npm - @wildo-ai/saas-technical-doc - Versions diffs - 1.1.4 → 1.1.6 - Mend

@wildo-ai/saas-technical-doc 1.1.4 → 1.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (205) hide show

package/dist/esm/runtime/AuthExchangePage.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AuthExchangePage.js","sourceRoot":"","sources":["../../../../src/runtime/AuthExchangePage.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAA+C,MAAM,OAAO,CAAC;AACjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAoB7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAiCxB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE;IACrC,MAAM,EAAE,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAE/C,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAqB,SAAS,CAAC,CAAC;IACpE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAS,GAAG,CAAC,CAAC;IAE1D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,CAAC,OAAO;YAAE,OAAO;QAC9B,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC;QAEzB;;;;;WAKG;QACH,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAE1C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC;;;;;;;;WAQG;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QACjD,MAAM,aAAa,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACvD,aAAa,CAAC,aAAa,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS,CAAC,aAAa,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC;aAChB,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE,EAAE;YACnD;;;;;;;;;;;;;;;eAeG;YACH,MAAM,UAAU,GAAG,kBAAkB;gBACnC,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;gBACxC,CAAC,CAAC,aAAa,CAAC;YAClB,aAAa,CAAC,UAAU,CAAC,CAAC;YAE1B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,QAAQ,CACN,mIAAmI,CACpI,CAAC;gBACF,SAAS,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,iEAAiE;YACjE,kEAAkE;YAClE,+DAA+D;YAC/D,kEAAkE;YAClE,kEAAkE;YAClE,qCAAqC;YACrC,MAAM,QAAQ,GACZ,iBAAiB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;gBACrB,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvB,CAAC,EAAE,CAAC,CAAC,CAAC;QACR,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACpE,SAAS,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAEvC,IAAI,MAAM;QAAE,OAAO,4BAAG,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,GAAI,CAAC;IAEhE,OAAO,KAAC,iBAAiB,IAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,GAAI,CAAC;AACrF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAIlB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE;IACrC,MAAM,cAAc,GAAkB;QACpC,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,uBAAuB;QACnC,SAAS,EAAE,QAAQ;KACpB,CAAC;IAEF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QACpD,OAAO,CACL,eAAK,KAAK,EAAE,cAAc,aACxB,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,qCAAsB,EACxD,YAAG,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAAmC,IAC1D,CACP,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CACL,eAAK,KAAK,EAAE,cAAc,aACxB,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,kCAA6B,EAC/D,aAAG,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAkB,UAAU,cAAM,IACzD,CACP,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,CACL,eAAK,KAAK,EAAE,cAAc,aACxB,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,mDAAyC,EAC3E,YAAG,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oEAAyD,EACpF,sBACE,YAAG,IAAI,EAAC,GAAG,gCAAoB,GAC7B,IACA,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,KAAK,EAAE,cAAc,aACxB,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,+BAAqB,EACvD,YAAG,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAG,KAAK,IAAI,gBAAgB,GAAK,EAC5D,sBACE,YAAG,IAAI,EAAC,GAAG,gCAAoB,GAC7B,IACA,CACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { useEffect, useRef, useState, type CSSProperties, type FC, type ReactNode } from 'react';\nimport { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\nimport { useDocsAuthSession } from './use-docs-auth-session';\n\n/*\n Status of the auth-code exchange the page is performing.\n \n - `pending` — initial mount; effect has not yet run.\n * - `exchanging`— the `/auth/token/exchange` POST is in flight.\n * - `success` — tokens received; about to navigate to `returnPath`.\n * - `error` — exchange failed; the page renders a fallback message\n * and a manual link back to the docs root.\n * - `missingCode`— landed on `/auth/exchange` without `?code=…` (someone\n * bookmarked the page or arrived via a stale link).\n /\nexport type AuthExchangeStatus =\n \| 'pending'\n \| 'exchanging'\n \| 'success'\n \| 'error'\n \| 'missingCode';\n\n/\n Page component mounted at `/auth/exchange` on the docs site\n * (saas-technical-doc.md Step 5).\n \n Lifecycle on mount:\n \n 1. Read `?code=` and `?return=` from `window.location.search`.\n * 2. If `code` is missing → render the missingCode UI (no network call).\n * 3. Else call `useDocsAuthSession().beginExchange(code)`, which POSTs\n * `/auth/token/exchange` and updates the in-memory context.\n * 4. On success, navigate to `returnPath` (defaults to `/`) using the\n * consumer-supplied `onSuccessNavigate` (Docusaurus / react-router\n * hosts MUST pass a client-side `history.push` — see the prop\n * docstring below for why a full reload is incorrect here).\n * 5. On failure, render the error UI with a link back to `/`.\n \n Why a single component (rather than splitting effect + render):\n \n - Keeps the exchange contract trivially auditable from one file.\n * - The effect intentionally runs ONCE per mount (`hasRunRef` guard) —\n * `code` values are single-use AUTH_CODE_EXCHANGE consumable tokens\n * and a stray re-mount in React 18 strict-mode dev would burn the\n * code with the second call returning `invalid_or_expired_code`.\n \n Visual layer: this component renders a minimal centered \"Signing you\n * in…\" / error block. Apps that want to brand it can either pass a\n * `render` prop (consumer-controlled UI for each status) or skip this\n * component entirely and call `useDocsAuthSession().beginExchange(code)`\n * from their own page. The default rendering deliberately uses inline\n * styles (no Tailwind / no CSS imports) so the component can be mounted\n * by any Docusaurus theme without dragging in extra build pipeline.\n /\nexport const AuthExchangePage: FC<{\n /\n Override the default rendering. Receives the current status and (when\n * the page reaches a terminal state) a recovery URL the consumer can\n * link back to.\n /\n render?: (props: { status: AuthExchangeStatus; returnPath: string; error: string \| null }) => ReactNode;\n /\n Post-success navigation. *SPA hosts (Docusaurus, react-router,\n Vite/React-Router apps) MUST pass a client-side router push** — the\n * default `window.location.assign` triggers a full browser navigation\n * which destroys the in-memory `DocsAuthProvider` state we just\n * populated (the entire JS bundle re-executes from scratch on the\n * destination page, the React tree re-mounts, and `session` resets to\n * `'anonymous'`). For a Docusaurus consumer that looks like:\n \n ```tsx\n * import { useHistory } from '@docusaurus/router';\n \n function AuthExchangeRoute() {\n * const history = useHistory();\n * return <AuthExchangePage onSuccessNavigate={(p) => history.push(p)} />;\n * }\n * ```\n \n The default `window.location.assign` only works for plain-HTML hosts\n * that have no in-memory client state to preserve across the redirect.\n * It is kept as the default so the runtime stays usable in those hosts\n * with zero ceremony, but for SPAs failing to override it would\n * silently break the entire handoff (the user lands on the destination\n * page anonymous and any role-gated content rejects them).\n /\n onSuccessNavigate?: (returnPath: string) => void;\n}> = ({ render, onSuccessNavigate }) => {\n const { beginExchange } = useDocsAuthSession();\n\n const [status, setStatus] = useState<AuthExchangeStatus>('pending');\n const [error, setError] = useState<string \| null>(null);\n const [returnPath, setReturnPath] = useState<string>('/');\n\n const hasRunRef = useRef(false);\n\n useEffect(() => {\n if (hasRunRef.current) return;\n hasRunRef.current = true;\n\n /\n SSR / build-time safety: Docusaurus may evaluate page modules in\n * Node during the static build pre-render pass. `window` is undefined\n * there. Bailing out keeps the static HTML emission clean — the real\n * exchange runs on hydration in the browser.\n /\n if (typeof window === 'undefined') return;\n\n const params = new URLSearchParams(window.location.search);\n const code = params.get('code');\n /\n URL `?return=` is kept as a defense-in-depth fallback for codes\n * minted before the cross-app-jwt-propagation.md Step 5 metadata\n * roll-out (which carries `returnPath` inside the exchange response\n * envelope). The post-exchange `safeReturn` resolution below prefers\n * the response-borne value because the issuer signs both into the\n * same code and the response value cannot be tampered with by\n * rewriting only the URL query string.\n /\n const rawUrlReturn = params.get('return') ?? '/';\n const urlSafeReturn = sanitizeReturnPath(rawUrlReturn);\n setReturnPath(urlSafeReturn);\n\n if (!code) {\n setStatus('missingCode');\n return;\n }\n\n setStatus('exchanging');\n beginExchange(code)\n .then(({ claims, returnPath: responseReturnPath }) => {\n /\n Source-of-truth ordering for navigation target:\n * 1. `responseReturnPath` — issuer-supplied via the exchange\n * response's TOP-LEVEL `returnPath` field (NOT a `metadata`\n * sub-field — the response has no `metadata` envelope; see\n * `TokenExchangeResponseSchema`). Sanitized again here even\n * though the issuer already validates at minting time; an\n * attacker who can intercept the response body should not be\n * able to weaponise it.\n * 2. `urlSafeReturn` — the URL `?return=` query parameter\n * (already sanitized above). Used when codes were minted\n * without a `returnPath` (OAuth2 callbacks, by contract)\n * OR when the response otherwise omits it.\n * 3. `/` — the docs root. Final fallback so the user is never\n * stranded on `/auth/exchange`.\n /\n const safeReturn = responseReturnPath\n ? sanitizeReturnPath(responseReturnPath)\n : urlSafeReturn;\n setReturnPath(safeReturn);\n\n if (claims === null) {\n setError(\n 'This sign-in link could not be exchanged. It may have expired or already been used. Please re-open the docs from the application.',\n );\n setStatus('error');\n return;\n }\n setStatus('success');\n // Navigate AFTER the React state flush so any other consumers of\n // `useDocsAuthSession()` see the authenticated session before the\n // page disappears. The default `window.location.assign` is the\n // plain-HTML fallback; SPA hosts override via `onSuccessNavigate`\n // (see prop docstring — full reload would tear down the in-memory\n // provider state we just populated).\n const navigate =\n onSuccessNavigate ?? ((path: string) => window.location.assign(path));\n window.setTimeout(() => {\n navigate(safeReturn);\n }, 0);\n })\n .catch((cause: unknown) => {\n setError(cause instanceof Error ? cause.message : 'Sign-in failed');\n setStatus('error');\n });\n }, [beginExchange, onSuccessNavigate]);\n\n if (render) return <>{render({ status, returnPath, error })}</>;\n\n return <DefaultExchangeUi status={status} returnPath={returnPath} error={error} />;\n};\n\n/\n Minimal client-side validation of the `return` query parameter.\n \n The cross-frontend handoff endpoint already validates `returnPath` at\n * the schema boundary (see `CrossFrontendHandoff_ReturnPathSchema` in\n * `authentication.shared.dto.schemas.ts`). This duplicate check is\n * defense-in-depth: anyone could construct a docs URL like\n * `/auth/exchange?code=…&return=https://evil.com` directly without\n * going through the backend. Without this guard, the `location.assign`\n * fallback (used by plain-HTML hosts when `onSuccessNavigate` is not\n * supplied) would happily redirect to that origin.\n \n The ORIGIN question is delegated to the shared\n * {@link isSameOriginRedirectPath} predicate on the bundle-safe seam, and\n * that delegation is a fix, not tidying. This function was a verbatim copy\n * of the SaaS-app receiver's copy, which was itself a copy of the issuer\n * schema's rules — and all three admitted `/<TAB>/evil.com`, because the\n * URL parser strips ASCII tab / LF / CR from the input BEFORE parsing, so\n * the target the browser sees is `//evil.com`. Every copy banned `\\`; none\n * banned the whitespace that becomes a `/`. Three mirrors reflected the\n * same hole, which is why the answer now has one home.\n \n The character rules are KEPT as defence-in-depth for the concerns the\n * origin predicate deliberately does not own: path traversal (`..`), markup\n * injection (`<>\"`) and the length ceiling.\n /\nfunction sanitizeReturnPath(raw: string): string {\n // Authoritative: `//evil.com`, `/\\evil.com` and the stripped-control-character\n // family all fail here, in one parse-based check.\n if (!isSameOriginRedirectPath(raw)) return '/';\n if (raw.includes('..')) return '/';\n if (raw.includes('\\\\')) return '/';\n if (raw.includes('://')) return '/';\n if (/[<>\"]/.test(raw)) return '/';\n if (raw.length > 256) return '/';\n return raw;\n}\n\n/\n Default zero-style status block. Apps that brand the docs site override\n * this via the `render` prop on `<AuthExchangePage>`.\n */\nconst DefaultExchangeUi: FC<{\n status: AuthExchangeStatus;\n returnPath: string;\n error: string \| null;\n}> = ({ status, returnPath, error }) => {\n const containerStyle: CSSProperties = {\n maxWidth: 480,\n margin: '6rem auto',\n padding: '2rem',\n fontFamily: 'system-ui, sans-serif',\n textAlign: 'center',\n };\n\n if (status === 'pending' \|\| status === 'exchanging') {\n return (\n <div style={containerStyle}>\n <h1 style={{ fontSize: '1.25rem' }}>Signing you in…</h1>\n <p style={{ color: '#666' }}>This will only take a moment.</p>\n </div>\n );\n }\n\n if (status === 'success') {\n return (\n <div style={containerStyle}>\n <h1 style={{ fontSize: '1.25rem' }}>You're signed in.</h1>\n <p style={{ color: '#666' }}>Redirecting to {returnPath}…</p>\n </div>\n );\n }\n\n if (status === 'missingCode') {\n return (\n <div style={containerStyle}>\n <h1 style={{ fontSize: '1.25rem' }}>This page requires a sign-in code.</h1>\n <p style={{ color: '#666' }}>Please open the documentation from the application.</p>\n <p>\n <a href=\"/\">Go to docs home</a>\n </p>\n </div>\n );\n }\n\n return (\n <div style={containerStyle}>\n <h1 style={{ fontSize: '1.25rem' }}>Sign-in failed</h1>\n <p style={{ color: '#666' }}>{error ?? 'Unknown error.'}</p>\n <p>\n <a href=\"/\">Go to docs home</a>\n </p>\n </div>\n );\n};\n"]}
