code string, so a consuming Cloud
- * Function maps it 1:1 at the app boundary:
- *
- *   catch (err) {
- *     if (err instanceof AuthAssertionError) throw new HttpsError(err.code, err.message);
- *     throw err;
- *   }
- *
- * WHY THE PACKAGE MUST NOT BUILD THE HttpsError ITSELF: firebase-functions 7.2.5
- * ships TWO distinct `HttpsError` classes — the one
- * exported from the ESM entry `firebase-functions/v2/https`, and the one the CJS
- * callable runtime closes over and `instanceof`-checks at
- * `lib/common/providers/https.js`. An `HttpsError` constructed by this package's
- * ESM `dist` fails that identity check, so `onCall` logged "Unhandled error" and
- * replaced a correct 400 with `500 INTERNAL`. Measured:
- *
- *   ESM class === CJS class ?              false
- *   esm-built error instanceof CJS class ? false
- *   httpErrorCode.status:                  400   (the error itself was correct)
- *
- * Because `assertAuth` is the first line of every callable, that turned EVERY auth
- * rejection — unauthenticated, unverified email, suspended, banned — into a generic
- * 500: users saw a generic error instead of the verify-email dialog, and monitoring
- * filled with 500s that were really expected answers. Constructing the HttpsError in
- * APP module space fixes the identity permanently and cannot regress when
- * firebase-functions repackages.
- *
- * This also brings auth-core in line with engineering-rules QUALITY-102 (generic
- * packages stay framework-agnostic; the consuming app's adapter binds the framework) and
- * mirrors `report-core`'s `ReportCoreTaskError`, which already works this way.
- */
 export type AuthAssertionErrorCode = 'unauthenticated' | 'failed-precondition' | 'not-found' | 'permission-denied';
-/**
- * Structured details an `AuthAssertionError` may carry — one per refusal the client answers
- * with a surface of its own, each told apart by `reason`: the email-verification refusal
- * (`reason: 'email-verification-required'`, recognized by `isEmailVerificationRequiredError`)
- * and the acceptance refusal (`reason: 'acceptance-required'`, recognized by
- * `isAcceptanceRequiredError`). The app forwards `details` as the `HttpsError` details so the
- * client can recognize them:
- *
- *   throw new HttpsError(err.code, err.message, err.details);
- *
- * Every other rejection leaves `details` undefined.
- */
 export type AuthAssertionErrorDetails = AcceptanceRequiredDetails | EmailVerificationRequiredDetails;
 export declare class AuthAssertionError extends Error {
     readonly code: AuthAssertionErrorCode;

package/dist/server/authError.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authError.d.ts","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,sBAAsB,GAChC,iBAAiB,GAAG,qBAAqB,GAAG,WAAW,GAAG,mBAAmB,CAAC;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,yBAAyB,GACnC,yBAAyB,GAAG,gCAAgC,CAAC;AAE/D,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;gBAEjC,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB;CAM/F"}
+{"version":3,"file":"authError.d.ts","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAIjF,MAAM,MAAM,sBAAsB,GAChC,iBAAiB,GAAG,qBAAqB,GAAG,WAAW,GAAG,mBAAmB,CAAC;AAEhF,MAAM,MAAM,yBAAyB,GACnC,yBAAyB,GAAG,gCAAgC,CAAC;AAE/D,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;gBAEjC,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB;CAM/F"}

