@wow-two-beta/ui-vue 0.0.2

package/dist/auth/AuthProvider.vue.d.ts

@@ -0,0 +1,33 @@
+import { AuthBridge } from './AuthBridge';
+import { AuthSession, AuthStrategy } from './AuthSession';
+import { VNodeProps, AllowedComponentProps, ComponentCustomProps, PublicProps, ShallowUnwrapRef, VNode } from 'vue';
+/** Defines the props for {@link AuthProvider}. */
+export interface AuthProviderProps<TUser = unknown, TSignInInput = unknown> {
+    /** The transport strategy (cookie / bearer / redirect factory, or bespoke delegates). Read live on every call, so swapping it takes effect immediately — it does not re-resolve on its own. */
+    strategy: AuthStrategy<TUser, TSignInInput>;
+    /** The module-scope bridge wiring the non-Vue seams — api-client 401s flip this session; router guards read it. */
+    bridge?: AuthBridge<TUser>;
+    /** Whether to run the me-resolve on mount. Default `true`; with `false` the session stays `unknown` until `refresh()` or an action settles it. */
+    resolveOnMount?: boolean;
+    /** Fires after a bridged 401 flips the session to `anonymous` — wire redirect-to-login here. */
+    onUnauthorized?: (error?: unknown) => void;
+    /** Fires when the me-resolve throws (network / 5xx) — the session still settles `anonymous`. */
+    onResolveError?: (error: unknown) => void;
+    /** Fires on every session snapshot, including the initial `unknown`. */
+    onSessionChange?: (session: AuthSession<TUser>) => void;
+}
+declare const _default: <TUser = unknown, TSignInInput = unknown>(__VLS_props: NonNullable<Awaited<typeof __VLS_setup>>["props"], __VLS_ctx?: __VLS_PrettifyLocal<Pick<NonNullable<Awaited<typeof __VLS_setup>>, "attrs" | "emit" | "slots">>, __VLS_expose?: NonNullable<Awaited<typeof __VLS_setup>>["expose"], __VLS_setup?: Promise<{
+    props: __VLS_PrettifyLocal<Pick<Partial<{}> & Omit<{} & VNodeProps & AllowedComponentProps & ComponentCustomProps, never>, never> & AuthProviderProps<TUser, TSignInInput> & Partial<{}>> & PublicProps;
+    expose(exposed: ShallowUnwrapRef<{}>): void;
+    attrs: any;
+    slots: {
+        default?: (props: {}) => any;
+    };
+    emit: {};
+}>) => VNode & {
+    __ctx?: Awaited<typeof __VLS_setup>;
+};
+export default _default;
+type __VLS_PrettifyLocal<T> = {
+    [K in keyof T]: T[K];
+} & {};

package/dist/auth/AuthSession.d.ts

@@ -0,0 +1,41 @@
+/** Defines the lifecycle phase of the app session state machine. */
+export declare const AuthStatus: {
+    /** Refers to a session not yet examined — the provider mounted with `resolveOnMount: false` and no action has run yet. */
+    readonly Unknown: "unknown";
+    /** Refers to an in-flight me-resolve — render a splash/spinner, not the login gate. */
+    readonly Resolving: "resolving";
+    /** Refers to a settled, signed-in session carrying a user. */
+    readonly Authenticated: "authenticated";
+    /** Refers to a settled, signed-out session. */
+    readonly Anonymous: "anonymous";
+};
+export type AuthStatus = (typeof AuthStatus)[keyof typeof AuthStatus];
+/** Defines a snapshot of the session — `user` is non-null exactly when `status` is `authenticated`. */
+export interface AuthSession<TUser = unknown> {
+    /** The current machine phase (`unknown → resolving → authenticated | anonymous`). */
+    readonly status: AuthStatus;
+    /** The signed-in user, or `null` outside `authenticated`. */
+    readonly user: TUser | null;
+}
+/** Defines the call context passed to strategy delegates — forward `signal` to the transport when present. */
+export interface AuthResolveContext {
+    /** An optional cancellation signal for the underlying request. */
+    readonly signal?: AbortSignal;
+}
+/**
+ * Defines the pluggable transport half of the session — how the current user is resolved,
+ * established, and torn down. Ship shapes: `createCookieStrategy` (me-resolve over a cookie
+ * session), `createBearerStrategy` (token storage + `getAuthToken` wiring), and
+ * `createRedirectStrategy` (sign-in = full-page OAuth redirect). Any object matching this
+ * contract works — write delegates directly for bespoke flows.
+ */
+export interface AuthStrategy<TUser = unknown, TSignInInput = unknown> {
+    /** Resolves the current user — `null` means signed out; a throw also settles anonymous (reported via the provider's `onResolveError`). */
+    resolveUser(context: AuthResolveContext): Promise<TUser | null>;
+    /** Establishes a session. Return the user to authenticate immediately; return `null`/`void` to leave state unchanged (redirect flows navigate away instead). */
+    signIn?(input: TSignInInput, context: AuthResolveContext): Promise<TUser | null | void> | TUser | null | void;
+    /** Tears the session down (server sign-out, token revoke) — local state flips to anonymous regardless of the outcome. */
+    signOut?(context: AuthResolveContext): Promise<void> | void;
+    /** Reacts to a bridged 401 (e.g. clears a stored bearer token) just before the session flips to anonymous. */
+    onUnauthorized?(): void;
+}

package/dist/auth/BearerStrategy.d.ts

@@ -0,0 +1,36 @@
+import { AuthResolveContext, AuthStrategy } from './AuthSession';
+import { TokenStorage } from './TokenStorage';
+/** Defines the outcome of a bearer credential exchange. */
+export interface BearerAuthenticateResult<TUser> {
+    /** The bearer token stored and sent on subsequent requests. */
+    readonly token: string;
+    /** The signed-in user the session becomes. */
+    readonly user: TUser;
+}
+/** Defines the options for {@link createBearerStrategy}. */
+export interface CreateBearerStrategyOptions<TUser, TSignInInput = unknown> {
+    /** Exchanges credentials for a token + user (e.g. `POST` a password) — a throw propagates to the `signIn` caller (show it on the form). */
+    readonly authenticate: (input: TSignInInput, context: AuthResolveContext) => Promise<BearerAuthenticateResult<TUser>>;
+    /** Where the token lives. Default `createMemoryTokenStorage()` — never persisted, a reload requires re-login (the secrets-vault posture). */
+    readonly tokenStorage?: TokenStorage;
+    /** Restores the user behind a persisted token (me-resolve with the token). Without it, a token found on mount is discarded — sessions restore only when the user can be rebuilt. */
+    readonly resolveUser?: (context: AuthResolveContext & {
+        readonly token: string;
+    }) => Promise<TUser | null>;
+    /** An optional server-side revoke called on sign-out — the token clears locally regardless of the outcome. */
+    readonly signOut?: (context: AuthResolveContext) => Promise<void> | void;
+}
+/** Defines the bearer strategy — an {@link AuthStrategy} plus the `getAuthToken` reader that feeds the api client. */
+export interface BearerStrategy<TUser, TSignInInput = unknown> extends AuthStrategy<TUser, TSignInInput> {
+    /** Feeds `createApiClient({ getAuthToken })` — re-read on every request, so headers always reflect the live session. */
+    readonly getAuthToken: () => string | null;
+    /** The storage behind the strategy — exposed for tests and advanced wiring. */
+    readonly tokenStorage: TokenStorage;
+}
+/**
+ * Creates the bearer-token strategy — the token lives in a {@link TokenStorage} delegate
+ * (in-memory by default), `signIn` runs the credential exchange, and a bridged 401 clears the
+ * token before the session flips to anonymous. Wire the api client with the returned
+ * `getAuthToken`. Covers the secrets-vault shape.
+ */
+export declare function createBearerStrategy<TUser, TSignInInput = unknown>(options: CreateBearerStrategyOptions<TUser, TSignInInput>): BearerStrategy<TUser, TSignInInput>;