1	+ {"version":3,"file":"AuthExchangePage.js","sourceRoot":"","sources":["../../../../src/runtime/AuthExchangePage.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAA+C,MAAM,OAAO,CAAC;AACjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAoC,MAAM,iCAAiC,CAAC;AAsBhG,kFAAkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;AAEjE,+GAA+G;AAC/G,MAAM,UAAU,uBAAuB,CAAC,EAAE,SAAS,EAAkD;IACnG,MAAM,IAAI,GAAG,CAAC,MAA+B,EAAE,SAA2C,EAAE,EAAU,EAAE,CACtG,WAAW,CAAC,SAAS,CAAC,GAAG,4BAA4B,GAAG,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;QAC5B,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC;QACxC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;QAC1B,aAAa,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC1E,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;QAChC,iBAAiB,EAAE,IAAI,CAAC,mBAAmB,CAAC;QAC5C,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;QAClC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;QAClC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;QAChC,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,6FAA6F;IAC7F,oDAA6B,CAAA;IAC7B,oEAAoE;IACpE,0DAAmC,CAAA;AACrC,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAuCxB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE;IAC5C,MAAM,EAAE,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAE/C,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAqB,SAAS,CAAC,CAAC;IACpE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAA6B,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAS,GAAG,CAAC,CAAC;IAE1D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,CAAC,OAAO;YAAE,OAAO;QAC9B,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC;QAEzB;;;;;WAKG;QACH,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAE1C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC;;;;;;;;WAQG;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QACjD,MAAM,aAAa,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACvD,aAAa,CAAC,aAAa,CAAC,CAAC;QAE7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS,CAAC,aAAa,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC;aAChB,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE,EAAE;YACnD;;;;;;;;;;;;;;;eAeG;YACH,MAAM,UAAU,GAAG,kBAAkB;gBACnC,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;gBACxC,CAAC,CAAC,aAAa,CAAC;YAClB,aAAa,CAAC,UAAU,CAAC,CAAC;YAE1B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,QAAQ,CAAC,gEAAgE,CAAC,CAAC;gBAC3E,UAAU,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;gBAC7C,SAAS,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,iEAAiE;YACjE,kEAAkE;YAClE,+DAA+D;YAC/D,kEAAkE;YAClE,kEAAkE;YAClE,qCAAqC;YACrC,MAAM,QAAQ,GACZ,iBAAiB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;gBACrB,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvB,CAAC,EAAE,CAAC,CAAC,CAAC;QACR,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,UAAU,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAChD,SAAS,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAEvC,IAAI,MAAM;QAAE,OAAO,4BAAG,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAI,CAAC;IAEzE,OAAO,KAAC,iBAAiB,IAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,GAAI,CAAC;AACvG,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAKlB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;IAC9C,MAAM,cAAc,GAAkB;QACpC,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,uBAAuB;QACnC,SAAS,EAAE,QAAQ;KACpB,CAAC;IAEF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QACpD,OAAO,CACL,eAAK,KAAK,EAAE,cAAc,aACxB,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAG,KAAK,CAAC,SAAS,GAAM,EAC1D,YAAG,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAG,KAAK,CAAC,eAAe,GAAK,IACpD,CACP,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CACL,eAAK,KAAK,EAAE,cAAc,aACxB,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAG,KAAK,CAAC,QAAQ,GAAM,EACzD,YAAG,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAG,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,GAAK,IAC9D,CACP,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,CACL,eAAK,KAAK,EAAE,cAAc,aACxB,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAG,KAAK,CAAC,WAAW,GAAM,EAC5D,YAAG,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAG,KAAK,CAAC,iBAAiB,GAAK,EAC1D,sBACE,YAAG,IAAI,EAAC,GAAG,YAAE,KAAK,CAAC,YAAY,GAAK,GAClC,IACA,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,KAAK,EAAE,cAAc,aACxB,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAG,KAAK,CAAC,YAAY,GAAM,EAC7D,YAAG,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAG,OAAO,KAAK,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,GAAK,EAC1H,sBACE,YAAG,IAAI,EAAC,GAAG,YAAE,KAAK,CAAC,YAAY,GAAK,GAClC,IACA,CACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { useEffect, useRef, useState, type CSSProperties, type FC, type ReactNode } from 'react';\nimport { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\nimport { useDocsAuthSession } from './use-docs-auth-session';\nimport { fillMessage, type DocumentationSiteTranslator } from './documentation-site-translator';\n\n/*\n Every word the default hand-off page shows a reader (#1992). The runtime has no label pack; the site\n * words them through its translator (see {@link createAuthExchangeWords}), so an untranslated one shows\n * its id rather than English.\n /\nexport interface AuthExchangeWords {\n readonly signingIn: string;\n readonly signingInDetail: string;\n readonly signedIn: string;\n readonly redirectingTo: (returnPath: string) => string;\n readonly missingCode: string;\n readonly missingCodeDetail: string;\n readonly goToDocsHome: string;\n readonly signInFailed: string;\n /* The link was refused: expired, already used, or never valid. /\n readonly linkRefused: string;\n /* The exchange could not complete: the application did not answer, or answered with an error. /\n readonly exchangeFailed: string;\n}\n\n/* The prefix every hand-off page word's id carries in the site's `code.json`. /\nexport const AUTH_EXCHANGE_WORD_ID_PREFIX = 'docs.authExchange.';\n\n/* The hand-off page's words through the site's translator: each member reads `docs.authExchange.<member>`. /\nexport function createAuthExchangeWords({ translate }: Pick<DocumentationSiteTranslator, 'translate'>): AuthExchangeWords {\n const word = (member: keyof AuthExchangeWords, values: Readonly<Record<string, string>> = {}): string =>\n fillMessage(translate(`${AUTH_EXCHANGE_WORD_ID_PREFIX}${member}`), values);\n return {\n signingIn: word('signingIn'),\n signingInDetail: word('signingInDetail'),\n signedIn: word('signedIn'),\n redirectingTo: (returnPath) => word('redirectingTo', { path: returnPath }),\n missingCode: word('missingCode'),\n missingCodeDetail: word('missingCodeDetail'),\n goToDocsHome: word('goToDocsHome'),\n signInFailed: word('signInFailed'),\n linkRefused: word('linkRefused'),\n exchangeFailed: word('exchangeFailed'),\n };\n}\n\n/\n Why a hand-off did not sign the reader in — decides which word the page shows. The technical cause\n * stays in `error` for a `render` consumer and for logs; it is not a sentence for a reader.\n /\nexport enum AuthExchangeFailure {\n /* The application answered, and refused the code: expired, already used, or never valid. /\n LINK_REFUSED = 'link_refused',\n /* The exchange did not complete: no answer, or an error answer. /\n EXCHANGE_FAILED = 'exchange_failed',\n}\n\n/\n Status of the auth-code exchange the page is performing.\n \n - `pending` — initial mount; effect has not yet run.\n * - `exchanging`— the `/auth/token/exchange` POST is in flight.\n * - `success` — tokens received; about to navigate to `returnPath`.\n * - `error` — exchange failed; the page renders a fallback message\n * and a manual link back to the docs root.\n * - `missingCode`— landed on `/auth/exchange` without `?code=…` (someone\n * bookmarked the page or arrived via a stale link).\n /\nexport type AuthExchangeStatus =\n \| 'pending'\n \| 'exchanging'\n \| 'success'\n \| 'error'\n \| 'missingCode';\n\n/\n Page component mounted at `/auth/exchange` on the docs site\n * (saas-technical-doc.md Step 5).\n \n Lifecycle on mount:\n \n 1. Read `?code=` and `?return=` from `window.location.search`.\n * 2. If `code` is missing → render the missingCode UI (no network call).\n * 3. Else call `useDocsAuthSession().beginExchange(code)`, which POSTs\n * `/auth/token/exchange` and updates the in-memory context.\n * 4. On success, navigate to `returnPath` (defaults to `/`) using the\n * consumer-supplied `onSuccessNavigate` (Docusaurus / react-router\n * hosts MUST pass a client-side `history.push` — see the prop\n * docstring below for why a full reload is incorrect here).\n * 5. On failure, render the error UI with a link back to `/`.\n \n Why a single component (rather than splitting effect + render):\n \n - Keeps the exchange contract trivially auditable from one file.\n * - The effect intentionally runs ONCE per mount (`hasRunRef` guard) —\n * `code` values are single-use AUTH_CODE_EXCHANGE consumable tokens\n * and a stray re-mount in React 18 strict-mode dev would burn the\n * code with the second call returning `invalid_or_expired_code`.\n \n Visual layer: this component renders a minimal centered status block\n * in the words the site passes as `words` (#1992). Apps that want to brand it can either pass a\n * `render` prop (consumer-controlled UI for each status) or skip this\n * component entirely and call `useDocsAuthSession().beginExchange(code)`\n * from their own page. The default rendering deliberately uses inline\n * styles (no Tailwind / no CSS imports) so the component can be mounted\n * by any Docusaurus theme without dragging in extra build pipeline.\n /\nexport const AuthExchangePage: FC<({\n /\n Override the default rendering. Receives the current status and (when\n * the page reaches a terminal state) a recovery URL the consumer can\n * link back to.\n /\n render: (props: { status: AuthExchangeStatus; returnPath: string; error: string \| null; failure: AuthExchangeFailure \| null }) => ReactNode;\n words?: undefined;\n} \| {\n render?: undefined;\n /* The default rendering's words, worded by the site (#1992). Required unless `render` replaces it. /\n words: AuthExchangeWords;\n}) & {\n /\n Post-success navigation. *SPA hosts (Docusaurus, react-router,\n Vite/React-Router apps) MUST pass a client-side router push** — the\n * default `window.location.assign` triggers a full browser navigation\n * which destroys the in-memory `DocsAuthProvider` state we just\n * populated (the entire JS bundle re-executes from scratch on the\n * destination page, the React tree re-mounts, and `session` resets to\n * `'anonymous'`). For a Docusaurus consumer that looks like:\n \n ```tsx\n * import { useHistory } from '@docusaurus/router';\n \n function AuthExchangeRoute() {\n * const history = useHistory();\n * return <AuthExchangePage onSuccessNavigate={(p) => history.push(p)} />;\n * }\n * ```\n \n The default `window.location.assign` only works for plain-HTML hosts\n * that have no in-memory client state to preserve across the redirect.\n * It is kept as the default so the runtime stays usable in those hosts\n * with zero ceremony, but for SPAs failing to override it would\n * silently break the entire handoff (the user lands on the destination\n * page anonymous and any role-gated content rejects them).\n /\n onSuccessNavigate?: (returnPath: string) => void;\n}> = ({ render, words, onSuccessNavigate }) => {\n const { beginExchange } = useDocsAuthSession();\n\n const [status, setStatus] = useState<AuthExchangeStatus>('pending');\n const [error, setError] = useState<string \| null>(null);\n const [failure, setFailure] = useState<AuthExchangeFailure \| null>(null);\n const [returnPath, setReturnPath] = useState<string>('/');\n\n const hasRunRef = useRef(false);\n\n useEffect(() => {\n if (hasRunRef.current) return;\n hasRunRef.current = true;\n\n /\n SSR / build-time safety: Docusaurus may evaluate page modules in\n * Node during the static build pre-render pass. `window` is undefined\n * there. Bailing out keeps the static HTML emission clean — the real\n * exchange runs on hydration in the browser.\n /\n if (typeof window === 'undefined') return;\n\n const params = new URLSearchParams(window.location.search);\n const code = params.get('code');\n /\n URL `?return=` is kept as a defense-in-depth fallback for codes\n * minted before the cross-app-jwt-propagation.md Step 5 metadata\n * roll-out (which carries `returnPath` inside the exchange response\n * envelope). The post-exchange `safeReturn` resolution below prefers\n * the response-borne value because the issuer signs both into the\n * same code and the response value cannot be tampered with by\n * rewriting only the URL query string.\n /\n const rawUrlReturn = params.get('return') ?? '/';\n const urlSafeReturn = sanitizeReturnPath(rawUrlReturn);\n setReturnPath(urlSafeReturn);\n\n if (!code) {\n setStatus('missingCode');\n return;\n }\n\n setStatus('exchanging');\n beginExchange(code)\n .then(({ claims, returnPath: responseReturnPath }) => {\n /\n Source-of-truth ordering for navigation target:\n * 1. `responseReturnPath` — issuer-supplied via the exchange\n * response's TOP-LEVEL `returnPath` field (NOT a `metadata`\n * sub-field — the response has no `metadata` envelope; see\n * `TokenExchangeResponseSchema`). Sanitized again here even\n * though the issuer already validates at minting time; an\n * attacker who can intercept the response body should not be\n * able to weaponise it.\n * 2. `urlSafeReturn` — the URL `?return=` query parameter\n * (already sanitized above). Used when codes were minted\n * without a `returnPath` (OAuth2 callbacks, by contract)\n * OR when the response otherwise omits it.\n * 3. `/` — the docs root. Final fallback so the user is never\n * stranded on `/auth/exchange`.\n /\n const safeReturn = responseReturnPath\n ? sanitizeReturnPath(responseReturnPath)\n : urlSafeReturn;\n setReturnPath(safeReturn);\n\n if (claims === null) {\n setError('The exchange returned no session claims: the code was refused.');\n setFailure(AuthExchangeFailure.LINK_REFUSED);\n setStatus('error');\n return;\n }\n setStatus('success');\n // Navigate AFTER the React state flush so any other consumers of\n // `useDocsAuthSession()` see the authenticated session before the\n // page disappears. The default `window.location.assign` is the\n // plain-HTML fallback; SPA hosts override via `onSuccessNavigate`\n // (see prop docstring — full reload would tear down the in-memory\n // provider state we just populated).\n const navigate =\n onSuccessNavigate ?? ((path: string) => window.location.assign(path));\n window.setTimeout(() => {\n navigate(safeReturn);\n }, 0);\n })\n .catch((cause: unknown) => {\n setError(cause instanceof Error ? cause.message : String(cause));\n setFailure(AuthExchangeFailure.EXCHANGE_FAILED);\n setStatus('error');\n });\n }, [beginExchange, onSuccessNavigate]);\n\n if (render) return <>{render({ status, returnPath, error, failure })}</>;\n\n return <DefaultExchangeUi status={status} returnPath={returnPath} failure={failure} words={words} />;\n};\n\n/\n Minimal client-side validation of the `return` query parameter.\n \n The cross-frontend handoff endpoint already validates `returnPath` at\n * the schema boundary (see `CrossFrontendHandoff_ReturnPathSchema` in\n * `authentication.shared.dto.schemas.ts`). This duplicate check is\n * defense-in-depth: anyone could construct a docs URL like\n * `/auth/exchange?code=…&return=https://evil.com` directly without\n * going through the backend. Without this guard, the `location.assign`\n * fallback (used by plain-HTML hosts when `onSuccessNavigate` is not\n * supplied) would happily redirect to that origin.\n \n The ORIGIN question is delegated to the shared\n * {@link isSameOriginRedirectPath} predicate on the bundle-safe seam, and\n * that delegation is a fix, not tidying. This function was a verbatim copy\n * of the SaaS-app receiver's copy, which was itself a copy of the issuer\n * schema's rules — and all three admitted `/<TAB>/evil.com`, because the\n * URL parser strips ASCII tab / LF / CR from the input BEFORE parsing, so\n * the target the browser sees is `//evil.com`. Every copy banned `\\`; none\n * banned the whitespace that becomes a `/`. Three mirrors reflected the\n * same hole, which is why the answer now has one home.\n \n The character rules are KEPT as defence-in-depth for the concerns the\n * origin predicate deliberately does not own: path traversal (`..`), markup\n * injection (`<>\"`) and the length ceiling.\n /\nfunction sanitizeReturnPath(raw: string): string {\n // Authoritative: `//evil.com`, `/\\evil.com` and the stripped-control-character\n // family all fail here, in one parse-based check.\n if (!isSameOriginRedirectPath(raw)) return '/';\n if (raw.includes('..')) return '/';\n if (raw.includes('\\\\')) return '/';\n if (raw.includes('://')) return '/';\n if (/[<>\"]/.test(raw)) return '/';\n if (raw.length > 256) return '/';\n return raw;\n}\n\n/\n Default zero-style status block. Apps that brand the docs site override\n * this via the `render` prop on `<AuthExchangePage>`.\n */\nconst DefaultExchangeUi: FC<{\n status: AuthExchangeStatus;\n returnPath: string;\n failure: AuthExchangeFailure \| null;\n words: AuthExchangeWords;\n}> = ({ status, returnPath, failure, words }) => {\n const containerStyle: CSSProperties = {\n maxWidth: 480,\n margin: '6rem auto',\n padding: '2rem',\n fontFamily: 'system-ui, sans-serif',\n textAlign: 'center',\n };\n\n if (status === 'pending' \|\| status === 'exchanging') {\n return (\n <div style={containerStyle}>\n <h1 style={{ fontSize: '1.25rem' }}>{words.signingIn}</h1>\n <p style={{ color: '#666' }}>{words.signingInDetail}</p>\n </div>\n );\n }\n\n if (status === 'success') {\n return (\n <div style={containerStyle}>\n <h1 style={{ fontSize: '1.25rem' }}>{words.signedIn}</h1>\n <p style={{ color: '#666' }}>{words.redirectingTo(returnPath)}</p>\n </div>\n );\n }\n\n if (status === 'missingCode') {\n return (\n <div style={containerStyle}>\n <h1 style={{ fontSize: '1.25rem' }}>{words.missingCode}</h1>\n <p style={{ color: '#666' }}>{words.missingCodeDetail}</p>\n <p>\n <a href=\"/\">{words.goToDocsHome}</a>\n </p>\n </div>\n );\n }\n\n return (\n <div style={containerStyle}>\n <h1 style={{ fontSize: '1.25rem' }}>{words.signInFailed}</h1>\n <p style={{ color: '#666' }}>{failure === AuthExchangeFailure.LINK_REFUSED ? words.linkRefused : words.exchangeFailed}</p>\n <p>\n <a href=\"/\">{words.goToDocsHome}</a>\n </p>\n </div>\n );\n};\n"]}