package/dist/server/authError.js.map

@@ -1 +1 @@
-{"version":3,"file":"authError.js","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AAyDA,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,OAAO,CAA6B;IAE7C,YAAY,IAA4B,EAAE,OAAe,EAAE,OAAmC;QAC5F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACpD,CAAC;CACF","sourcesContent":["import type { AcceptanceRequiredDetails } from '../acceptance.js';\nimport type { EmailVerificationRequiredDetails } from '../email-verification.js';\n\n/**\n * Typed failure channel for `createAssertAuth`.\n *\n * Every EXPECTED auth outcome (not signed in, email unverified, missing profile,\n * account not in good standing) throws an `AuthAssertionError` whose `code` is\n * deliberately the matching `HttpsError` code string, so a consuming Cloud\n * Function maps it 1:1 at the app boundary:\n *\n *   catch (err) {\n *     if (err instanceof AuthAssertionError) throw new HttpsError(err.code, err.message);\n *     throw err;\n *   }\n *\n * WHY THE PACKAGE MUST NOT BUILD THE HttpsError ITSELF: firebase-functions 7.2.5\n * ships TWO distinct `HttpsError` classes — the one\n * exported from the ESM entry `firebase-functions/v2/https`, and the one the CJS\n * callable runtime closes over and `instanceof`-checks at\n * `lib/common/providers/https.js`. An `HttpsError` constructed by this package's\n * ESM `dist` fails that identity check, so `onCall` logged \"Unhandled error\" and\n * replaced a correct 400 with `500 INTERNAL`. Measured:\n *\n *   ESM class === CJS class ?              false\n *   esm-built error instanceof CJS class ? false\n *   httpErrorCode.status:                  400   (the error itself was correct)\n *\n * Because `assertAuth` is the first line of every callable, that turned EVERY auth\n * rejection — unauthenticated, unverified email, suspended, banned — into a generic\n * 500: users saw a generic error instead of the verify-email dialog, and monitoring\n * filled with 500s that were really expected answers. Constructing the HttpsError in\n * APP module space fixes the identity permanently and cannot regress when\n * firebase-functions repackages.\n *\n * This also brings auth-core in line with engineering-rules QUALITY-102 (generic\n * packages stay framework-agnostic; the consuming app's adapter binds the framework) and\n * mirrors `report-core`'s `ReportCoreTaskError`, which already works this way.\n */\nexport type AuthAssertionErrorCode =\n  'unauthenticated' | 'failed-precondition' | 'not-found' | 'permission-denied';\n\n/**\n * Structured details an `AuthAssertionError` may carry — one per refusal the client answers\n * with a surface of its own, each told apart by `reason`: the email-verification refusal\n * (`reason: 'email-verification-required'`, recognized by `isEmailVerificationRequiredError`)\n * and the acceptance refusal (`reason: 'acceptance-required'`, recognized by\n * `isAcceptanceRequiredError`). The app forwards `details` as the `HttpsError` details so the\n * client can recognize them:\n *\n *   throw new HttpsError(err.code, err.message, err.details);\n *\n * Every other rejection leaves `details` undefined.\n */\nexport type AuthAssertionErrorDetails =\n  AcceptanceRequiredDetails | EmailVerificationRequiredDetails;\n\nexport class AuthAssertionError extends Error {\n  readonly code: AuthAssertionErrorCode;\n  readonly details?: AuthAssertionErrorDetails;\n\n  constructor(code: AuthAssertionErrorCode, message: string, details?: AuthAssertionErrorDetails) {\n    super(message);\n    this.name = 'AuthAssertionError';\n    this.code = code;\n    if (details !== undefined) this.details = details;\n  }\n}\n"]}
+{"version":3,"file":"authError.js","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,OAAO,CAA6B;IAE7C,YAAY,IAA4B,EAAE,OAAe,EAAE,OAAmC;QAC5F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACpD,CAAC;CACF","sourcesContent":["import type { AcceptanceRequiredDetails } from '../acceptance.js';\nimport type { EmailVerificationRequiredDetails } from '../email-verification.js';\n\n// firebase-functions' callable runtime instanceof-checks its own HttpsError class, which one built\n// in this package's ESM dist fails (a 500 INTERNAL), so the consuming app builds the HttpsError.\nexport type AuthAssertionErrorCode =\n  'unauthenticated' | 'failed-precondition' | 'not-found' | 'permission-denied';\n\nexport type AuthAssertionErrorDetails =\n  AcceptanceRequiredDetails | EmailVerificationRequiredDetails;\n\nexport class AuthAssertionError extends Error {\n  readonly code: AuthAssertionErrorCode;\n  readonly details?: AuthAssertionErrorDetails;\n\n  constructor(code: AuthAssertionErrorCode, message: string, details?: AuthAssertionErrorDetails) {\n    super(message);\n    this.name = 'AuthAssertionError';\n    this.code = code;\n    if (details !== undefined) this.details = details;\n  }\n}\n"]}

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
 export { createAssertAuth } from './assertAuth.js';
 export { AuthAssertionError } from './authError.js';
 export type { AuthAssertionErrorCode, AuthAssertionErrorDetails } from './authError.js';
-export type { AcceptanceGateConfig, AssertAuthConfig, AssertAuthFn, AuthContext, AuthRequirements, AdminCheckOptions, UserStatus, } from './types.js';
+export type { AcceptanceGateConfig, AssertAuthConfig, AssertAuthFn, AuthContext, AuthRequirements, UserStatus, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,GACX,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC"}

package/dist/server/index.js

@@ -1,4 +1,3 @@
-// Public surface of @ttt-productions/auth-core/server.
 export { createAssertAuth } from './assertAuth.js';
 export { AuthAssertionError } from './authError.js';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["// Public surface of @ttt-productions/auth-core/server.\n\nexport { createAssertAuth } from './assertAuth.js';\nexport { AuthAssertionError } from './authError.js';\nexport type { AuthAssertionErrorCode, AuthAssertionErrorDetails } from './authError.js';\nexport type {\n  AcceptanceGateConfig,\n  AssertAuthConfig,\n  AssertAuthFn,\n  AuthContext,\n  AuthRequirements,\n  AdminCheckOptions,\n  UserStatus,\n} from './types.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["export { createAssertAuth } from './assertAuth.js';\nexport { AuthAssertionError } from './authError.js';\nexport type { AuthAssertionErrorCode, AuthAssertionErrorDetails } from './authError.js';\nexport type {\n  AcceptanceGateConfig,\n  AssertAuthConfig,\n  AssertAuthFn,\n  AuthContext,\n  AuthRequirements,\n  UserStatus,\n} from './types.js';\n"]}