package/dist/auth/CookieStrategy.d.ts

@@ -0,0 +1,29 @@
+import { ApiClient } from '../foundation/http';
+import { AuthResolveContext, AuthStrategy } from './AuthSession';
+/** Defines the slice of the SDK `ApiClient` the cookie strategy calls — any object with `get`/`post` fits (fakes included). */
+export type CookieAuthClient = Pick<ApiClient, 'get' | 'post'>;
+/** Defines the context passed to a cookie strategy's custom `signIn` delegate. */
+export interface CookieSignInContext extends AuthResolveContext {
+    /** The strategy's HTTP client — call sign-in endpoints (guest creation, credential/ID-token exchange) through it. */
+    readonly client: CookieAuthClient;
+}
+/** Defines the options for {@link createCookieStrategy}. */
+export interface CreateCookieStrategyOptions<TUser, TSignInInput = unknown> {
+    /** The HTTP client the strategy calls — the app's `createApiClient` (same-origin, or `credentials: 'include'` cross-origin). */
+    readonly client: CookieAuthClient;
+    /** The me-resolve endpoint (GET). Default `/api/identity/me` — the backend SDK identity baseline. */
+    readonly mePath?: string;
+    /** The sign-out endpoint (POST). Default `/api/identity/sign-out`; pass `null` to skip the server call and clear locally only. */
+    readonly signOutPath?: string | null;
+    /** Treats a 200 me-response as signed out (e.g. smart-qr's `kind === 'anonymous'` guest gate). Default: every resolved user counts as authenticated. */
+    readonly isAnonymous?: (user: TUser) => boolean;
+    /** A custom sign-in exchange (guest creation, password post, Google ID-token swap) — return the user to authenticate immediately. */
+    readonly signIn?: (input: TSignInInput, context: CookieSignInContext) => Promise<TUser | null | void> | TUser | null | void;
+}
+/**
+ * Creates the cookie-session strategy — the session cookie is owned by the backend; the client
+ * only resolves `GET {mePath}` on mount (401 → anonymous, other failures settle anonymous and are
+ * reported) and posts `{signOutPath}` on sign-out. Covers the drydock and smart-qr shapes; pair
+ * with `isAnonymous`/`signIn` for guest gates, or use `createRedirectStrategy` for OAuth sign-in.
+ */
+export declare function createCookieStrategy<TUser, TSignInInput = unknown>(options: CreateCookieStrategyOptions<TUser, TSignInInput>): AuthStrategy<TUser, TSignInInput>;

package/dist/auth/RedirectStrategy.d.ts

@@ -0,0 +1,24 @@
+import { AuthStrategy } from './AuthSession';
+import { CreateCookieStrategyOptions } from './CookieStrategy';
+/** Defines the options for {@link createRedirectStrategy}. */
+export interface CreateRedirectStrategyOptions<TUser> extends Omit<CreateCookieStrategyOptions<TUser, never>, 'signIn'> {
+    /** The sign-in challenge endpoint the browser navigates to. Default `/api/identity/sign-in` — the backend SDK identity baseline. */
+    readonly signInPath?: string;
+    /** The query param carrying the post-login return path. Default `returnUrl` (the drydock shape). */
+    readonly returnUrlParam?: string;
+    /** Builds the full challenge URL from the return path — overrides `signInPath` + `returnUrlParam` entirely. */
+    readonly buildSignInUrl?: (returnUrl: string) => string;
+    /** Performs the navigation. Default `window.location.assign` — injectable for tests, and the seam that keeps this strategy testable without a DOM. */
+    readonly navigate?: (url: string) => void;
+}
+/**
+ * Creates the external-redirect OAuth strategy — a cookie session whose `signIn(returnUrl?)`
+ * navigates the browser to the backend's sign-in challenge (`{signInPath}?{returnUrlParam}=…`);
+ * the OAuth callback is handled server-side, which sets the cookie and redirects back. `returnUrl`
+ * defaults to the current `pathname + search`. Covers the drydock shape.
+ *
+ * Construction is SSR-safe — every browser global is read inside `signIn`, never at factory time —
+ * but `signIn` itself is a browser-only operation, and says so with a real message instead of a
+ * bare `ReferenceError` if it is ever reached on the server.
+ */
+export declare function createRedirectStrategy<TUser>(options: CreateRedirectStrategyOptions<TUser>): AuthStrategy<TUser, string | undefined>;

package/dist/auth/TokenStorage.d.ts

@@ -0,0 +1,9 @@
+/** Defines where a bearer strategy keeps its token — implement over `localStorage`/`StorageBroker` when a session must survive reloads. */
+export interface TokenStorage {
+    /** Reads the stored token, or `null` when signed out. */
+    get(): string | null;
+    /** Stores a new token, or clears it with `null`. */
+    set(token: string | null): void;
+}
+/** Creates the default in-memory token storage — deliberately never persisted, so a reload requires re-login (keeps the token off disk). */
+export declare function createMemoryTokenStorage(): TokenStorage;

package/dist/auth/index.d.ts

@@ -0,0 +1,8 @@
+export { AuthStatus, type AuthSession, type AuthResolveContext, type AuthStrategy } from './AuthSession';
+export { default as AuthProvider, type AuthProviderProps } from './AuthProvider.vue';
+export { useAuth, type AuthApi } from './AuthContext';
+export { createAuthBridge, type AuthBridge, type UnauthorizedListener, type SessionListener } from './AuthBridge';
+export { createCookieStrategy, type CreateCookieStrategyOptions, type CookieAuthClient, type CookieSignInContext } from './CookieStrategy';
+export { createBearerStrategy, type CreateBearerStrategyOptions, type BearerStrategy, type BearerAuthenticateResult } from './BearerStrategy';
+export { createRedirectStrategy, type CreateRedirectStrategyOptions } from './RedirectStrategy';
+export { createMemoryTokenStorage, type TokenStorage } from './TokenStorage';