package/dist/esm/runtime/DocsAuthContext.d.ts CHANGED Viewed

@@ -116,8 +116,8 @@ export declare const DocsAuthProvider: FC<{
      * them. Both are needed, because a JSON payload cannot carry an SDK loader
      * and a bundle cannot know which environment it is running in.
      *
-     * Omitted is the ordinary case for a docs site declaring no package-shipped
-     * provider: no such file is generated, so there is nothing to import.
+     * Config sync emits a stable map, including an empty map for a service without providers.
+     * When DocsFrontendProviders wraps this component, that outer owner supplies the registry.
      */
     frontendProviderModules?: GeneratedTechdocProviderModules;
     /**

package/dist/esm/runtime/DocsAuthContext.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"DocsAuthContext.d.ts","sourceRoot":"","sources":["~~../../../~~src/runtime/DocsAuthContext.tsx"],"names":[],"mappings":"~~AAAA~~,OAAO,~~EAOL~~,KAAK,OAAO,EACZ,KAAK,EAAE,EACP,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAEnF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;~~AAElF~~,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sCAAsC,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;IACnE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC9D,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,OAAO,CAAC,oBAAoB,GAAG,IAAI,CACf,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,gBAAgB,EAAE,EAAE,CAAC;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C;;;;;;;;;;;;;OAaG;IACH,uBAAuB,CAAC,EAAE,+BAA+B,CAAC;IAC1D;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB,~~CA4HA~~,CAAC"}
1	+ {"version":3,"file":"DocsAuthContext.d.ts","sourceRoot":"","sources":["../../../../src/runtime/DocsAuthContext.tsx"],"names":[],"mappings":"AACA,OAAO,EAQL,KAAK,OAAO,EACZ,KAAK,EAAE,EACP,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAEnF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGlF,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sCAAsC,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;IACnE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC9D,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,OAAO,CAAC,oBAAoB,GAAG,IAAI,CACf,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,gBAAgB,EAAE,EAAE,CAAC;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C;;;;;;;;;;;;;OAaG;IACH,uBAAuB,CAAC,EAAE,+BAA+B,CAAC;IAC1D;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB,CA8HA,CAAC"}

package/dist/esm/runtime/DocsAuthContext.js CHANGED Viewed

@@ -1,8 +1,10 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { createContext, useCallback, useEffect, useMemo, useRef, useState, } from 'react';
+import { DocsFrontendProvidersContext } from './DocsFrontendProviders.js';
+import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState, } from 'react';
 import { decodeJwtClaims } from './decode-jwt-claims.js';
 import { DocsAuthClient } from './docs-auth-client.js';
 import { useDocsProviderSdks } from './use-docs-provider-sdks.js';
+import { useDocsProviderScripts } from './use-docs-provider-scripts.js';
 import { createFrontendTechdocProviderRegistry, } from './frontend-provider-registry.techdoc.js';
 /**
  * @internal — consumers should call `useDocsAuthSession()` instead of
@@ -64,7 +66,8 @@ export const DocsAuthProvider = ({ children, apiBaseUrl, frontendProviders, fron
                 : null,
         });
     }, [apiBaseUrl, frontendServiceName, clientOverride, sessionRef]);
-    const frontendProviderRegistry = useMemo(() => createFrontendTechdocProviderRegistry({
+    const inheritedProviderRegistry = useContext(DocsFrontendProvidersContext);
+    const frontendProviderRegistry = useMemo(() => inheritedProviderRegistry ?? createFrontendTechdocProviderRegistry({
         entries: frontendProviders,
         modules: frontendProviderModules,
         onDiagnostic: (diagnostic) => {
@@ -75,11 +78,12 @@ export const DocsAuthProvider = ({ children, apiBaseUrl, frontendProviders, fron
             // eslint-disable-next-line no-console
             console.warn(`[wildo-provider] ${diagnostic.kind}: ${diagnostic.message}`);
         },
-    }), [frontendProviders, frontendProviderModules]);
+    }), [inheritedProviderRegistry, frontendProviders, frontendProviderModules]);
     // Load and start the SDK of every live provider that ships one. Effect-only:
     // Docusaurus server-renders every page at build time, and starting a vendor
     // client there would run it inside the build.
-    useDocsProviderSdks(frontendProviderRegistry);
+    useDocsProviderSdks(inheritedProviderRegistry === undefined ? frontendProviderRegistry : undefined);
+    useDocsProviderScripts(inheritedProviderRegistry === undefined ? frontendProviderRegistry : undefined);
     /**
      * Auto-clear when the access token expires.
      *