package/dist/auth/index.js

@@ -0,0 +1,275 @@
+import { inject, defineComponent, shallowRef, watch, onMounted, provide, renderSlot } from "vue";
+import { A as ApiError } from "../chunks/ApiError-l0YdcqqV.js";
+const AuthStatus = {
+  /** Refers to a session not yet examined — the provider mounted with `resolveOnMount: false` and no action has run yet. */
+  Unknown: "unknown",
+  /** Refers to an in-flight me-resolve — render a splash/spinner, not the login gate. */
+  Resolving: "resolving",
+  /** Refers to a settled, signed-in session carrying a user. */
+  Authenticated: "authenticated",
+  /** Refers to a settled, signed-out session. */
+  Anonymous: "anonymous"
+};
+const AuthKey = Symbol("wow-two.auth");
+function useAuth() {
+  const context = inject(AuthKey, null);
+  if (context === null) throw new Error("useAuth must be used within an AuthProvider.");
+  return context;
+}
+const AnonymousSession = { status: AuthStatus.Anonymous, user: null };
+const _sfc_main = /* @__PURE__ */ defineComponent({
+  ...{ name: "AuthProvider" },
+  __name: "AuthProvider",
+  props: {
+    strategy: {},
+    bridge: { default: void 0 },
+    resolveOnMount: { type: Boolean, default: true },
+    onUnauthorized: { type: Function, default: void 0 },
+    onResolveError: { type: Function, default: void 0 },
+    onSessionChange: { type: Function, default: void 0 }
+  },
+  setup(__props) {
+    const props = __props;
+    const session = shallowRef({ status: AuthStatus.Unknown, user: null });
+    let generation = 0;
+    let inflight = null;
+    watch(
+      [session, () => props.bridge],
+      ([current, bridge]) => {
+        bridge?.publishSession(current);
+        props.onSessionChange?.(current);
+      },
+      { immediate: true }
+    );
+    function runResolve() {
+      if (inflight) return inflight;
+      const current = ++generation;
+      session.value = { status: AuthStatus.Resolving, user: null };
+      const promise = (async () => {
+        let user;
+        try {
+          user = await props.strategy.resolveUser({});
+        } catch (error) {
+          user = null;
+          props.onResolveError?.(error);
+        }
+        if (generation === current) {
+          session.value = user == null ? AnonymousSession : { status: AuthStatus.Authenticated, user };
+        }
+        return user;
+      })().finally(() => {
+        if (inflight === promise) inflight = null;
+      });
+      inflight = promise;
+      return promise;
+    }
+    onMounted(() => {
+      if (props.resolveOnMount) void runResolve();
+    });
+    watch(
+      () => props.resolveOnMount,
+      (enabled) => {
+        if (enabled) void runResolve();
+      }
+    );
+    watch(
+      () => props.bridge,
+      (bridge, _previous, onCleanup) => {
+        if (!bridge) return;
+        onCleanup(
+          bridge.subscribeUnauthorized((error) => {
+            props.strategy.onUnauthorized?.();
+            generation += 1;
+            inflight = null;
+            session.value = AnonymousSession;
+            props.onUnauthorized?.(error);
+          })
+        );
+      },
+      { immediate: true }
+    );
+    async function signIn(input) {
+      const doSignIn = props.strategy.signIn;
+      if (!doSignIn) throw new Error("AuthProvider: the configured strategy does not implement signIn.");
+      const user = await doSignIn(input, {}) ?? null;
+      if (user === null) return null;
+      generation += 1;
+      inflight = null;
+      session.value = { status: AuthStatus.Authenticated, user };
+      return user;
+    }
+    async function signOut() {
+      generation += 1;
+      inflight = null;
+      try {
+        await props.strategy.signOut?.({});
+      } finally {
+        session.value = AnonymousSession;
+      }
+    }
+    function setUser(user) {
+      generation += 1;
+      inflight = null;
+      session.value = user == null ? AnonymousSession : { status: AuthStatus.Authenticated, user };
+    }
+    const api = {
+      get status() {
+        return session.value.status;
+      },
+      get user() {
+        return session.value.user;
+      },
+      get isAuthenticated() {
+        return session.value.status === AuthStatus.Authenticated;
+      },
+      get isPending() {
+        return session.value.status === AuthStatus.Unknown || session.value.status === AuthStatus.Resolving;
+      },
+      signIn,
+      signOut,
+      refresh: runResolve,
+      setUser
+    };
+    provide(AuthKey, api);
+    return (_ctx, _cache) => {
+      return renderSlot(_ctx.$slots, "default");
+    };
+  }
+});
+function isSettled(session) {
+  return session.status === AuthStatus.Authenticated || session.status === AuthStatus.Anonymous;
+}
+function createAuthBridge() {
+  let session = { status: AuthStatus.Unknown, user: null };
+  const unauthorizedListeners = /* @__PURE__ */ new Set();
+  const sessionListeners = /* @__PURE__ */ new Set();
+  let settleWaiters = [];
+  return {
+    onUnauthorized(error) {
+      for (const listener of [...unauthorizedListeners]) listener(error);
+    },
+    isAuthenticated() {
+      if (isSettled(session)) return Promise.resolve(session.status === AuthStatus.Authenticated);
+      return new Promise((resolve) => settleWaiters.push(resolve));
+    },
+    getSession: () => session,
+    publishSession(next) {
+      session = next;
+      for (const listener of [...sessionListeners]) listener(next);
+      if (!isSettled(next)) return;
+      const waiters = settleWaiters;
+      settleWaiters = [];
+      const authenticated = next.status === AuthStatus.Authenticated;
+      for (const waiter of waiters) waiter(authenticated);
+    },
+    subscribeUnauthorized(listener) {
+      unauthorizedListeners.add(listener);
+      return () => unauthorizedListeners.delete(listener);
+    },
+    subscribeSession(listener) {
+      sessionListeners.add(listener);
+      return () => sessionListeners.delete(listener);
+    }
+  };
+}
+function createCookieStrategy(options) {
+  const { client, mePath = "/api/identity/me", signOutPath = "/api/identity/sign-out", isAnonymous, signIn } = options;
+  const strategy = {
+    async resolveUser(context) {
+      let user;
+      try {
+        user = await client.get(mePath, context.signal ? { signal: context.signal } : void 0);
+      } catch (error) {
+        if (error instanceof ApiError && error.status === 401) return null;
+        throw error;
+      }
+      if (user == null) return null;
+      return isAnonymous?.(user) ? null : user;
+    },
+    async signOut(context) {
+      if (signOutPath === null) return;
+      await client.post(signOutPath, context.signal ? { signal: context.signal } : void 0);
+    }
+  };
+  if (signIn) {
+    strategy.signIn = (input, context) => signIn(input, { ...context, client });
+  }
+  return strategy;
+}
+function createMemoryTokenStorage() {
+  let token = null;
+  return {
+    get: () => token,
+    set: (next) => {
+      token = next;
+    }
+  };
+}
+function createBearerStrategy(options) {
+  const storage = options.tokenStorage ?? createMemoryTokenStorage();
+  return {
+    tokenStorage: storage,
+    getAuthToken: () => storage.get(),
+    async resolveUser(context) {
+      const token = storage.get();
+      if (token == null) return null;
+      if (!options.resolveUser) {
+        storage.set(null);
+        return null;
+      }
+      const user = await options.resolveUser({ ...context, token });
+      if (user == null) storage.set(null);
+      return user;
+    },
+    async signIn(input, context) {
+      const { token, user } = await options.authenticate(input, context);
+      storage.set(token);
+      return user;
+    },
+    async signOut(context) {
+      try {
+        await options.signOut?.(context);
+      } finally {
+        storage.set(null);
+      }
+    },
+    onUnauthorized() {
+      storage.set(null);
+    }
+  };
+}
+function currentPath() {
+  if (typeof window === "undefined") return "/";
+  return window.location.pathname + window.location.search;
+}
+function createRedirectStrategy(options) {
+  const { signInPath = "/api/identity/sign-in", returnUrlParam = "returnUrl", buildSignInUrl, navigate, ...cookieOptions } = options;
+  const base = createCookieStrategy(cookieOptions);
+  const buildUrl = buildSignInUrl ?? ((returnUrl) => `${signInPath}?${returnUrlParam}=${encodeURIComponent(returnUrl)}`);
+  const doNavigate = navigate ?? ((url) => {
+    if (typeof window === "undefined") {
+      throw new Error("createRedirectStrategy: signIn needs a browser to navigate. Pass `navigate` to drive it elsewhere.");
+    }
+    window.location.assign(url);
+  });
+  return {
+    // Closure-based delegates off the cookie strategy — no `this`, safe to re-home.
+    resolveUser: base.resolveUser,
+    signOut: base.signOut,
+    // Returns void on purpose: the session state stays as-is while the browser navigates away.
+    signIn(returnUrl) {
+      doNavigate(buildUrl(returnUrl ?? currentPath()));
+    }
+  };
+}
+export {
+  _sfc_main as AuthProvider,
+  AuthStatus,
+  createAuthBridge,
+  createBearerStrategy,
+  createCookieStrategy,
+  createMemoryTokenStorage,
+  createRedirectStrategy,
+  useAuth
+};
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../src/auth/AuthSession.ts","../../src/auth/AuthContext.ts","../../src/auth/AuthProvider.vue","../../src/auth/AuthBridge.ts","../../src/auth/CookieStrategy.ts","../../src/auth/TokenStorage.ts","../../src/auth/BearerStrategy.ts","../../src/auth/RedirectStrategy.ts"],"sourcesContent":["/** Defines the lifecycle phase of the app session state machine. */\nexport const AuthStatus = {\n  /** Refers to a session not yet examined — the provider mounted with `resolveOnMount: false` and no action has run yet. */\n  Unknown: 'unknown',\n  /** Refers to an in-flight me-resolve — render a splash/spinner, not the login gate. */\n  Resolving: 'resolving',\n  /** Refers to a settled, signed-in session carrying a user. */\n  Authenticated: 'authenticated',\n  /** Refers to a settled, signed-out session. */\n  Anonymous: 'anonymous',\n} as const;\n\nexport type AuthStatus = (typeof AuthStatus)[keyof typeof AuthStatus];\n\n/** Defines a snapshot of the session — `user` is non-null exactly when `status` is `authenticated`. */\nexport interface AuthSession<TUser = unknown> {\n  /** The current machine phase (`unknown → resolving → authenticated | anonymous`). */\n  readonly status: AuthStatus;\n\n  /** The signed-in user, or `null` outside `authenticated`. */\n  readonly user: TUser | null;\n}\n\n/** Defines the call context passed to strategy delegates — forward `signal` to the transport when present. */\nexport interface AuthResolveContext {\n  /** An optional cancellation signal for the underlying request. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * Defines the pluggable transport half of the session — how the current user is resolved,\n * established, and torn down. Ship shapes: `createCookieStrategy` (me-resolve over a cookie\n * session), `createBearerStrategy` (token storage + `getAuthToken` wiring), and\n * `createRedirectStrategy` (sign-in = full-page OAuth redirect). Any object matching this\n * contract works — write delegates directly for bespoke flows.\n */\nexport interface AuthStrategy<TUser = unknown, TSignInInput = unknown> {\n  /** Resolves the current user — `null` means signed out; a throw also settles anonymous (reported via the provider's `onResolveError`). */\n  resolveUser(context: AuthResolveContext): Promise<TUser | null>;\n\n  /** Establishes a session. Return the user to authenticate immediately; return `null`/`void` to leave state unchanged (redirect flows navigate away instead). */\n  signIn?(input: TSignInInput, context: AuthResolveContext): Promise<TUser | null | void> | TUser | null | void;\n\n  /** Tears the session down (server sign-out, token revoke) — local state flips to anonymous regardless of the outcome. */\n  signOut?(context: AuthResolveContext): Promise<void> | void;\n\n  /** Reacts to a bridged 401 (e.g. clears a stored bearer token) just before the session flips to anonymous. */\n  onUnauthorized?(): void;\n}\n","import { inject, type InjectionKey } from 'vue';\n\nimport type { AuthStatus } from './AuthSession';\n\n/**\n * Defines the session API exposed by {@link useAuth}.\n *\n * The four state members are REACTIVE PROPERTIES — native getters over the provider's session ref,\n * not snapshots. Read them (`auth.status`, `auth.user`) in a template, a `computed`, or a `watch`\n * and they re-evaluate on every transition. Destructuring (`const { user } = useAuth()`) takes a\n * one-time copy and will not update — bind to the object instead.\n *\n * Getters rather than a `reactive()` wrapper on purpose: `reactive()` would hand back a deep proxy\n * of `user`, so `auth.user !== theUserTheAppPassedIn` and identity checks would silently fail.\n */\nexport interface AuthApi<TUser = unknown, TSignInInput = unknown> {\n  /** The current machine phase (`unknown → resolving → authenticated | anonymous`). */\n  readonly status: AuthStatus;\n\n  /** The signed-in user, or `null` outside `authenticated`. */\n  readonly user: TUser | null;\n\n  /** Whether the session is settled and signed in. */\n  readonly isAuthenticated: boolean;\n\n  /** Whether the session has not settled yet (`unknown` or `resolving`) — render a splash, not the login gate. */\n  readonly isPending: boolean;\n\n  /** Runs the strategy's sign-in. Resolves the user when the exchange returns one (state → `authenticated`); resolves `null` when it doesn't (redirect flows navigate away). Exchange errors reject. */\n  signIn(input?: TSignInInput): Promise<TUser | null>;\n\n  /** Runs the strategy's sign-out — local state flips to `anonymous` regardless; a server-side failure still rejects. */\n  signOut(): Promise<void>;\n\n  /** Re-runs the me-resolve (through `resolving`); resolves the settled user, or `null`. */\n  refresh(): Promise<TUser | null>;\n\n  /** Applies an externally obtained user — e.g. a Google ID-token exchange completed by a button. `null` flips to `anonymous`. */\n  setUser(user: TUser | null): void;\n}\n\n/**\n * React's `createContext<AuthApi | null>(null)` becomes an `InjectionKey`. One untyped key backs\n * every generic instantiation; `useAuth<TUser>()` re-narrows, exactly as the React original did.\n *\n * Deliberately NOT re-exported from `index.ts` — the React original kept its context module-private,\n * and the barrel shape is preserved.\n */\nexport const AuthKey: InjectionKey<AuthApi<unknown, unknown>> = Symbol('wow-two.auth');\n\n/** Accesses the session API. Must be used within an {@link AuthProvider}; `TUser` re-narrows the provider's generic. */\nexport function useAuth<TUser = unknown, TSignInInput = unknown>(): AuthApi<TUser, TSignInInput> {\n  const context = inject(AuthKey, null);\n  if (context === null) throw new Error('useAuth must be used within an AuthProvider.');\n  return context as AuthApi<TUser, TSignInInput>;\n}\n","<script lang=\"ts\">\nimport type { AuthBridge } from './AuthBridge';\nimport { AuthStatus, type AuthSession, type AuthStrategy } from './AuthSession';\n\nconst AnonymousSession = { status: AuthStatus.Anonymous, user: null } as const;\n\n/** Defines the props for {@link AuthProvider}. */\nexport interface AuthProviderProps<TUser = unknown, TSignInInput = unknown> {\n  /** The transport strategy (cookie / bearer / redirect factory, or bespoke delegates). Read live on every call, so swapping it takes effect immediately — it does not re-resolve on its own. */\n  strategy: AuthStrategy<TUser, TSignInInput>;\n\n  /** The module-scope bridge wiring the non-Vue seams — api-client 401s flip this session; router guards read it. */\n  bridge?: AuthBridge<TUser>;\n\n  /** Whether to run the me-resolve on mount. Default `true`; with `false` the session stays `unknown` until `refresh()` or an action settles it. */\n  resolveOnMount?: boolean;\n\n  /** Fires after a bridged 401 flips the session to `anonymous` — wire redirect-to-login here. */\n  onUnauthorized?: (error?: unknown) => void;\n\n  /** Fires when the me-resolve throws (network / 5xx) — the session still settles `anonymous`. */\n  onResolveError?: (error: unknown) => void;\n\n  /** Fires on every session snapshot, including the initial `unknown`. */\n  onSessionChange?: (session: AuthSession<TUser>) => void;\n}\n</script>\n\n<script setup lang=\"ts\" generic=\"TUser = unknown, TSignInInput = unknown\">\nimport { onMounted, provide, shallowRef, watch } from 'vue';\n\n// `AuthStatus` / `AuthSession` are already imported by the plain `<script>` block above — the two\n// blocks compile into ONE module, so importing them again here is a duplicate identifier.\nimport { AuthKey, type AuthApi } from './AuthContext';\n\n/**\n * Owns the app session state machine (`unknown → resolving → authenticated | anonymous`) —\n * me-resolve on mount (deduped, never aborted mid-flight), `signIn`/`signOut`/`refresh`/`setUser`\n * actions, and optional `AuthBridge` wiring so api-client 401s flip the session and router guards\n * can await it. Headless: gates, splash screens, and login UI stay app-side.\n *\n * ```vue\n * <AuthProvider :strategy=\"strategy\" :bridge=\"bridge\">\n *   <App />\n * </AuthProvider>\n * ```\n *\n * Renders no element of its own — the slot passes straight through.