package/dist/esm/runtime/DocsAuthContext.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"DocsAuthContext.js","sourceRoot":"","sources":["../../../src/runtime/DocsAuthContext.tsx"],"names":[],"mappings":";AAAA,OAAO,EACL,aAAa,EACb,WAAW,EACX,SAAS,EACT,OAAO,EACP,MAAM,EACN,QAAQ,GAIT,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,qCAAqC,GAGtC,MAAM,sCAAsC,CAAC;AA2D9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,aAAa,CAA8B,IAAI,CAAC,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAiCxB,CAAC,EACJ,QAAQ,EACR,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GAAG,IAAI,EAC1B,MAAM,EAAE,cAAc,GACvB,EAAE,EAAE;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAkB,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAEjF;;;;;;OAMG;IACH,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAG,OAAO,CAAiB,GAAG,EAAE;QAC1C,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,OAAO,IAAI,cAAc,CAAC;YACxB,UAAU;YACV,mBAAmB;YACnB,aAAa,EAAE,GAAG,EAAE,CAClB,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe;gBAC3C,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW;gBAChC,CAAC,CAAC,IAAI;SACX,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,UAAU,EAAE,mBAAmB,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;IAClE,MAAM,wBAAwB,GAAG,OAAO,CACtC,GAAG,EAAE,CACH,qCAAqC,CAAC;QACpC,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,uBAAuB;QAChC,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE;YAC3B,iEAAiE;YACjE,qEAAqE;YACrE,uEAAuE;YACvE,+BAA+B;YAC/B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,oBAAoB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC,EACJ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAC7C,CAAC;IAEF,6EAA6E;IAC7E,4EAA4E;IAC5E,8CAA8C;IAC9C,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;IAE9C;;;;;;;;;;OAUG;IACH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO;QAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7D,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACtC,CAAC,EAAE,aAAa,CAAC,CAAC;QAClB,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,MAAM,aAAa,GAAG,WAAW,CAC/B,KAAK,EAAE,IAAY,EAAoC,EAAE;QACvD,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACrD,uEAAuE;YACvE,kEAAkE;YAClE,kEAAkE;YAClE,8DAA8D;YAC9D,iEAAiE;YACjE,8DAA8D;YAC9D,0DAA0D;YAC1D,qDAAqD;YACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC;YAC/C,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ;;;;;;;;mBAQG;gBACH,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YACtC,CAAC;YACD,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACtC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAC3E,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,aAAa,EAAE,KAAK,CAAC,CAClE,CAAC;IAEF,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAC;AACvF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAS,YAAY,CAAI,KAAQ;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAI,KAAK,CAAC,CAAC;IAC7B,SAAS,CAAC,GAAG,EAAE;QACb,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import {\n createContext,\n useCallback,\n useEffect,\n useMemo,\n useRef,\n useState,\n type Context,\n type FC,\n type ReactNode,\n} from 'react';\nimport type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';\nimport { decodeJwtClaims } from './decode-jwt-claims';\nimport { DocsAuthClient } from './docs-auth-client';\nimport type { DocsAuthSession, DocsJwtClaims } from './docs-auth-session.schemas';\nimport { useDocsProviderSdks } from './use-docs-provider-sdks';\nimport {\n createFrontendTechdocProviderRegistry,\n type FrontendTechdocProviderRegistry,\n type GeneratedTechdocProviderModules,\n} from './frontend-provider-registry.techdoc';\n\n/*\n Result of a `beginExchange()` call surfaced to `<AuthExchangePage>`.\n \n `claims` — decoded `DocsJwtClaims` (or `null` if the access token\n * came back undecodable — treated as anonymous).\n * `returnPath` — the issuer-supplied `returnPath` from the token exchange\n * response (cross-app-jwt-propagation.md Step 5). It is\n * a TOP-LEVEL field on `TokenExchangeResponseSchema` —\n * NOT nested under `metadata`. The earlier draft of this\n * JSDoc said \"metadata.returnPath\" and the implementation\n * read `response.metadata?.returnPath` (always undefined,\n * because no such key exists on the response). H-3 in the\n * Step 5 second deep-review log fixes both the docstring\n * and the read site.\n * `null` for OAuth2-callback codes (which never carry a\n * `returnPath` at all — discriminator invariant pinned by\n * `TokenExchangeResponseSchema` JSDoc); the exchange page\n * falls back to the URL `?return=` parameter in that case\n * (defense-in-depth).\n /\nexport interface DocsBeginExchangeResult {\n readonly claims: DocsJwtClaims \| null;\n readonly returnPath: string \| null;\n}\n\n/\n Public surface of `useDocsAuthSession()`.\n \n `session` — discriminated union (anonymous / exchanging / authenticated).\n * `client` — the singleton `DocsAuthClient` for authenticated docs\n * runtime code that needs to request a handoff to another\n * frontend. Anonymous docs gates deep-link to the SaaS app\n * because handoff issuance requires a bearer.\n * `frontendProviderRegistry`\n * — hydrated registry of the frontend-safe provider entries\n * materialized for the active docs service. Browser-only\n * docs widgets (search, analytics, future SDK protocols)\n * read from this instead of importing generated artifacts.\n * `beginExchange` — called by `<AuthExchangePage>` when a `?code=` arrives.\n * Returns the decoded claims AND the issuer-supplied\n * top-level `returnPath` from the exchange response\n * (the SOURCE OF TRUTH for post-exchange navigation;\n * the URL `?return=` is a defense-in-depth fallback\n * only). NOT `response.metadata.returnPath` — the\n * response has no `metadata` envelope (H-3 fix).\n * `clear` — called when the user explicitly closes the docs\n * session (e.g. a \"Sign out of docs\" link). NOT called\n * on tab close — ephemeral state evaporates on its own.\n /\nexport interface DocsAuthContextValue {\n readonly session: DocsAuthSession;\n readonly client: DocsAuthClient;\n readonly frontendProviderRegistry: FrontendTechdocProviderRegistry;\n beginExchange(code: string): Promise<DocsBeginExchangeResult>;\n clear(): void;\n}\n\n/\n @internal — consumers should call `useDocsAuthSession()` instead of\n * touching this directly. Exported so the matching hook can `useContext`\n * it from a sibling module (Fast Refresh boundary).\n /\nexport const DocsAuthContext: Context<DocsAuthContextValue \| null> =\n createContext<DocsAuthContextValue \| null>(null);\n\n/\n In-memory React context owning the docs-site authenticated session\n * (saas-technical-doc.md K-9b).\n \n Storage characteristics — locked by K-9b:\n \n - In-memory only. NO `localStorage`, NO `sessionStorage`, NO cookies.\n * Closing the tab destroys the session.\n * - NO refresh-token loop. `/auth/token/exchange` no longer returns a\n * refresh token in the JSON body; SaaS-app receivers get refresh via the\n * HttpOnly cookie channel, while docs intentionally keeps only the access\n * token in memory. When the access token's `exp` passes, the next access\n * becomes anonymous and the user re-handshakes from the SaaS app on demand.\n * - NO BroadcastChannel cross-tab coordination. Each docs tab owns its\n * own session — opening a new tab is anonymous until it gets its own\n * `?code=` redirect.\n \n These choices are deliberate: the docs site is a session RECEIVER\n * (never a session OWNER), and the SaaS app is the authoritative source\n * of authentication. Replicating the SaaS app's session-management stack\n * here would force the docs Docusaurus bundle to ship inversify, the\n * resources framework, and a refresh interceptor — all of which are\n * about to be hardened (auth-hardening.md Slice A) in the SaaS app\n * specifically because they are sensitive surfaces. Keeping the docs\n * site free of those mechanisms keeps its attack surface tiny.\n \n The `apiBaseUrl` prop is supplied by the docs site at mount time\n * (typically read from a small `appConfig.json` shipped alongside the\n * Docusaurus bundle, or from an env var injected at build time). It is\n * not pulled from `saas-frontend-lib`'s `useApplication()` because that\n * would force this package to import the inversify-bound `appConfig`\n * provider — exactly the dependency we are avoiding.\n /\nexport const DocsAuthProvider: FC<{\n children: ReactNode;\n apiBaseUrl: string;\n /\n Optional materialized provider block for the active docs service.\n * When omitted, the docs runtime exposes an empty provider registry.\n /\n frontendProviders?: FrontendProvidersBlock;\n /\n The CODE channel for those providers (#332): the\n * `generatedFrontendProviderModules` export of this docs service's own\n * `src/generated/frontend-providers.generated.ts`, written by\n * `wildo config sync`.\n \n `frontendProviders` above says WHICH providers this service turned on, in\n * this environment; this says what code the bundle actually contains for\n * them. Both are needed, because a JSON payload cannot carry an SDK loader\n * and a bundle cannot know which environment it is running in.\n \n Omitted is the ordinary case for a docs site declaring no package-shipped\n * provider: no such file is generated, so there is nothing to import.\n /\n frontendProviderModules?: GeneratedTechdocProviderModules;\n /\n Runtime frontend service identity used for the `X-Frontend-Service-Name`\n * header on exchange/handoff auth calls.\n /\n frontendServiceName?: string \| null;\n /\n Optional override for tests. Production code constructs a\n * `DocsAuthClient` from `apiBaseUrl` + the in-memory bearer.\n /\n client?: DocsAuthClient;\n}> = ({\n children,\n apiBaseUrl,\n frontendProviders,\n frontendProviderModules,\n frontendServiceName = null,\n client: clientOverride,\n}) => {\n const [session, setSession] = useState<DocsAuthSession>({ status: 'anonymous' });\n\n /\n `getAuthBearer` reads from a closure over `session` so the bearer\n * always reflects the current state without re-creating the client\n * on every state change. The `useMemo` below depends only on\n * `apiBaseUrl` so the client identity is stable across re-renders,\n * which keeps `useEffect` dependency arrays in swizzles honest.\n /\n const sessionRef = useLatestRef(session);\n\n const client = useMemo<DocsAuthClient>(() => {\n if (clientOverride) return clientOverride;\n return new DocsAuthClient({\n apiBaseUrl,\n frontendServiceName,\n getAuthBearer: () =>\n sessionRef.current.status === 'authenticated'\n ? sessionRef.current.accessToken\n : null,\n });\n }, [apiBaseUrl, frontendServiceName, clientOverride, sessionRef]);\n const frontendProviderRegistry = useMemo(\n () =>\n createFrontendTechdocProviderRegistry({\n entries: frontendProviders,\n modules: frontendProviderModules,\n onDiagnostic: (diagnostic) => {\n // The docs runtime has no logger service, and a provider that is\n // declared but cannot fully run is a developer-facing fact that must\n // not be silent. Never a throw: a misconfigured provider must not take\n // the documentation site down.\n // eslint-disable-next-line no-console\n console.warn(`[wildo-provider] ${diagnostic.kind}: ${diagnostic.message}`);\n },\n }),\n [frontendProviders, frontendProviderModules],\n );\n\n // Load and start the SDK of every live provider that ships one. Effect-only:\n // Docusaurus server-renders every page at build time, and starting a vendor\n // client there would run it inside the build.\n useDocsProviderSdks(frontendProviderRegistry);\n\n /\n Auto-clear when the access token expires.\n \n Sets a single timer based on `claims.exp`; on tick, transitions the\n * session back to `anonymous`. No polling, no refresh — the next\n * gated action will trigger a re-handshake via `requestCrossFrontendHandoff`.\n \n The timer is recreated whenever the session transitions to\n * `authenticated`, and cleared on unmount or on transition AWAY from\n * `authenticated` to avoid stale timers firing into a fresh session.\n /\n useEffect(() => {\n if (session.status !== 'authenticated') return;\n const msUntilExpiry = session.claims.exp 1000 - Date.now();\n if (msUntilExpiry <= 0) {\n setSession({ status: 'anonymous' });\n return;\n }\n const handle = setTimeout(() => {\n setSession({ status: 'anonymous' });\n }, msUntilExpiry);\n return () => clearTimeout(handle);\n }, [session]);\n\n const beginExchange = useCallback(\n async (code: string): Promise<DocsBeginExchangeResult> => {\n setSession({ status: 'exchanging' });\n try {\n const response = await client.exchangeAuthCode(code);\n // `returnPath` lives at the TOP LEVEL of `TokenExchangeResponseSchema`\n // — NOT under `metadata`. Reading `response.metadata?.returnPath`\n // (the previous shape this code targeted) is silently `undefined`\n // because the schema has no `metadata` envelope. The previous\n // implementation made every docs handoff fall through to the URL\n // `?return=` value, defeating Step 5's \"response value is the\n // source of truth\" contract. See H-3 in the Step 5 second\n // deep-review log on `cross-app-jwt-propagation.md`.\n const returnPath = response.returnPath ?? null;\n const claims = decodeJwtClaims(response.accessToken);\n if (!claims) {\n /*\n The exchange succeeded but the returned token isn't decodable.\n * Treat as anonymous rather than half-authenticated — the\n * swizzles never have to handle a `claims === null &&\n * status === 'authenticated'` corner case. We still surface\n * `returnPath` so the exchange page can navigate the user\n * somewhere sensible (e.g. `/`) instead of stranding them on\n * `/auth/exchange`.\n /\n setSession({ status: 'anonymous' });\n return { claims: null, returnPath };\n }\n setSession({ status: 'authenticated', accessToken: response.accessToken, claims });\n return { claims, returnPath };\n } catch {\n setSession({ status: 'anonymous' });\n return { claims: null, returnPath: null };\n }\n },\n [client],\n );\n\n const clear = useCallback(() => {\n setSession({ status: 'anonymous' });\n }, []);\n\n const value = useMemo<DocsAuthContextValue>(\n () => ({ session, client, frontendProviderRegistry, beginExchange, clear }),\n [session, client, frontendProviderRegistry, beginExchange, clear],\n );\n\n return <DocsAuthContext.Provider value={value}>{children}</DocsAuthContext.Provider>;\n};\n\n/\n Tiny ref-of-latest-value helper. Avoids pulling in a utility lib for\n * one ~6-line function. Used here so the `DocsAuthClient`'s\n * `getAuthBearer` callback always sees the freshest session without\n * re-instantiating the client.\n \n Implementation discipline (L-NEW-1 fix from the Step 6 third\n * deep-review log): the previous implementation mutated `ref.current`\n * DURING render (the `ref.current = value;` line ran in the function\n * body), which violates React's \"no side effects during render\"\n * invariant and produces inconsistent reads under concurrent\n * rendering — a render that gets discarded by React's scheduler can\n * still leave a stale `ref.current` behind for the next render.\n \n The fix is the textbook React 18 pattern: hold the value in a real\n * `useRef`, then sync it inside `useEffect` after commit.\n \n Trade-off acknowledged: between render and effect-flush,\n * `ref.current` lags by one render. That is SAFE for this consumer\n * because `getAuthBearer()` is only invoked ASYNCHRONOUSLY (inside a\n * `fetch()` call originated by `requestCrossFrontendHandoff()` /\n * `exchangeAuthCode()`) — by the time the bearer is read, every\n * `useEffect` from the triggering render has already flushed and\n * `ref.current` reflects the latest committed session.\n \n Concretely: if the user clicks an org-API navbar entry that promotes\n * the session from `anonymous` → `exchanging` → `authenticated`, the\n * next fetch the client issues sees `authenticated` (ref synced after\n * commit) — never the stale `exchanging` value, even though the\n * `useMemo` factory may have captured the closure at the earlier\n * render.\n */\nfunction useLatestRef<T>(value: T): { current: T } {\n const ref = useRef<T>(value);\n useEffect(() => {\n ref.current = value;\n });\n return ref;\n}\n"]}