\n */\ndefineOptions({ name: 'AuthProvider' });\n\nconst props = withDefaults(defineProps<AuthProviderProps<TUser, TSignInInput>>(), {\n  bridge: undefined,\n  resolveOnMount: true,\n  onUnauthorized: undefined,\n  onResolveError: undefined,\n  onSessionChange: undefined,\n});\n\nconst session = shallowRef<AuthSession<TUser>>({ status: AuthStatus.Unknown, user: null });\n\n// React needed the latest-ref pattern here — four `useRef`s reassigned every render — so its\n// `useCallback` delegates could read fresh props without re-creating. Vue's `props` is already a\n// live reactive object, so reading `props.strategy` / `props.onResolveError` at call time IS the\n// latest-ref pattern, and the whole bookkeeping block collapses to nothing.\n\n// Guards async completions: every explicit transition bumps the generation, so a stale resolve\n// settling later cannot overwrite it. Plain locals — never rendered, so reactivity would be waste.\nlet generation = 0;\nlet inflight: Promise<TUser | null> | null = null;\n\n// Publish every snapshot outward — bridge first (guards may be awaiting), then the app callback.\n// `immediate` publishes the initial `unknown`, which React's mount effect also did. SSR-safe: both\n// sinks are plain callbacks over a Set, with no browser global in reach.\nwatch(\n  [session, () => props.bridge],\n  ([current, bridge]) => {\n    bridge?.publishSession(current);\n    props.onSessionChange?.(current);\n  },\n  { immediate: true },\n);\n\nfunction runResolve(): Promise<TUser | null> {\n  // Shared in-flight promise: a remount and concurrent `refresh()` calls ride one me-request\n  // instead of racing duplicates (the drydock dedupe, per-provider).\n  if (inflight) return inflight;\n\n  const current = ++generation;\n  session.value = { status: AuthStatus.Resolving, user: null };\n\n  const promise = (async (): Promise<TUser | null> => {\n    let user: TUser | null;\n    try {\n      user = await props.strategy.resolveUser({});\n    } catch (error) {\n      user = null;\n      props.onResolveError?.(error);\n    }\n    if (generation === current) {\n      session.value = user == null ? AnonymousSession : { status: AuthStatus.Authenticated, user };\n    }\n    return user;\n  })().finally(() => {\n    if (inflight === promise) inflight = null;\n  });\n\n  inflight = promise;\n  return promise;\n}\n\n// `onMounted` never runs on the server, which is exactly what the me-resolve needs: it is a network\n// call, and a `watch(…, { immediate: true })` here would fire it during SSR.\nonMounted(() => {\n  if (props.resolveOnMount) void runResolve();\n});\n\n// React's mount effect also re-ran when `resolveOnMount` flipped; a non-immediate watcher mirrors\n// that, and cannot double-fire at mount the way an immediate one would.\nwatch(\n  () => props.resolveOnMount,\n  (enabled) => {\n    if (enabled) void runResolve();\n  },\n);\n\n// Bridged 401 → strategy cleanup (bearer drops its token) → anonymous → app callback.\nwatch(\n  () => props.bridge,\n  (bridge, _previous, onCleanup) => {\n    if (!bridge) return;\n    onCleanup(\n      bridge.subscribeUnauthorized((error) => {\n        props.strategy.onUnauthorized?.();\n        generation += 1;\n        inflight = null;\n        session.value = AnonymousSession;\n        props.onUnauthorized?.(error);\n      }),\n    );\n  },\n  { immediate: true },\n);\n\nasync function signIn(input?: TSignInInput): Promise<TUser | null> {\n  const doSignIn = props.strategy.signIn;\n  if (!doSignIn) throw new Error('AuthProvider: the configured strategy does not implement signIn.');\n  const user = (await doSignIn(input as TSignInInput, {})) ?? null;\n  if (user === null) return null; // no user handed back (redirect navigating away) → state unchanged\n  generation += 1;\n  inflight = null;\n  session.value = { status: AuthStatus.Authenticated, user };\n  return user;\n}\n\nasync function signOut(): Promise<void> {\n  generation += 1;\n  inflight = null;\n  try {\n    await props.strategy.signOut?.({});\n  } finally {\n    session.value = AnonymousSession; // local sign-out always lands, even when the server call fails\n  }\n}\n\nfunction setUser(user: TUser | null): void {\n  generation += 1;\n  inflight = null;\n  session.value = user == null ? AnonymousSession : { status: AuthStatus.Authenticated, user };\n}\n\n// React rebuilt this object through `useMemo` on every session change so consumers saw fresh\n// values. Native getters over the `session` ref do it without rebuilding: each read tracks the ref,\n// so a template binding or a `computed` re-evaluates on transition. See `AuthApi` for why these are\n// getters rather than a `reactive()` wrapper — a proxy would break `user`'s identity.\nconst api: AuthApi<TUser, TSignInInput> = {\n  get status() {\n    return session.value.status;\n  },\n  get user() {\n    return session.value.user;\n  },\n  get isAuthenticated() {\n    return session.value.status === AuthStatus.Authenticated;\n  },\n  get isPending() {\n    return session.value.status === AuthStatus.Unknown || session.value.status === AuthStatus.Resolving;\n  },\n  signIn,\n  signOut,\n  refresh: runResolve,\n  setUser,\n};\n\nprovide(AuthKey, api as AuthApi<unknown, unknown>);\n</script>\n\n<template>\n  <slot />\n</template>\n","import { AuthStatus, type AuthSession } from './AuthSession';\n\n/** Defines a listener notified when a bridged 401 arrives. */\nexport type UnauthorizedListener = (error?: unknown) => void;\n\n/** Defines a listener notified on every published session snapshot. */\nexport type SessionListener<TUser = unknown> = (session: AuthSession<TUser>) => void;\n\n/**\n * Defines the module-scope hub wiring the Vue session to the non-Vue seams. Create it once\n * next to the api client and feed both ends:\n *\n * - **401s in** — `createApiClient({ onUnauthorized: bridge.onUnauthorized })`; the mounted\n *   `AuthProvider` subscribes and flips the session to anonymous.\n * - **Guards out** — `requireAuth(bridge.isAuthenticated)` (`/router`); the check waits for the\n *   in-flight me-resolve to settle before allowing or redirecting.\n */\nexport interface AuthBridge<TUser = unknown> {\n  /** Fires the 401 signal — pass as the api client's `onUnauthorized`; safe to call with no provider mounted (no-op). */\n  onUnauthorized(error?: unknown): void;\n\n  /** Resolves whether the session is authenticated, waiting for an unsettled session to settle — matches the router guard's `isAuthenticated` callback shape. */\n  isAuthenticated(): Promise<boolean>;\n\n  /** Reads the latest published session snapshot (`unknown` until a provider publishes). */\n  getSession(): AuthSession<TUser>;\n\n  /** Publishes a session snapshot — called by `AuthProvider` on every transition; call manually only in custom (non-provider) integrations. */\n  publishSession(session: AuthSession<TUser>): void;\n\n  /** Subscribes to bridged 401s — used by `AuthProvider`; returns an unsubscribe. */\n  subscribeUnauthorized(listener: UnauthorizedListener): () => void;\n\n  /** Subscribes to published session snapshots; returns an unsubscribe. */\n  subscribeSession(listener: SessionListener<TUser>): () => void;\n}\n\n/** Checks whether a session has left the pending phases. */\nfunction isSettled(session: AuthSession<unknown>): boolean {\n  return session.status === AuthStatus.Authenticated || session.status === AuthStatus.Anonymous;\n}\n\n/** Creates an {@link AuthBridge} — one per app, module scope, shared by the api client, the router guards, and the `AuthProvider`. */\nexport function createAuthBridge<TUser = unknown>(): AuthBridge<TUser> {\n  let session: AuthSession<TUser> = { status: AuthStatus.Unknown, user: null };\n  const unauthorizedListeners = new Set<UnauthorizedListener>();\n  const sessionListeners = new Set<SessionListener<TUser>>();\n  let settleWaiters: Array<(authenticated: boolean) => void> = [];\n\n  return {\n    onUnauthorized(error?: unknown): void {\n      for (const listener of [...unauthorizedListeners]) listener(error);\n    },\n\n    isAuthenticated(): Promise<boolean> {\n      if (isSettled(session)) return Promise.resolve(session.status === AuthStatus.Authenticated);\n      return new Promise((resolve) => settleWaiters.push(resolve));\n    },\n\n    getSession: () => session,\n\n    publishSession(next: AuthSession<TUser>): void {\n      session = next;\n      for (const listener of [...sessionListeners]) listener(next);\n      if (!isSettled(next)) return;\n      const waiters = settleWaiters;\n      settleWaiters = [];\n      const authenticated = next.status === AuthStatus.Authenticated;\n      for (const waiter of waiters) waiter(authenticated);\n    },\n\n    subscribeUnauthorized(listener: UnauthorizedListener): () => void {\n      unauthorizedListeners.add(listener);\n      return () => unauthorizedListeners.delete(listener);\n    },\n\n    subscribeSession(listener: SessionListener<TUser>): () => void {\n      sessionListeners.add(listener);\n      return () => sessionListeners.delete(listener);\n    },\n  };\n}\n","import { ApiError, type ApiClient } from '../foundation/http';\n\nimport type { AuthResolveContext, AuthStrategy } from './AuthSession';\n\n/** Defines the slice of the SDK `ApiClient` the cookie strategy calls — any object with `get`/`post` fits (fakes included). */\nexport type CookieAuthClient = Pick<ApiClient, 'get' | 'post'>;\n\n/** Defines the context passed to a cookie strategy's custom `signIn` delegate. */\nexport interface CookieSignInContext extends AuthResolveContext {\n  /** The strategy's HTTP client — call sign-in endpoints (guest creation, credential/ID-token exchange) through it. */\n  readonly client: CookieAuthClient;\n}\n\n/** Defines the options for {@link createCookieStrategy}. */\nexport interface CreateCookieStrategyOptions<TUser, TSignInInput = unknown> {\n  /** The HTTP client the strategy calls — the app's `createApiClient` (same-origin, or `credentials: 'include'` cross-origin). */\n  readonly client: CookieAuthClient;\n\n  /** The me-resolve endpoint (GET). Default `/api/identity/me` — the backend SDK identity baseline. */\n  readonly mePath?: string;\n\n  /** The sign-out endpoint (POST). Default `/api/identity/sign-out`; pass `null` to skip the server call and clear locally only. */\n  readonly signOutPath?: string | null;\n\n  /** Treats a 200 me-response as signed out (e.g. smart-qr's `kind === 'anonymous'` guest gate). Default: every resolved user counts as authenticated. */\n  readonly isAnonymous?: (user: TUser) => boolean;\n\n  /** A custom sign-in exchange (guest creation, password post, Google ID-token swap) — return the user to authenticate immediately. */\n  readonly signIn?: (input: TSignInInput, context: CookieSignInContext) => Promise<TUser | null | void> | TUser | null | void;\n}\n\n/**\n * Creates the cookie-session strategy — the session cookie is owned by the backend; the client\n * only resolves `GET {mePath}` on mount (401 → anonymous, other failures settle anonymous and are\n * reported) and posts `{signOutPath}` on sign-out. Covers the drydock and smart-qr shapes; pair\n * with `isAnonymous`/`signIn` for guest gates, or use `createRedirectStrategy` for OAuth sign-in.\n */\nexport function createCookieStrategy<TUser, TSignInInput = unknown>(\n  options: CreateCookieStrategyOptions<TUser, TSignInInput>,\n): AuthStrategy<TUser, TSignInInput> {\n  const { client, mePath = '/api/identity/me', signOutPath = '/api/identity/sign-out', isAnonymous, signIn } = options;\n\n  const strategy: AuthStrategy<TUser, TSignInInput> = {\n    async resolveUser(context: AuthResolveContext): Promise<TUser | null> {\n      let user: TUser | undefined;\n      try {\n        user = await client.get<TUser>(mePath, context.signal ? { signal: context.signal } : undefined);\n      } catch (error) {\n        // 401 = simply signed out — not a failure. Anything else propagates: the provider settles\n        // anonymous and reports it via `onResolveError` (the drydock/smart-qr posture).\n        if (error instanceof ApiError && error.status === 401) return null;\n        throw error;\n      }\n      if (user == null) return null;\n      return isAnonymous?.(user) ? null : user;\n    },\n\n    async signOut(context: AuthResolveContext): Promise<void> {\n      if (signOutPath === null) return;\n      await client.post<void>(signOutPath, context.signal ? { signal: context.signal } : undefined);\n    },\n  };\n\n  if (signIn) {\n    strategy.signIn = (input: TSignInInput, context: AuthResolveContext) => signIn(input, { ...context, client });\n  }\n\n  return strategy;\n}\n","/** Defines where a bearer strategy keeps its token — implement over `localStorage`/`StorageBroker` when a session must survive reloads. */\nexport interface TokenStorage {\n  /** Reads the stored token, or `null` when signed out. */\n  get(): string | null;\n\n  /** Stores a new token, or clears it with `null`. */\n  set(token: string | null): void;\n}\n\n/** Creates the default in-memory token storage — deliberately never persisted, so a reload requires re-login (keeps the token off disk). */\nexport function createMemoryTokenStorage(): TokenStorage {\n  let token: string | null = null;\n  return {\n    get: () => token,\n    set: (next) => {\n      token = next;\n    },\n  };\n}\n","import type { AuthResolveContext, AuthStrategy } from './AuthSession';\nimport { createMemoryTokenStorage, type TokenStorage } from './TokenStorage';\n\n/** Defines the outcome of a bearer credential exchange. */\nexport interface BearerAuthenticateResult<TUser> {\n  /** The bearer token stored and sent on subsequent requests. */\n  readonly token: string;\n\n  /** The signed-in user the session becomes. */\n  readonly user: TUser;\n}\n\n/** Defines the options for {@link createBearerStrategy}. */\nexport interface CreateBearerStrategyOptions<TUser, TSignInInput = unknown> {\n  /** Exchanges credentials for a token + user (e.g. `POST` a password) — a throw propagates to the `signIn` caller (show it on the form). */\n  readonly authenticate: (input: TSignInInput, context: AuthResolveContext) => Promise<BearerAuthenticateResult<TUser>>;\n\n  /** Where the token lives. Default `createMemoryTokenStorage()` — never persisted, a reload requires re-login (the secrets-vault posture). */\n  readonly tokenStorage?: TokenStorage;\n\n  /** Restores the user behind a persisted token (me-resolve with the token). Without it, a token found on mount is discarded — sessions restore only when the user can be rebuilt. */\n  readonly resolveUser?: (context: AuthResolveContext & { readonly token: string }) => Promise<TUser | null>;\n\n  /** An optional server-side revoke called on sign-out — the token clears locally regardless of the outcome. */\n  readonly signOut?: (context: AuthResolveContext) => Promise<void> | void;\n}\n\n/** Defines the bearer strategy — an {@link AuthStrategy} plus the `getAuthToken` reader that feeds the api client. */\nexport interface BearerStrategy<TUser, TSignInInput = unknown> extends AuthStrategy<TUser, TSignInInput> {\n  /** Feeds `createApiClient({ getAuthToken })` — re-read on every request, so headers always reflect the live session. */\n  readonly getAuthToken: () => string | null;\n\n  /** The storage behind the strategy — exposed for tests and advanced wiring. */\n  readonly tokenStorage: TokenStorage;\n}\n\n/**\n * Creates the bearer-token strategy — the token lives in a {@link TokenStorage} delegate\n * (in-memory by default), `signIn` runs the credential exchange, and a bridged 401 clears the\n * token before the session flips to anonymous. Wire the api client with the returned\n * `getAuthToken`. Covers the secrets-vault shape.\n */\nexport function createBearerStrategy<TUser, TSignInInput = unknown>(\n  options: CreateBearerStrategyOptions<TUser, TSignInInput>,\n): BearerStrategy<TUser, TSignInInput> {\n  const storage = options.tokenStorage ?? createMemoryTokenStorage();\n\n  return {\n    tokenStorage: storage,\n    getAuthToken: () => storage.get(),\n\n    async resolveUser(context: AuthResolveContext): Promise<TUser | null> {\n      const token = storage.get();\n      if (token == null) return null;\n      if (!options.resolveUser) {\n        // A token we cannot turn back into a user is dead weight — drop it so the api client\n        // stops sending a header the session no longer stands behind.\n        storage.set(null);\n        return null;\n      }\n      // A throw keeps the token (transient failure ≠ revoked session); a `null` result clears it.\n      const user = await options.resolveUser({ ...context, token });\n      if (user == null) storage.set(null);\n      return user;\n    },\n\n    async signIn(input: TSignInInput, context: AuthResolveContext): Promise<TUser> {\n      const { token, user } = await options.authenticate(input, context);\n      storage.set(token);\n      return user;\n    },\n\n    async signOut(context: AuthResolveContext): Promise<void> {\n      try {\n        await options.signOut?.(context);\n      } finally {\n        storage.set(null);\n      }\n    },\n\n    onUnauthorized(): void {\n      storage.set(null);\n    },\n  };\n}\n","import type { AuthStrategy } from './AuthSession';\nimport { createCookieStrategy, type CreateCookieStrategyOptions } from './CookieStrategy';\n\n/** Defines the options for {@link createRedirectStrategy}. */\nexport interface CreateRedirectStrategyOptions<TUser> extends Omit<CreateCookieStrategyOptions<TUser, never>, 'signIn'> {\n  /** The sign-in challenge endpoint the browser navigates to. Default `/api/identity/sign-in` — the backend SDK identity baseline. */\n  readonly signInPath?: string;\n\n  /** The query param carrying the post-login return path. Default `returnUrl` (the drydock shape). */\n  readonly returnUrlParam?: string;\n\n  /** Builds the full challenge URL from the return path — overrides `signInPath` + `returnUrlParam` entirely. */\n  readonly buildSignInUrl?: (returnUrl: string) => string;\n\n  /** Performs the navigation. Default `window.location.assign` — injectable for tests, and the seam that keeps this strategy testable without a DOM. */\n  readonly navigate?: (url: string) => void;\n}\n\n/**\n * Reads the current location as the default return path.\n *\n * SSR-safe: `createRedirectStrategy` is built at module scope in an app, so this module is imported\n * on the server. There is no location there, so a bare `/` stands in rather than letting\n * `window.location` throw a bare `ReferenceError`.\n */\nfunction currentPath(): string {\n  if (typeof window === 'undefined') return '/';\n  return window.location.pathname + window.location.search;\n}\n\n/**\n * Creates the external-redirect OAuth strategy — a cookie session whose `signIn(returnUrl?)`\n * navigates the browser to the backend's sign-in challenge (`{signInPath}?{returnUrlParam}=…`);\n * the OAuth callback is handled server-side, which sets the cookie and redirects back. `returnUrl`\n * defaults to the current `pathname + search`. Covers the drydock shape.\n *\n * Construction is SSR-safe — every browser global is read inside `signIn`, never at factory time —\n * but `signIn` itself is a browser-only operation, and says so with a real message instead of a\n * bare `ReferenceError` if it is ever reached on the server.\n */\nexport function createRedirectStrategy<TUser>(options: CreateRedirectStrategyOptions<TUser>): AuthStrategy<TUser, string | undefined> {\n  const { signInPath = '/api/identity/sign-in', returnUrlParam = 'returnUrl', buildSignInUrl, navigate, ...cookieOptions } = options;\n\n  const base = createCookieStrategy<TUser, never>(cookieOptions);\n  const buildUrl = buildSignInUrl ?? ((returnUrl: string) => `${signInPath}?${returnUrlParam}=${encodeURIComponent(returnUrl)}`);\n  const doNavigate =\n    navigate ??\n    ((url: string) => {\n      // A full-page redirect needs a browser. Reaching this on the server means `signIn` was called\n      // from a render rather than a user action — fail loudly, since silently dropping a sign-in\n      // leaves the session stuck with no signal at all. Pass `navigate` to drive it in a test.\n      if (typeof window === 'undefined') {\n        throw new Error('createRedirectStrategy: signIn needs a browser to navigate. Pass `navigate` to drive it elsewhere.');\n      }\n      window.location.assign(url);\n    });\n\n  return {\n    // Closure-based delegates off the cookie strategy — no `this`, safe to re-home.\n    resolveUser: base.resolveUser,\n    signOut: base.signOut,\n\n    // Returns void on purpose: the session state stays as-is while the browser navigates away.\n    signIn(returnUrl?: string): void {\n      doNavigate(buildUrl(returnUrl ?? currentPath()));\n    },\n  };\n}\n"],"names":["_renderSlot"],"mappings":";;AACO,MAAM,aAAa;AAAA;AAAA,EAExB,SAAS;AAAA;AAAA,EAET,WAAW;AAAA;AAAA,EAEX,eAAe;AAAA;AAAA,EAEf,WAAW;AACb;ACsCO,MAAM,UAAmD,OAAO,cAAc;AAG9E,SAAS,UAAiF;AAC/F,QAAM,UAAU,OAAO,SAAS,IAAI;AACpC,MAAI,YAAY,KAAM,OAAM,IAAI,MAAM,8CAA8C;AACpF,SAAO;AACT;ACnDA,MAAM,mBAAmB,EAAE,QAAQ,WAAW,WAAW,MAAM,KAAA;;;;;;;;;;;;;AA+C/D,UAAM,QAAQ;AAQd,UAAM,UAAU,WAA+B,EAAE,QAAQ,WAAW,SAAS,MAAM,MAAM;AASzF,QAAI,aAAa;AACjB,QAAI,WAAyC;AAK7C;AAAA,MACE,CAAC,SAAS,MAAM,MAAM,MAAM;AAAA,MAC5B,CAAC,CAAC,SAAS,MAAM,MAAM;AACrB,gBAAQ,eAAe,OAAO;AAC9B,cAAM,kBAAkB,OAAO;AAAA,MACjC;AAAA,MACA,EAAE,WAAW,KAAA;AAAA,IAAK;AAGpB,aAAS,aAAoC;AAG3C,UAAI,SAAU,QAAO;AAErB,YAAM,UAAU,EAAE;AAClB,cAAQ,QAAQ,EAAE,QAAQ,WAAW,WAAW,MAAM,KAAA;AAEtD,YAAM,WAAW,YAAmC;AAClD,YAAI;AACJ,YAAI;AACF,iBAAO,MAAM,MAAM,SAAS,YAAY,CAAA,CAAE;AAAA,QAC5C,SAAS,OAAO;AACd,iBAAO;AACP,gBAAM,iBAAiB,KAAK;AAAA,QAC9B;AACA,YAAI,eAAe,SAAS;AAC1B,kBAAQ,QAAQ,QAAQ,OAAO,mBAAmB,EAAE,QAAQ,WAAW,eAAe,KAAA;AAAA,QACxF;AACA,eAAO;AAAA,MACT,GAAA,EAAK,QAAQ,MAAM;AACjB,YAAI,aAAa,QAAS,YAAW;AAAA,MACvC,CAAC;AAED,iBAAW;AACX,aAAO;AAAA,IACT;AAIA,cAAU,MAAM;AACd,UAAI,MAAM,eAAgB,MAAK,WAAA;AAAA,IACjC,CAAC;AAID;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,CAAC,YAAY;AACX,YAAI,cAAc,WAAA;AAAA,MACpB;AAAA,IAAA;AAIF;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,CAAC,QAAQ,WAAW,cAAc;AAChC,YAAI,CAAC,OAAQ;AACb;AAAA,UACE,OAAO,sBAAsB,CAAC,UAAU;AACtC,kBAAM,SAAS,iBAAA;AACf,0BAAc;AACd,uBAAW;AACX,oBAAQ,QAAQ;AAChB,kBAAM,iBAAiB,KAAK;AAAA,UAC9B,CAAC;AAAA,QAAA;AAAA,MAEL;AAAA,MACA,EAAE,WAAW,KAAA;AAAA,IAAK;AAGpB,mBAAe,OAAO,OAA6C;AACjE,YAAM,WAAW,MAAM,SAAS;AAChC,UAAI,CAAC,SAAU,OAAM,IAAI,MAAM,kEAAkE;AACjG,YAAM,OAAQ,MAAM,SAAS,OAAuB,CAAA,CAAE,KAAM;AAC5D,UAAI,SAAS,KAAM,QAAO;AAC1B,oBAAc;AACd,iBAAW;AACX,cAAQ,QAAQ,EAAE,QAAQ,WAAW,eAAe,KAAA;AACpD,aAAO;AAAA,IACT;AAEA,mBAAe,UAAyB;AACtC,oBAAc;AACd,iBAAW;AACX,UAAI;AACF,cAAM,MAAM,SAAS,UAAU,EAAE;AAAA,MACnC,UAAA;AACE,gBAAQ,QAAQ;AAAA,MAClB;AAAA,IACF;AAEA,aAAS,QAAQ,MAA0B;AACzC,oBAAc;AACd,iBAAW;AACX,cAAQ,QAAQ,QAAQ,OAAO,mBAAmB,EAAE,QAAQ,WAAW,eAAe,KAAA;AAAA,IACxF;AAMA,UAAM,MAAoC;AAAA,MACxC,IAAI,SAAS;AACX,eAAO,QAAQ,MAAM;AAAA,MACvB;AAAA,MACA,IAAI,OAAO;AACT,eAAO,QAAQ,MAAM;AAAA,MACvB;AAAA,MACA,IAAI,kBAAkB;AACpB,eAAO,QAAQ,MAAM,WAAW,WAAW;AAAA,MAC7C;AAAA,MACA,IAAI,YAAY;AACd,eAAO,QAAQ,MAAM,WAAW,WAAW,WAAW,QAAQ,MAAM,WAAW,WAAW;AAAA,MAC5F;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IAAA;AAGF,YAAQ,SAAS,GAAgC;;aAI/CA,WAAQ,KAAA,QAAA,SAAA;AAAA;;;AChKV,SAAS,UAAU,SAAwC;AACzD,SAAO,QAAQ,WAAW,WAAW,iBAAiB,QAAQ,WAAW,WAAW;AACtF;AAGO,SAAS,mBAAuD;AACrE,MAAI,UAA8B,EAAE,QAAQ,WAAW,SAAS,MAAM,KAAA;AACtE,QAAM,4CAA4B,IAAA;AAClC,QAAM,uCAAuB,IAAA;AAC7B,MAAI,gBAAyD,CAAA;AAE7D,SAAO;AAAA,IACL,eAAe,OAAuB;AACpC,iBAAW,YAAY,CAAC,GAAG,qBAAqB,YAAY,KAAK;AAAA,IACnE;AAAA,IAEA,kBAAoC;AAClC,UAAI,UAAU,OAAO,EAAG,QAAO,QAAQ,QAAQ,QAAQ,WAAW,WAAW,aAAa;AAC1F,aAAO,IAAI,QAAQ,CAAC,YAAY,cAAc,KAAK,OAAO,CAAC;AAAA,IAC7D;AAAA,IAEA,YAAY,MAAM;AAAA,IAElB,eAAe,MAAgC;AAC7C,gBAAU;AACV,iBAAW,YAAY,CAAC,GAAG,gBAAgB,YAAY,IAAI;AAC3D,UAAI,CAAC,UAAU,IAAI,EAAG;AACtB,YAAM,UAAU;AAChB,sBAAgB,CAAA;AAChB,YAAM,gBAAgB,KAAK,WAAW,WAAW;AACjD,iBAAW,UAAU,QAAS,QAAO,aAAa;AAAA,IACpD;AAAA,IAEA,sBAAsB,UAA4C;AAChE,4BAAsB,IAAI,QAAQ;AAClC,aAAO,MAAM,sBAAsB,OAAO,QAAQ;AAAA,IACpD;AAAA,IAEA,iBAAiB,UAA8C;AAC7D,uBAAiB,IAAI,QAAQ;AAC7B,aAAO,MAAM,iBAAiB,OAAO,QAAQ;AAAA,IAC/C;AAAA,EAAA;AAEJ;AC5CO,SAAS,qBACd,SACmC;AACnC,QAAM,EAAE,QAAQ,SAAS,oBAAoB,cAAc,0BAA0B,aAAa,WAAW;AAE7G,QAAM,WAA8C;AAAA,IAClD,MAAM,YAAY,SAAoD;AACpE,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,OAAO,IAAW,QAAQ,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAA,IAAW,MAAS;AAAA,MAChG,SAAS,OAAO;AAGd,YAAI,iBAAiB,YAAY,MAAM,WAAW,IAAK,QAAO;AAC9D,cAAM;AAAA,MACR;AACA,UAAI,QAAQ,KAAM,QAAO;AACzB,aAAO,cAAc,IAAI,IAAI,OAAO;AAAA,IACtC;AAAA,IAEA,MAAM,QAAQ,SAA4C;AACxD,UAAI,gBAAgB,KAAM;AAC1B,YAAM,OAAO,KAAW,aAAa,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAA,IAAW,MAAS;AAAA,IAC9F;AAAA,EAAA;AAGF,MAAI,QAAQ;AACV,aAAS,SAAS,CAAC,OAAqB,YAAgC,OAAO,OAAO,EAAE,GAAG,SAAS,QAAQ;AAAA,EAC9G;AAEA,SAAO;AACT;AC1DO,SAAS,2BAAyC;AACvD,MAAI,QAAuB;AAC3B,SAAO;AAAA,IACL,KAAK,MAAM;AAAA,IACX,KAAK,CAAC,SAAS;AACb,cAAQ;AAAA,IACV;AAAA,EAAA;AAEJ;ACwBO,SAAS,qBACd,SACqC;AACrC,QAAM,UAAU,QAAQ,gBAAgB,yBAAA;AAExC,SAAO;AAAA,IACL,cAAc;AAAA,IACd,cAAc,MAAM,QAAQ,IAAA;AAAA,IAE5B,MAAM,YAAY,SAAoD;AACpE,YAAM,QAAQ,QAAQ,IAAA;AACtB,UAAI,SAAS,KAAM,QAAO;AAC1B,UAAI,CAAC,QAAQ,aAAa;AAGxB,gBAAQ,IAAI,IAAI;AAChB,eAAO;AAAA,MACT;AAEA,YAAM,OAAO,MAAM,QAAQ,YAAY,EAAE,GAAG,SAAS,OAAO;AAC5D,UAAI,QAAQ,KAAM,SAAQ,IAAI,IAAI;AAClC,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,OAAqB,SAA6C;AAC7E,YAAM,EAAE,OAAO,KAAA,IAAS,MAAM,QAAQ,aAAa,OAAO,OAAO;AACjE,cAAQ,IAAI,KAAK;AACjB,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,SAA4C;AACxD,UAAI;AACF,cAAM,QAAQ,UAAU,OAAO;AAAA,MACjC,UAAA;AACE,gBAAQ,IAAI,IAAI;AAAA,MAClB;AAAA,IACF;AAAA,IAEA,iBAAuB;AACrB,cAAQ,IAAI,IAAI;AAAA,IAClB;AAAA,EAAA;AAEJ;AC3DA,SAAS,cAAsB;AAC7B,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,SAAO,OAAO,SAAS,WAAW,OAAO,SAAS;AACpD;AAYO,SAAS,uBAA8B,SAAwF;AACpI,QAAM,EAAE,aAAa,yBAAyB,iBAAiB,aAAa,gBAAgB,UAAU,GAAG,cAAA,IAAkB;AAE3H,QAAM,OAAO,qBAAmC,aAAa;AAC7D,QAAM,WAAW,mBAAmB,CAAC,cAAsB,GAAG,UAAU,IAAI,cAAc,IAAI,mBAAmB,SAAS,CAAC;AAC3H,QAAM,aACJ,aACC,CAAC,QAAgB;AAIhB,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI,MAAM,oGAAoG;AAAA,IACtH;AACA,WAAO,SAAS,OAAO,GAAG;AAAA,EAC5B;AAEF,SAAO;AAAA;AAAA,IAEL,aAAa,KAAK;AAAA,IAClB,SAAS,KAAK;AAAA;AAAA,IAGd,OAAO,WAA0B;AAC/B,iBAAW,SAAS,aAAa,YAAA,CAAa,CAAC;AAAA,IACjD;AAAA,EAAA;AAEJ;"}