1	+ {"version":3,"file":"DocsAuthContext.js","sourceRoot":"","sources":["../../../../src/runtime/DocsAuthContext.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EACL,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,OAAO,EACP,MAAM,EACN,QAAQ,GAIT,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EACL,qCAAqC,GAGtC,MAAM,sCAAsC,CAAC;AA2D9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,aAAa,CAA8B,IAAI,CAAC,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAiCxB,CAAC,EACJ,QAAQ,EACR,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GAAG,IAAI,EAC1B,MAAM,EAAE,cAAc,GACvB,EAAE,EAAE;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAkB,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAEjF;;;;;;OAMG;IACH,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAG,OAAO,CAAiB,GAAG,EAAE;QAC1C,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,OAAO,IAAI,cAAc,CAAC;YACxB,UAAU;YACV,mBAAmB;YACnB,aAAa,EAAE,GAAG,EAAE,CAClB,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe;gBAC3C,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW;gBAChC,CAAC,CAAC,IAAI;SACX,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,UAAU,EAAE,mBAAmB,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;IAClE,MAAM,yBAAyB,GAAG,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAC3E,MAAM,wBAAwB,GAAG,OAAO,CACtC,GAAG,EAAE,CACH,yBAAyB,IAAI,qCAAqC,CAAC;QACjE,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,uBAAuB;QAChC,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE;YAC3B,iEAAiE;YACjE,qEAAqE;YACrE,uEAAuE;YACvE,+BAA+B;YAC/B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,oBAAoB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC,EACJ,CAAC,yBAAyB,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CACxE,CAAC;IAEF,6EAA6E;IAC7E,4EAA4E;IAC5E,8CAA8C;IAC9C,mBAAmB,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,sBAAsB,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEvG;;;;;;;;;;OAUG;IACH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO;QAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7D,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACtC,CAAC,EAAE,aAAa,CAAC,CAAC;QAClB,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,MAAM,aAAa,GAAG,WAAW,CAC/B,KAAK,EAAE,IAAY,EAAoC,EAAE;QACvD,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACrD,uEAAuE;YACvE,kEAAkE;YAClE,kEAAkE;YAClE,8DAA8D;YAC9D,iEAAiE;YACjE,8DAA8D;YAC9D,0DAA0D;YAC1D,qDAAqD;YACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC;YAC/C,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ;;;;;;;;mBAQG;gBACH,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YACtC,CAAC;YACD,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACtC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAC3E,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,aAAa,EAAE,KAAK,CAAC,CAClE,CAAC;IAEF,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAC;AACvF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAS,YAAY,CAAI,KAAQ;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAI,KAAK,CAAC,CAAC;IAC7B,SAAS,CAAC,GAAG,EAAE;QACb,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import { DocsFrontendProvidersContext } from './DocsFrontendProviders';\nimport {\n createContext,\n useCallback,\n useContext,\n useEffect,\n useMemo,\n useRef,\n useState,\n type Context,\n type FC,\n type ReactNode,\n} from 'react';\nimport type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';\nimport { decodeJwtClaims } from './decode-jwt-claims';\nimport { DocsAuthClient } from './docs-auth-client';\nimport type { DocsAuthSession, DocsJwtClaims } from './docs-auth-session.schemas';\nimport { useDocsProviderSdks } from './use-docs-provider-sdks';\nimport { useDocsProviderScripts } from './use-docs-provider-scripts';\nimport {\n createFrontendTechdocProviderRegistry,\n type FrontendTechdocProviderRegistry,\n type GeneratedTechdocProviderModules,\n} from './frontend-provider-registry.techdoc';\n\n/*\n Result of a `beginExchange()` call surfaced to `<AuthExchangePage>`.\n \n `claims` — decoded `DocsJwtClaims` (or `null` if the access token\n * came back undecodable — treated as anonymous).\n * `returnPath` — the issuer-supplied `returnPath` from the token exchange\n * response (cross-app-jwt-propagation.md Step 5). It is\n * a TOP-LEVEL field on `TokenExchangeResponseSchema` —\n * NOT nested under `metadata`. The earlier draft of this\n * JSDoc said \"metadata.returnPath\" and the implementation\n * read `response.metadata?.returnPath` (always undefined,\n * because no such key exists on the response). H-3 in the\n * Step 5 second deep-review log fixes both the docstring\n * and the read site.\n * `null` for OAuth2-callback codes (which never carry a\n * `returnPath` at all — discriminator invariant pinned by\n * `TokenExchangeResponseSchema` JSDoc); the exchange page\n * falls back to the URL `?return=` parameter in that case\n * (defense-in-depth).\n /\nexport interface DocsBeginExchangeResult {\n readonly claims: DocsJwtClaims \| null;\n readonly returnPath: string \| null;\n}\n\n/\n Public surface of `useDocsAuthSession()`.\n \n `session` — discriminated union (anonymous / exchanging / authenticated).\n * `client` — the singleton `DocsAuthClient` for authenticated docs\n * runtime code that needs to request a handoff to another\n * frontend. Anonymous docs gates deep-link to the SaaS app\n * because handoff issuance requires a bearer.\n * `frontendProviderRegistry`\n * — hydrated registry of the frontend-safe provider entries\n * materialized for the active docs service. Browser-only\n * docs widgets (search, analytics, future SDK protocols)\n * read from this instead of importing generated artifacts.\n * `beginExchange` — called by `<AuthExchangePage>` when a `?code=` arrives.\n * Returns the decoded claims AND the issuer-supplied\n * top-level `returnPath` from the exchange response\n * (the SOURCE OF TRUTH for post-exchange navigation;\n * the URL `?return=` is a defense-in-depth fallback\n * only). NOT `response.metadata.returnPath` — the\n * response has no `metadata` envelope (H-3 fix).\n * `clear` — called when the user explicitly closes the docs\n * session (e.g. a \"Sign out of docs\" link). NOT called\n * on tab close — ephemeral state evaporates on its own.\n /\nexport interface DocsAuthContextValue {\n readonly session: DocsAuthSession;\n readonly client: DocsAuthClient;\n readonly frontendProviderRegistry: FrontendTechdocProviderRegistry;\n beginExchange(code: string): Promise<DocsBeginExchangeResult>;\n clear(): void;\n}\n\n/\n @internal — consumers should call `useDocsAuthSession()` instead of\n * touching this directly. Exported so the matching hook can `useContext`\n * it from a sibling module (Fast Refresh boundary).\n /\nexport const DocsAuthContext: Context<DocsAuthContextValue \| null> =\n createContext<DocsAuthContextValue \| null>(null);\n\n/\n In-memory React context owning the docs-site authenticated session\n * (saas-technical-doc.md K-9b).\n \n Storage characteristics — locked by K-9b:\n \n - In-memory only. NO `localStorage`, NO `sessionStorage`, NO cookies.\n * Closing the tab destroys the session.\n * - NO refresh-token loop. `/auth/token/exchange` no longer returns a\n * refresh token in the JSON body; SaaS-app receivers get refresh via the\n * HttpOnly cookie channel, while docs intentionally keeps only the access\n * token in memory. When the access token's `exp` passes, the next access\n * becomes anonymous and the user re-handshakes from the SaaS app on demand.\n * - NO BroadcastChannel cross-tab coordination. Each docs tab owns its\n * own session — opening a new tab is anonymous until it gets its own\n * `?code=` redirect.\n \n These choices are deliberate: the docs site is a session RECEIVER\n * (never a session OWNER), and the SaaS app is the authoritative source\n * of authentication. Replicating the SaaS app's session-management stack\n * here would force the docs Docusaurus bundle to ship inversify, the\n * resources framework, and a refresh interceptor — all of which are\n * about to be hardened (auth-hardening.md Slice A) in the SaaS app\n * specifically because they are sensitive surfaces. Keeping the docs\n * site free of those mechanisms keeps its attack surface tiny.\n \n The `apiBaseUrl` prop is supplied by the docs site at mount time\n * (typically read from a small `appConfig.json` shipped alongside the\n * Docusaurus bundle, or from an env var injected at build time). It is\n * not pulled from `saas-frontend-lib`'s `useApplication()` because that\n * would force this package to import the inversify-bound `appConfig`\n * provider — exactly the dependency we are avoiding.\n /\nexport const DocsAuthProvider: FC<{\n children: ReactNode;\n apiBaseUrl: string;\n /\n Optional materialized provider block for the active docs service.\n * When omitted, the docs runtime exposes an empty provider registry.\n /\n frontendProviders?: FrontendProvidersBlock;\n /\n The CODE channel for those providers (#332): the\n * `generatedFrontendProviderModules` export of this docs service's own\n * `src/generated/frontend-providers.generated.ts`, written by\n * `wildo config sync`.\n \n `frontendProviders` above says WHICH providers this service turned on, in\n * this environment; this says what code the bundle actually contains for\n * them. Both are needed, because a JSON payload cannot carry an SDK loader\n * and a bundle cannot know which environment it is running in.\n \n Config sync emits a stable map, including an empty map for a service without providers.\n * When DocsFrontendProviders wraps this component, that outer owner supplies the registry.\n /\n frontendProviderModules?: GeneratedTechdocProviderModules;\n /\n Runtime frontend service identity used for the `X-Frontend-Service-Name`\n * header on exchange/handoff auth calls.\n /\n frontendServiceName?: string \| null;\n /\n Optional override for tests. Production code constructs a\n * `DocsAuthClient` from `apiBaseUrl` + the in-memory bearer.\n /\n client?: DocsAuthClient;\n}> = ({\n children,\n apiBaseUrl,\n frontendProviders,\n frontendProviderModules,\n frontendServiceName = null,\n client: clientOverride,\n}) => {\n const [session, setSession] = useState<DocsAuthSession>({ status: 'anonymous' });\n\n /\n `getAuthBearer` reads from a closure over `session` so the bearer\n * always reflects the current state without re-creating the client\n * on every state change. The `useMemo` below depends only on\n * `apiBaseUrl` so the client identity is stable across re-renders,\n * which keeps `useEffect` dependency arrays in swizzles honest.\n /\n const sessionRef = useLatestRef(session);\n\n const client = useMemo<DocsAuthClient>(() => {\n if (clientOverride) return clientOverride;\n return new DocsAuthClient({\n apiBaseUrl,\n frontendServiceName,\n getAuthBearer: () =>\n sessionRef.current.status === 'authenticated'\n ? sessionRef.current.accessToken\n : null,\n });\n }, [apiBaseUrl, frontendServiceName, clientOverride, sessionRef]);\n const inheritedProviderRegistry = useContext(DocsFrontendProvidersContext);\n const frontendProviderRegistry = useMemo(\n () =>\n inheritedProviderRegistry ?? createFrontendTechdocProviderRegistry({\n entries: frontendProviders,\n modules: frontendProviderModules,\n onDiagnostic: (diagnostic) => {\n // The docs runtime has no logger service, and a provider that is\n // declared but cannot fully run is a developer-facing fact that must\n // not be silent. Never a throw: a misconfigured provider must not take\n // the documentation site down.\n // eslint-disable-next-line no-console\n console.warn(`[wildo-provider] ${diagnostic.kind}: ${diagnostic.message}`);\n },\n }),\n [inheritedProviderRegistry, frontendProviders, frontendProviderModules],\n );\n\n // Load and start the SDK of every live provider that ships one. Effect-only:\n // Docusaurus server-renders every page at build time, and starting a vendor\n // client there would run it inside the build.\n useDocsProviderSdks(inheritedProviderRegistry === undefined ? frontendProviderRegistry : undefined);\n useDocsProviderScripts(inheritedProviderRegistry === undefined ? frontendProviderRegistry : undefined);\n\n /\n Auto-clear when the access token expires.\n \n Sets a single timer based on `claims.exp`; on tick, transitions the\n * session back to `anonymous`. No polling, no refresh — the next\n * gated action will trigger a re-handshake via `requestCrossFrontendHandoff`.\n \n The timer is recreated whenever the session transitions to\n * `authenticated`, and cleared on unmount or on transition AWAY from\n * `authenticated` to avoid stale timers firing into a fresh session.\n /\n useEffect(() => {\n if (session.status !== 'authenticated') return;\n const msUntilExpiry = session.claims.exp 1000 - Date.now();\n if (msUntilExpiry <= 0) {\n setSession({ status: 'anonymous' });\n return;\n }\n const handle = setTimeout(() => {\n setSession({ status: 'anonymous' });\n }, msUntilExpiry);\n return () => clearTimeout(handle);\n }, [session]);\n\n const beginExchange = useCallback(\n async (code: string): Promise<DocsBeginExchangeResult> => {\n setSession({ status: 'exchanging' });\n try {\n const response = await client.exchangeAuthCode(code);\n // `returnPath` lives at the TOP LEVEL of `TokenExchangeResponseSchema`\n // — NOT under `metadata`. Reading `response.metadata?.returnPath`\n // (the previous shape this code targeted) is silently `undefined`\n // because the schema has no `metadata` envelope. The previous\n // implementation made every docs handoff fall through to the URL\n // `?return=` value, defeating Step 5's \"response value is the\n // source of truth\" contract. See H-3 in the Step 5 second\n // deep-review log on `cross-app-jwt-propagation.md`.\n const returnPath = response.returnPath ?? null;\n const claims = decodeJwtClaims(response.accessToken);\n if (!claims) {\n /*\n The exchange succeeded but the returned token isn't decodable.\n * Treat as anonymous rather than half-authenticated — the\n * swizzles never have to handle a `claims === null &&\n * status === 'authenticated'` corner case. We still surface\n * `returnPath` so the exchange page can navigate the user\n * somewhere sensible (e.g. `/`) instead of stranding them on\n * `/auth/exchange`.\n /\n setSession({ status: 'anonymous' });\n return { claims: null, returnPath };\n }\n setSession({ status: 'authenticated', accessToken: response.accessToken, claims });\n return { claims, returnPath };\n } catch {\n setSession({ status: 'anonymous' });\n return { claims: null, returnPath: null };\n }\n },\n [client],\n );\n\n const clear = useCallback(() => {\n setSession({ status: 'anonymous' });\n }, []);\n\n const value = useMemo<DocsAuthContextValue>(\n () => ({ session, client, frontendProviderRegistry, beginExchange, clear }),\n [session, client, frontendProviderRegistry, beginExchange, clear],\n );\n\n return <DocsAuthContext.Provider value={value}>{children}</DocsAuthContext.Provider>;\n};\n\n/\n Tiny ref-of-latest-value helper. Avoids pulling in a utility lib for\n * one ~6-line function. Used here so the `DocsAuthClient`'s\n * `getAuthBearer` callback always sees the freshest session without\n * re-instantiating the client.\n \n Implementation discipline (L-NEW-1 fix from the Step 6 third\n * deep-review log): the previous implementation mutated `ref.current`\n * DURING render (the `ref.current = value;` line ran in the function\n * body), which violates React's \"no side effects during render\"\n * invariant and produces inconsistent reads under concurrent\n * rendering — a render that gets discarded by React's scheduler can\n * still leave a stale `ref.current` behind for the next render.\n \n The fix is the textbook React 18 pattern: hold the value in a real\n * `useRef`, then sync it inside `useEffect` after commit.\n \n Trade-off acknowledged: between render and effect-flush,\n * `ref.current` lags by one render. That is SAFE for this consumer\n * because `getAuthBearer()` is only invoked ASYNCHRONOUSLY (inside a\n * `fetch()` call originated by `requestCrossFrontendHandoff()` /\n * `exchangeAuthCode()`) — by the time the bearer is read, every\n * `useEffect` from the triggering render has already flushed and\n * `ref.current` reflects the latest committed session.\n \n Concretely: if the user clicks an org-API navbar entry that promotes\n * the session from `anonymous` → `exchanging` → `authenticated`, the\n * next fetch the client issues sees `authenticated` (ref synced after\n * commit) — never the stale `exchanging` value, even though the\n * `useMemo` factory may have captured the closure at the earlier\n * render.\n */\nfunction useLatestRef<T>(value: T): { current: T } {\n const ref = useRef<T>(value);\n useEffect(() => {\n ref.current = value;\n });\n return ref;\n}\n"]}

package/dist/esm/runtime/DocsFrontendProviders.d.ts ADDED Viewed

@@ -0,0 +1,30 @@
+import { type ReactNode } from 'react';
+import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';
+import { type FrontendTechdocProviderRegistry, type GeneratedTechdocProviderModules } from './frontend-provider-registry.techdoc';
+import type { ProviderComponentLoaderContribution } from '@wildo-ai/external-connectors-public/techdoc';
+import { type DocsProviderComponentRegistry } from './provider-component-registry.techdoc';
+/** Provider execution belongs to the public documentation surface, independently of reader authentication. */
+export declare const DocsFrontendProvidersContext: import("react").Context<FrontendTechdocProviderRegistry>;
+/**
+ * The components the live docs providers contribute (#1703), built once per registry by
+ * `DocsFrontendProviders` and read by `useDocsProviderComponent`. Absent outside it — an
+ * auth-provider-only mount offers no provider components.
+ */
+export declare const DocsProviderComponentsContext: import("react").Context<DocsProviderComponentRegistry>;
+/**
+ * Join build-time DATA with browser CODE without constructing an authentication client.
+ * The Root swizzle mounts this outside its optional DocsAuthProvider. SDKs activate only in an
+ * effect and stop on unmount, including on standalone documentation sites with no application API.
+ */
+export declare function DocsFrontendProviders({ children, frontendProviders, frontendProviderModules, providerComponentLoaders, }: {
+    children: ReactNode;
+    frontendProviders?: FrontendProvidersBlock;
+    frontendProviderModules?: GeneratedTechdocProviderModules;
+    /**
+     * Loaders for provider components an ENGINE provider module declares but cannot import (#1703) —
+     * the documentation site's facet-library door. A provider package that ships its own component needs
+     * nothing here. Pass a module-level constant: a new array each render rebuilds the component registry.
+     */
+    providerComponentLoaders?: ReadonlyArray<ProviderComponentLoaderContribution>;
+}): ReactNode;
+//# sourceMappingURL=DocsFrontendProviders.d.ts.map

package/dist/esm/runtime/DocsFrontendProviders.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"DocsFrontendProviders.d.ts","sourceRoot":"","sources":["../../../../src/runtime/DocsFrontendProviders.tsx"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,8CAA8C,CAAC;AACxG,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,uCAAuC,CAAC;AAI/C,8GAA8G;AAC9G,eAAO,MAAM,4BAA4B,0DAAwE,CAAC;AAElH;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,wDAAsE,CAAC;AAEjH;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,QAAQ,EACR,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,GACzB,EAAE;IACD,QAAQ,EAAE,SAAS,CAAC;IACpB,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,uBAAuB,CAAC,EAAE,+BAA+B,CAAC;IAC1D;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,aAAa,CAAC,mCAAmC,CAAC,CAAC;CAC/E,GAAG,SAAS,CA4BZ"}

package/dist/esm/runtime/DocsFrontendProviders.js ADDED Viewed

@@ -0,0 +1,39 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useMemo } from 'react';
+import { createFrontendTechdocProviderRegistry, } from './frontend-provider-registry.techdoc.js';
+import { createDocsProviderComponentRegistry, } from './provider-component-registry.techdoc.js';
+import { useDocsProviderSdks } from './use-docs-provider-sdks.js';
+import { useDocsProviderScripts } from './use-docs-provider-scripts.js';
+/** Provider execution belongs to the public documentation surface, independently of reader authentication. */
+export const DocsFrontendProvidersContext = createContext(undefined);
+/**
+ * The components the live docs providers contribute (#1703), built once per registry by
+ * `DocsFrontendProviders` and read by `useDocsProviderComponent`. Absent outside it — an
+ * auth-provider-only mount offers no provider components.
+ */
+export const DocsProviderComponentsContext = createContext(undefined);
+/**
+ * Join build-time DATA with browser CODE without constructing an authentication client.
+ * The Root swizzle mounts this outside its optional DocsAuthProvider. SDKs activate only in an
+ * effect and stop on unmount, including on standalone documentation sites with no application API.
+ */
+export function DocsFrontendProviders({ children, frontendProviders, frontendProviderModules, providerComponentLoaders, }) {
+    const registry = useMemo(() => createFrontendTechdocProviderRegistry({
+        entries: frontendProviders,
+        modules: frontendProviderModules,
+        onDiagnostic: (diagnostic) => {
+            // eslint-disable-next-line no-console
+            console.warn(`[wildo-provider] ${diagnostic.kind}: ${diagnostic.message}`);
+        },
+    }), [frontendProviders, frontendProviderModules]);
+    // Memoised with the provider registry: the component registry caches what it loaded, and a new one
+    // per render would re-run every slot's load effect.
+    const componentRegistry = useMemo(() => createDocsProviderComponentRegistry({
+        providerRegistry: registry,
+        ...(providerComponentLoaders !== undefined ? { providerComponentLoaders } : {}),
+    }), [registry, providerComponentLoaders]);
+    useDocsProviderSdks(registry);
+    useDocsProviderScripts(registry, componentRegistry);
+    return (_jsx(DocsFrontendProvidersContext.Provider, { value: registry, children: _jsx(DocsProviderComponentsContext.Provider, { value: componentRegistry, children: children }) }));
+}
+//# sourceMappingURL=DocsFrontendProviders.js.map

package/dist/esm/runtime/DocsFrontendProviders.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"DocsFrontendProviders.js","sourceRoot":"","sources":["../../../../src/runtime/DocsFrontendProviders.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,aAAa,EAAE,OAAO,EAAkB,MAAM,OAAO,CAAC;AAE/D,OAAO,EACL,qCAAqC,GAGtC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,mCAAmC,GAEpC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,8GAA8G;AAC9G,MAAM,CAAC,MAAM,4BAA4B,GAAG,aAAa,CAA8C,SAAS,CAAC,CAAC;AAElH;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAA4C,SAAS,CAAC,CAAC;AAEjH;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EACR,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,GAWzB;IACC,MAAM,QAAQ,GAAG,OAAO,CACtB,GAAG,EAAE,CAAC,qCAAqC,CAAC;QAC1C,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,uBAAuB;QAChC,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE;YAC3B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,oBAAoB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC,EACF,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAC7C,CAAC;IACF,mGAAmG;IACnG,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,OAAO,CAC/B,GAAG,EAAE,CAAC,mCAAmC,CAAC;QACxC,gBAAgB,EAAE,QAAQ;QAC1B,GAAG,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,EACF,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CACrC,CAAC;IACF,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACpD,OAAO,CACL,KAAC,4BAA4B,CAAC,QAAQ,IAAC,KAAK,EAAE,QAAQ,YACpD,KAAC,6BAA6B,CAAC,QAAQ,IAAC,KAAK,EAAE,iBAAiB,YAAG,QAAQ,GAA0C,GAC/E,CACzC,CAAC;AACJ,CAAC","sourcesContent":["import { createContext, useMemo, type ReactNode } from 'react';\nimport type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';\nimport {\n createFrontendTechdocProviderRegistry,\n type FrontendTechdocProviderRegistry,\n type GeneratedTechdocProviderModules,\n} from './frontend-provider-registry.techdoc';\nimport type { ProviderComponentLoaderContribution } from '@wildo-ai/external-connectors-public/techdoc';\nimport {\n createDocsProviderComponentRegistry,\n type DocsProviderComponentRegistry,\n} from './provider-component-registry.techdoc';\nimport { useDocsProviderSdks } from './use-docs-provider-sdks';\nimport { useDocsProviderScripts } from './use-docs-provider-scripts';\n\n/** Provider execution belongs to the public documentation surface, independently of reader authentication. */\nexport const DocsFrontendProvidersContext = createContext<FrontendTechdocProviderRegistry | undefined>(undefined);\n\n/**\n * The components the live docs providers contribute (#1703), built once per registry by\n * `DocsFrontendProviders` and read by `useDocsProviderComponent`. Absent outside it — an\n * auth-provider-only mount offers no provider components.\n */\nexport const DocsProviderComponentsContext = createContext<DocsProviderComponentRegistry | undefined>(undefined);\n\n/**\n * Join build-time DATA with browser CODE without constructing an authentication client.\n * The Root swizzle mounts this outside its optional DocsAuthProvider. SDKs activate only in an\n * effect and stop on unmount, including on standalone documentation sites with no application API.\n */\nexport function DocsFrontendProviders({\n children,\n frontendProviders,\n frontendProviderModules,\n providerComponentLoaders,\n}: {\n children: ReactNode;\n frontendProviders?: FrontendProvidersBlock;\n frontendProviderModules?: GeneratedTechdocProviderModules;\n /**\n * Loaders for provider components an ENGINE provider module declares but cannot import (#1703) —\n * the documentation site's facet-library door. A provider package that ships its own component needs\n * nothing here. Pass a module-level constant: a new array each render rebuilds the component registry.\n */\n providerComponentLoaders?: ReadonlyArray<ProviderComponentLoaderContribution>;\n}): ReactNode {\n const registry = useMemo(\n () => createFrontendTechdocProviderRegistry({\n entries: frontendProviders,\n modules: frontendProviderModules,\n onDiagnostic: (diagnostic) => {\n // eslint-disable-next-line no-console\n console.warn(`[wildo-provider] ${diagnostic.kind}: ${diagnostic.message}`);\n },\n }),\n [frontendProviders, frontendProviderModules],\n );\n // Memoised with the provider registry: the component registry caches what it loaded, and a new one\n // per render would re-run every slot's load effect.\n const componentRegistry = useMemo(\n () => createDocsProviderComponentRegistry({\n providerRegistry: registry,\n ...(providerComponentLoaders !== undefined ? { providerComponentLoaders } : {}),\n }),\n [registry, providerComponentLoaders],\n );\n useDocsProviderSdks(registry);\n useDocsProviderScripts(registry, componentRegistry);\n return (\n <DocsFrontendProvidersContext.Provider value={registry}>\n <DocsProviderComponentsContext.Provider value={componentRegistry}>{children}</DocsProviderComponentsContext.Provider>\n </DocsFrontendProvidersContext.Provider>\n );\n}\n"]}

package/dist/esm/runtime/DocsProviderComponent.d.ts ADDED Viewed

@@ -0,0 +1,41 @@
+import { type ReactNode } from 'react';
+import type { ProviderCapability } from '@wildo-ai/saas-models/public-runtime';
+/**
+ * @wildo_source:part:start engine.saas-technical-doc.provider-component.slot facet:layer:runtime facet:family:technical-doc
+ *
+ * `<DocsProviderComponent>` — places ONE provider's component on a documentation page (#1703), from
+ * the provider's own `components[capability]` declaration, the same one the application and the website
+ * read. Mount it inside `DocsFrontendProviders`.
+ *
+ * - **Nothing of the vendor reaches the prerendered HTML.** Docusaurus renders every page at build time;
+ *   the component loads from an effect, which never runs there, and the registry refuses to load where
+ *   there is no browser document. The build renders only the reserved box — this is the effect-based
+ *   equivalent of a `<BrowserOnly>` boundary, with the box kept so the page does not shift.
+ * - **No layout shift.** `reservedMinHeight` applies to the box in every state.
+ * - **Consent: nobody is asked here, so a provider resting on a consent purpose never loads** on the
+ *   documentation site, and the box renders `consentRequired`; a component that fails to load renders
+ *   `unavailable`. Both REQUIRED, so a page cannot place a component and ship a silent blank where it
+ *   would have been.
+ * - **The words are the site's.** The documentation runtime has no label pack of its own, so every state
+ *   a reader sees is passed in — write them with Docusaurus `<Translate>` so they are translated with
+ *   the rest of the site. The box holds a `role="status"` live region from the first render, filled
+ *   when a refusal or failure appears, so a screen reader announces it.
+ * - **The vendor's scripts load with the component**, not on every documentation page.
+ */
+export interface DocsProviderComponentProps<TProps extends object> {
+    /** The capability the component fills. */
+    capability: ProviderCapability;
+    /** The provider the page chose, or `undefined` while nothing is chosen. */
+    providerRef: string | undefined;
+    /** The props the loaded component receives — the capability's slot contract. */
+    componentProps: TProps;
+    /** Rendered when the provider rests on a consent purpose, which the documentation site never grants. */
+    consentRequired: ReactNode;
+    /** Rendered when the component could not be loaded. Required for the same reason: a failure must say so. */
+    unavailable: ReactNode;
+    /** CSS length reserved for the box in every state, so the page does not shift when the component loads. */
+    reservedMinHeight?: string;
+}
+export declare function DocsProviderComponent<TProps extends object>({ capability, providerRef, componentProps, consentRequired, unavailable, reservedMinHeight, }: DocsProviderComponentProps<TProps>): ReactNode;
+/** @wildo_source:part:end engine.saas-technical-doc.provider-component.slot */
+//# sourceMappingURL=DocsProviderComponent.d.ts.map

package/dist/esm/runtime/DocsProviderComponent.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"DocsProviderComponent.d.ts","sourceRoot":"","sources":["../../../../src/runtime/DocsProviderComponent.tsx"],"names":[],"mappings":"AAAA,OAAc,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAE9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAI/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,0BAA0B,CAAC,MAAM,SAAS,MAAM;IAC/D,0CAA0C;IAC1C,UAAU,EAAE,kBAAkB,CAAC;IAC/B,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wGAAwG;IACxG,eAAe,EAAE,SAAS,CAAC;IAC3B,4GAA4G;IAC5G,WAAW,EAAE,SAAS,CAAC;IACvB,2GAA2G;IAC3G,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,SAAS,MAAM,EAAE,EAC3D,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,WAAW,EACX,iBAAiB,GAClB,EAAE,0BAA0B,CAAC,MAAM,CAAC,GAAG,SAAS,CA4BhD;AACD,+EAA+E"}

package/dist/esm/runtime/DocsProviderComponent.js ADDED Viewed

@@ -0,0 +1,17 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { ProviderComponentStatus } from '@wildo-ai/external-connectors-public/techdoc';
+import { useDocsProviderComponent } from './use-docs-provider-component.js';
+export function DocsProviderComponent({ capability, providerRef, componentProps, consentRequired, unavailable, reservedMinHeight, }) {
+    const { status, Component } = useDocsProviderComponent(capability, providerRef);
+    // The registry cannot know a capability's props; the page states them through `componentProps`.
+    const Loaded = status === ProviderComponentStatus.READY && Component !== null
+        ? Component
+        : null;
+    // The live region is present from the first render and FILLED when a refusal appears, so a screen
+    // reader announces it; a region inserted already filled is often not announced at all.
+    const content = Loaded !== null
+        ? _jsx(Loaded, { ...componentProps })
+        : (_jsxs("div", { role: "status", children: [status === ProviderComponentStatus.CONSENT_REQUIRED ? consentRequired : null, status === ProviderComponentStatus.UNAVAILABLE ? unavailable : null] }));
+    return (_jsx("div", { "data-docs-provider-component": capability, "data-docs-provider-component-state": status, "aria-busy": status === ProviderComponentStatus.LOADING ? true : undefined, style: reservedMinHeight !== undefined ? { minHeight: reservedMinHeight } : undefined, children: content }));
+}
+//# sourceMappingURL=DocsProviderComponent.js.map

package/dist/esm/runtime/DocsProviderComponent.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"DocsProviderComponent.js","sourceRoot":"","sources":["../../../../src/runtime/DocsProviderComponent.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAGvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAuCzE,MAAM,UAAU,qBAAqB,CAAwB,EAC3D,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,WAAW,EACX,iBAAiB,GACkB;IACnC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,wBAAwB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEhF,gGAAgG;IAChG,MAAM,MAAM,GAAG,MAAM,KAAK,uBAAuB,CAAC,KAAK,IAAI,SAAS,KAAK,IAAI;QAC3E,CAAC,CAAE,SAAoD;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,kGAAkG;IAClG,uFAAuF;IACvF,MAAM,OAAO,GAAc,MAAM,KAAK,IAAI;QACxC,CAAC,CAAC,KAAC,MAAM,OAAK,cAAc,GAAI;QAChC,CAAC,CAAC,CACA,eAAK,IAAI,EAAC,QAAQ,aACf,MAAM,KAAK,uBAAuB,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAC5E,MAAM,KAAK,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAChE,CACP,CAAC;IAEJ,OAAO,CACL,8CACgC,UAAU,wCACJ,MAAM,eAC/B,MAAM,KAAK,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACxE,KAAK,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,YAEpF,OAAO,GACJ,CACP,CAAC;AACJ,CAAC","sourcesContent":["import React, { type ReactNode } from 'react';\nimport { ProviderComponentStatus } from '@wildo-ai/external-connectors-public/techdoc';\nimport type { ProviderCapability } from '@wildo-ai/saas-models/public-runtime';\n\nimport { useDocsProviderComponent } from './use-docs-provider-component';\n\n/**\n * @wildo_source:part:start engine.saas-technical-doc.provider-component.slot facet:layer:runtime facet:family:technical-doc\n *\n * `<DocsProviderComponent>` — places ONE provider's component on a documentation page (#1703), from\n * the provider's own `components[capability]` declaration, the same one the application and the website\n * read. Mount it inside `DocsFrontendProviders`.\n *\n * - **Nothing of the vendor reaches the prerendered HTML.** Docusaurus renders every page at build time;\n * the component loads from an effect, which never runs there, and the registry refuses to load where\n * there is no browser document. The build renders only the reserved box — this is the effect-based\n * equivalent of a `<BrowserOnly>` boundary, with the box kept so the page does not shift.\n * - **No layout shift.** `reservedMinHeight` applies to the box in every state.\n * - **Consent: nobody is asked here, so a provider resting on a consent purpose never loads** on the\n * documentation site, and the box renders `consentRequired`; a component that fails to load renders\n * `unavailable`. Both REQUIRED, so a page cannot place a component and ship a silent blank where it\n * would have been.\n * - **The words are the site's.** The documentation runtime has no label pack of its own, so every state\n * a reader sees is passed in — write them with Docusaurus `<Translate>` so they are translated with\n * the rest of the site. The box holds a `role=\"status\"` live region from the first render, filled\n * when a refusal or failure appears, so a screen reader announces it.\n * - **The vendor's scripts load with the component**, not on every documentation page.\n */\nexport interface DocsProviderComponentProps<TProps extends object> {\n /** The capability the component fills. */\n capability: ProviderCapability;\n /** The provider the page chose, or `undefined` while nothing is chosen. */\n providerRef: string | undefined;\n /** The props the loaded component receives — the capability's slot contract. */\n componentProps: TProps;\n /** Rendered when the provider rests on a consent purpose, which the documentation site never grants. */\n consentRequired: ReactNode;\n /** Rendered when the component could not be loaded. Required for the same reason: a failure must say so. */\n unavailable: ReactNode;\n /** CSS length reserved for the box in every state, so the page does not shift when the component loads. */\n reservedMinHeight?: string;\n}\n\nexport function DocsProviderComponent<TProps extends object>({\n capability,\n providerRef,\n componentProps,\n consentRequired,\n unavailable,\n reservedMinHeight,\n}: DocsProviderComponentProps<TProps>): ReactNode {\n const { status, Component } = useDocsProviderComponent(capability, providerRef);\n\n // The registry cannot know a capability's props; the page states them through `componentProps`.\n const Loaded = status === ProviderComponentStatus.READY && Component !== null\n ? (Component as unknown as React.ComponentType<TProps>)\n : null;\n // The live region is present from the first render and FILLED when a refusal appears, so a screen\n // reader announces it; a region inserted already filled is often not announced at all.\n const content: ReactNode = Loaded !== null\n ? <Loaded {...componentProps} />\n : (\n <div role=\"status\">\n {status === ProviderComponentStatus.CONSENT_REQUIRED ? consentRequired : null}\n {status === ProviderComponentStatus.UNAVAILABLE ? unavailable : null}\n </div>\n );\n\n return (\n <div\n data-docs-provider-component={capability}\n data-docs-provider-component-state={status}\n aria-busy={status === ProviderComponentStatus.LOADING ? true : undefined}\n style={reservedMinHeight !== undefined ? { minHeight: reservedMinHeight } : undefined}\n >\n {content}\n </div>\n );\n}\n/** @wildo_source:part:end engine.saas-technical-doc.provider-component.slot */\n"]}

package/dist/esm/runtime/decode-jwt-claims.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"decode-jwt-claims.d.ts","sourceRoot":"","sources":["~~../../../~~src/runtime/decode-jwt-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAoCnE"}
1	+ {"version":3,"file":"decode-jwt-claims.d.ts","sourceRoot":"","sources":["../../../../src/runtime/decode-jwt-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAoCnE"}

package/dist/esm/runtime/docs-auth-client.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"docs-auth-client.d.ts","sourceRoot":"","sources":["~~../../../~~src/runtime/docs-auth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,6BAA6B,EAK7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC3B,MAAM,sCAAsC,CAAC;AAM9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgB;gBAExC,IAAI,EAAE;QAChB;;;;;;;;;WASG;QACH,UAAU,EAAE,MAAM,CAAC;QAEnB;;;;;;;;;;;;;;WAcG;QACH,aAAa,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;QACpC;;;;;WAKG;QACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACrC;IAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA+BpE;;;;;;;;;;;;;OAaG;IACG,2BAA2B,CAC/B,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,4BAA4B,CAAC;IAwCxC;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IAkBnC,OAAO,CAAC,OAAO;CAGhB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,uBAAuB,GAC/B,6BAA6B,GAC7B,iBAAiB,GACjB,yBAAyB,GACzB,oBAAoB,CAAC;AAEzB;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAM/E"}
1	+ {"version":3,"file":"docs-auth-client.d.ts","sourceRoot":"","sources":["../../../../src/runtime/docs-auth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,6BAA6B,EAK7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC3B,MAAM,sCAAsC,CAAC;AAM9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgB;gBAExC,IAAI,EAAE;QAChB;;;;;;;;;WASG;QACH,UAAU,EAAE,MAAM,CAAC;QAEnB;;;;;;;;;;;;;;WAcG;QACH,aAAa,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;QACpC;;;;;WAKG;QACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACrC;IAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA+BpE;;;;;;;;;;;;;OAaG;IACG,2BAA2B,CAC/B,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,4BAA4B,CAAC;IAwCxC;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IAkBnC,OAAO,CAAC,OAAO;CAGhB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,uBAAuB,GAC/B,6BAA6B,GAC7B,iBAAiB,GACjB,yBAAyB,GACzB,oBAAoB,CAAC;AAEzB;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAM/E"}

package/dist/esm/runtime/docs-auth-session.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"docs-auth-session.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/runtime/docs-auth-session.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,oBAAY,QAAQ;IAClB,SAAS,cAAc;IACvB,KAAK,UAAU;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB;;;;;kBAK9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC"}
1	+ {"version":3,"file":"docs-auth-session.schemas.d.ts","sourceRoot":"","sources":["../../../../src/runtime/docs-auth-session.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,oBAAY,QAAQ;IAClB,SAAS,cAAc;IACvB,KAAK,UAAU;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB;;;;;kBAK9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC"}

package/dist/esm/runtime/documentation-site-translator.d.ts ADDED Viewed

@@ -0,0 +1,53 @@
+/**
+ * How a documentation site words the engine's documentation pages (#1992): its translation lookup, its
+ * plural rule and its locale.
+ *
+ * On a Docusaurus site these are `translate({ id })` from `@docusaurus/Translate`,
+ * `usePluralForm().selectMessage` from `@docusaurus/theme-common` and `i18n.currentLocale`; the words
+ * live in the site's `i18n/<locale>/code.json`. The runtime takes them as functions so it imports
+ * nothing of Docusaurus, and so the ids stay the engine's one contract rather than being restated by
+ * every site.
+ *
+ * `translate` returns the MESSAGE, placeholders and all: the engine picks the plural form first and
+ * places the values after, so a value that happens to contain `|` or `{…}` cannot be read as syntax.
+ */
+export interface DocumentationSiteTranslator {
+    /** The reader's locale, a BCP 47 tag (`en`, `fr-FR`), for the locale's list pattern. */
+    readonly locale: string;
+    /** The message for `id` in the reader's locale, with its `{name}` placeholders as written; the id itself when missing. */
+    readonly translate: (id: string) => string;
+    /** The form of a `|`-separated plural message that fits `count` in the reader's locale. */
+    readonly selectPlural: (count: number, pluralForms: string) => string;
+}
+/** `template` with each `{name}` replaced by its value; a placeholder with no value is left as written. */
+export declare function fillMessage(template: string, values: Readonly<Record<string, string>>): string;
+/**
+ * `template` split around its placeholders: text at even positions, placeholder NAMES at odd ones — for a
+ * reader that places an element rather than a string at each placeholder.
+ */
+export declare function splitMessagePlaceholders(template: string): readonly string[];
+/** How the items of a list relate, which decides the word the locale joins them with. */
+export declare enum DocumentationListKind {
+    /** All of them — "a, b and c". */
+    CONJUNCTION = "conjunction",
+    /** Any one of them — "a, b or c". */
+    DISJUNCTION = "disjunction"
+}
+/** One piece of a list laid out in the reader's locale: the item at `index`, or the words between items. */
+export type DocumentationListPart = {
+    readonly item: number;
+} | {
+    readonly separator: string;
+};
+/** Whether a laid-out part is an item's position rather than the words between items. */
+export declare function isDocumentationListItem(part: DocumentationListPart): part is {
+    readonly item: number;
+};
+/**
+ * The layout of a list of `itemCount` items in `locale` — where each item goes and what the locale puts
+ * between them — from `Intl.ListFormat`, so the joining words come from the platform's locale data rather
+ * than from an English `', '` or `' or '` written into the view. The items themselves may be anything,
+ * which is why this returns positions rather than joining strings.
+ */
+export declare function documentationListLayout(locale: string, itemCount: number, kind: DocumentationListKind): readonly DocumentationListPart[];
+//# sourceMappingURL=documentation-site-translator.d.ts.map

package/dist/esm/runtime/documentation-site-translator.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"documentation-site-translator.d.ts","sourceRoot":"","sources":["../../../../src/runtime/documentation-site-translator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0HAA0H;IAC1H,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3C,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;CACvE;AASD,2GAA2G;AAC3G,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAG9F;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE5E;AAED,yFAAyF;AACzF,oBAAY,qBAAqB;IAC/B,kCAAkC;IAClC,WAAW,gBAAgB;IAC3B,qCAAqC;IACrC,WAAW,gBAAgB;CAC5B;AAED,4GAA4G;AAC5G,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,IAAI;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAEtG;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,SAAS,qBAAqB,EAAE,CAUxI"}

package/dist/esm/runtime/documentation-site-translator.js ADDED Viewed

@@ -0,0 +1,51 @@
+/**
+ * A message's `{name}` placeholders, found in one place so every reader of a template agrees on the syntax.
+ * Kept private, and a fresh RegExp built per use: a global RegExp carries `lastIndex` between calls, so a
+ * shared one would share that state. Readers go through {@link fillMessage} or {@link splitMessagePlaceholders}.
+ */
+const MESSAGE_PLACEHOLDER_SOURCE = String.raw `\{(\w+)\}`;
+/** `template` with each `{name}` replaced by its value; a placeholder with no value is left as written. */
+export function fillMessage(template, values) {
+    // Own values only: `{constructor}` or `{toString}` must not resolve to what every object inherits.
+    return template.replace(new RegExp(MESSAGE_PLACEHOLDER_SOURCE, 'g'), (placeholder, name) => (Object.hasOwn(values, name) ? values[name] : undefined) ?? placeholder);
+}
+/**
+ * `template` split around its placeholders: text at even positions, placeholder NAMES at odd ones — for a
+ * reader that places an element rather than a string at each placeholder.
+ */
+export function splitMessagePlaceholders(template) {
+    return template.split(new RegExp(MESSAGE_PLACEHOLDER_SOURCE));
+}
+/** How the items of a list relate, which decides the word the locale joins them with. */
+export var DocumentationListKind;
+(function (DocumentationListKind) {
+    /** All of them — "a, b and c". */
+    DocumentationListKind["CONJUNCTION"] = "conjunction";
+    /** Any one of them — "a, b or c". */
+    DocumentationListKind["DISJUNCTION"] = "disjunction";
+})(DocumentationListKind || (DocumentationListKind = {}));
+/** Whether a laid-out part is an item's position rather than the words between items. */
+export function isDocumentationListItem(part) {
+    return Object.hasOwn(part, 'item');
+}
+/**
+ * The layout of a list of `itemCount` items in `locale` — where each item goes and what the locale puts
+ * between them — from `Intl.ListFormat`, so the joining words come from the platform's locale data rather
+ * than from an English `', '` or `' or '` written into the view. The items themselves may be anything,
+ * which is why this returns positions rather than joining strings.
+ */
+export function documentationListLayout(locale, itemCount, kind) {
+    if (itemCount <= 0)
+        return [];
+    const markers = Array.from({ length: itemCount }, (_, index) => `\u0000${index}\u0000`);
+    const formatted = new Intl.ListFormat(locale, { type: kind, style: 'long' }).format(markers);
+    const parts = [];
+    for (const [index, segment] of formatted.split(/\u0000(\d+)\u0000/).entries()) {
+        if (index % 2 === 1)
+            parts.push({ item: Number(segment) });
+        else if (segment.length > 0)
+            parts.push({ separator: segment });
+    }
+    return parts;
+}
+//# sourceMappingURL=documentation-site-translator.js.map

package/dist/esm/runtime/documentation-site-translator.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"documentation-site-translator.js","sourceRoot":"","sources":["../../../../src/runtime/documentation-site-translator.ts"],"names":[],"mappings":"AAsBA;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAA,WAAW,CAAC;AAEzD,2GAA2G;AAC3G,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAwC;IACpF,mGAAmG;IACnG,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,CAAC;AAC/K,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,kCAAkC;IAClC,oDAA2B,CAAA;IAC3B,qCAAqC;IACrC,oDAA2B,CAAA;AAC7B,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAOD,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,SAAiB,EAAE,IAA2B;IACpG,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7F,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9E,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;aACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * How a documentation site words the engine's documentation pages (#1992): its translation lookup, its\n * plural rule and its locale.\n *\n * On a Docusaurus site these are `translate({ id })` from `@docusaurus/Translate`,\n * `usePluralForm().selectMessage` from `@docusaurus/theme-common` and `i18n.currentLocale`; the words\n * live in the site's `i18n/<locale>/code.json`. The runtime takes them as functions so it imports\n * nothing of Docusaurus, and so the ids stay the engine's one contract rather than being restated by\n * every site.\n *\n * `translate` returns the MESSAGE, placeholders and all: the engine picks the plural form first and\n * places the values after, so a value that happens to contain `|` or `{…}` cannot be read as syntax.\n */\nexport interface DocumentationSiteTranslator {\n /** The reader's locale, a BCP 47 tag (`en`, `fr-FR`), for the locale's list pattern. */\n readonly locale: string;\n /** The message for `id` in the reader's locale, with its `{name}` placeholders as written; the id itself when missing. */\n readonly translate: (id: string) => string;\n /** The form of a `|`-separated plural message that fits `count` in the reader's locale. */\n readonly selectPlural: (count: number, pluralForms: string) => string;\n}\n\n/**\n * A message's `{name}` placeholders, found in one place so every reader of a template agrees on the syntax.\n * Kept private, and a fresh RegExp built per use: a global RegExp carries `lastIndex` between calls, so a\n * shared one would share that state. Readers go through {@link fillMessage} or {@link splitMessagePlaceholders}.\n */\nconst MESSAGE_PLACEHOLDER_SOURCE = String.raw`\\{(\\w+)\\}`;\n\n/** `template` with each `{name}` replaced by its value; a placeholder with no value is left as written. */\nexport function fillMessage(template: string, values: Readonly<Record<string, string>>): string {\n // Own values only: `{constructor}` or `{toString}` must not resolve to what every object inherits.\n return template.replace(new RegExp(MESSAGE_PLACEHOLDER_SOURCE, 'g'), (placeholder, name: string) => (Object.hasOwn(values, name) ? values[name] : undefined) ?? placeholder);\n}\n\n/**\n * `template` split around its placeholders: text at even positions, placeholder NAMES at odd ones — for a\n * reader that places an element rather than a string at each placeholder.\n */\nexport function splitMessagePlaceholders(template: string): readonly string[] {\n return template.split(new RegExp(MESSAGE_PLACEHOLDER_SOURCE));\n}\n\n/** How the items of a list relate, which decides the word the locale joins them with. */\nexport enum DocumentationListKind {\n /** All of them — \"a, b and c\". */\n CONJUNCTION = 'conjunction',\n /** Any one of them — \"a, b or c\". */\n DISJUNCTION = 'disjunction',\n}\n\n/** One piece of a list laid out in the reader's locale: the item at `index`, or the words between items. */\nexport type DocumentationListPart =\n | { readonly item: number }\n | { readonly separator: string };\n\n/** Whether a laid-out part is an item's position rather than the words between items. */\nexport function isDocumentationListItem(part: DocumentationListPart): part is { readonly item: number } {\n return Object.hasOwn(part, 'item');\n}\n\n/**\n * The layout of a list of `itemCount` items in `locale` — where each item goes and what the locale puts\n * between them — from `Intl.ListFormat`, so the joining words come from the platform's locale data rather\n * than from an English `', '` or `' or '` written into the view. The items themselves may be anything,\n * which is why this returns positions rather than joining strings.\n */\nexport function documentationListLayout(locale: string, itemCount: number, kind: DocumentationListKind): readonly DocumentationListPart[] {\n if (itemCount <= 0) return [];\n const markers = Array.from({ length: itemCount }, (_, index) => `\\u0000${index}\\u0000`);\n const formatted = new Intl.ListFormat(locale, { type: kind, style: 'long' }).format(markers);\n const parts: DocumentationListPart[] = [];\n for (const [index, segment] of formatted.split(/\\u0000(\\d+)\\u0000/).entries()) {\n if (index % 2 === 1) parts.push({ item: Number(segment) });\n else if (segment.length > 0) parts.push({ separator: segment });\n }\n return parts;\n}\n"]}

package/dist/esm/runtime/frontend-provider-registry.techdoc.d.ts CHANGED Viewed

@@ -26,8 +26,7 @@ export interface CreateFrontendTechdocProviderRegistryInput {
     readonly entries?: FrontendProvidersBlock;
     /**
      * The CODE channel. Absent is the ordinary case for a docs site that declares
-     * no package-shipped provider — `wildo config sync` writes no generated file,
-     * so there is nothing to import and nothing to pass.
+     * no providers. Config sync still writes an empty map so startup imports remain stable.
      */
     readonly modules?: GeneratedTechdocProviderModules;
     readonly onDiagnostic?: (diagnostic: FrontendProviderHydrationDiagnostic) => void;

package/dist/esm/runtime/frontend-provider-registry.techdoc.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"frontend-provider-registry.techdoc.d.ts","sourceRoot":"","sources":["~~../../../~~src/runtime/frontend-provider-registry.techdoc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAEL,KAAK,mCAAmC,EACxC,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAEnF,YAAY,EACV,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,8CAA8C,CAAC;AAEtD,MAAM,WAAW,0CAA0C;IACzD,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C~~;;;;OAIG~~;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,mCAAmC,KAAK,IAAI,CAAC;CACnF;AAED;;GAEG;AACH,wBAAgB,qCAAqC,CACnD,KAAK,CAAC,EAAE,0CAA0C,GACjD,+BAA+B,CAMjC"}
1	+ {"version":3,"file":"frontend-provider-registry.techdoc.d.ts","sourceRoot":"","sources":["../../../../src/runtime/frontend-provider-registry.techdoc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAEL,KAAK,mCAAmC,EACxC,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACrC,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAEnF,YAAY,EACV,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,8CAA8C,CAAC;AAEtD,MAAM,WAAW,0CAA0C;IACzD,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,mCAAmC,KAAK,IAAI,CAAC;CACnF;AAED;;GAEG;AACH,wBAAgB,qCAAqC,CACnD,KAAK,CAAC,EAAE,0CAA0C,GACjD,+BAA+B,CAMjC"}