package/dist/chunks/Accept-BWpCXDmS.js

@@ -0,0 +1,35 @@
+function parseAcceptTokens(accept) {
+  if (accept === void 0 || accept === "") return [];
+  return accept.split(",").map((token) => token.trim().toLowerCase()).filter((token) => token.length > 0);
+}
+function tokenMatches(token, name, type) {
+  if (token.startsWith(".")) {
+    if (name === "") return "unverifiable";
+    return name.endsWith(token);
+  }
+  if (token.endsWith("/*")) return type.startsWith(token.slice(0, -1));
+  return type === token;
+}
+function matchesAccept(file, accept) {
+  const tokens = parseAcceptTokens(accept);
+  if (tokens.length === 0) return true;
+  const name = file.name.toLowerCase();
+  const type = file.type.toLowerCase();
+  return tokens.some((token) => tokenMatches(token, name, type) === true);
+}
+function matchesAcceptType(mimeType, accept, options) {
+  const tokens = parseAcceptTokens(accept);
+  if (tokens.length === 0) return true;
+  const allowUnverifiable = (options?.extensionTokens ?? "allow") === "allow";
+  const type = mimeType.toLowerCase();
+  return tokens.some((token) => {
+    const verdict = tokenMatches(token, "", type);
+    return verdict === "unverifiable" ? allowUnverifiable : verdict;
+  });
+}
+export {
+  matchesAcceptType as a,
+  matchesAccept as m,
+  parseAcceptTokens as p
+};
+//# sourceMappingURL=Accept-BWpCXDmS.js.map

package/dist/chunks/Accept-BWpCXDmS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Accept-BWpCXDmS.js","sources":["../../src/foundation/files/Accept.ts"],"sourcesContent":["// `accept`-attribute matching — the rule an `<input type=\"file\" accept=\"...\">` implies, applied in JS. An accept\n// string is a comma-separated list of extension tokens (`.png`), wildcard MIME tokens (`image/*`), and exact MIME\n// tokens (`application/pdf`). Two entry points because the browser exposes different information at different\n// moments: on drop / change a real `File` carries both name and type; at `dragenter` only the MIME type exists,\n// so extension tokens are unverifiable and the check is advisory.\n\n/** The subset of `File` accept-matching reads — lets a caller match a plain `{name, type}` without a real `File`. */\nexport interface FileLike {\n  /** The file name, including extension. */\n  readonly name: string;\n\n  /** The MIME type, possibly empty (browsers leave it blank for unknown types). */\n  readonly type: string;\n}\n\n/** Splits an `accept` string into normalized, lower-cased tokens. Returns `[]` for an absent or blank list. */\nexport function parseAcceptTokens(accept?: string): string[] {\n  if (accept === undefined || accept === '') return [];\n  return accept\n    .split(',')\n    .map((token) => token.trim().toLowerCase())\n    .filter((token) => token.length > 0);\n}\n\n/** Tests one already-normalized token against a name/type pair. `name` empty ⇒ extension tokens can't be judged. */\nfunction tokenMatches(token: string, name: string, type: string): boolean | 'unverifiable' {\n  if (token.startsWith('.')) {\n    if (name === '') return 'unverifiable';\n    return name.endsWith(token);\n  }\n  if (token.endsWith('/*')) return type.startsWith(token.slice(0, -1));\n  return type === token;\n}\n\n/**\n * Tests whether a file satisfies an `accept` list. An absent / blank / token-less list accepts everything.\n * Matching is case-insensitive: extension tokens compare against the file name, `type/*` against the MIME\n * prefix, and any other token against the exact MIME type.\n */\nexport function matchesAccept(file: FileLike, accept?: string): boolean {\n  const tokens = parseAcceptTokens(accept);\n  if (tokens.length === 0) return true;\n\n  const name = file.name.toLowerCase();\n  const type = file.type.toLowerCase();\n  return tokens.some((token) => tokenMatches(token, name, type) === true);\n}\n\n/** Tunes the advisory, type-only accept check. */\nexport interface MatchesAcceptTypeOptions {\n  /**\n   * How to treat extension tokens (`.png`) when no file name is available (a `dragenter`, where only the MIME\n   * type is exposed). `allow` (default) keeps the drag optimistic and defers the real verdict to the drop;\n   * `reject` fails closed.\n   */\n  readonly extensionTokens?: 'allow' | 'reject';\n}\n\n/**\n * Advisory accept check for the pre-drop phase, where only a MIME type is known (`DataTransferItem.type`).\n * Wildcard and exact MIME tokens are judged normally; extension tokens are unverifiable without a file name and\n * resolve per `extensionTokens` (default `allow`). Re-check with {@link matchesAccept} once the real `File` lands.\n */\nexport function matchesAcceptType(mimeType: string, accept?: string, options?: MatchesAcceptTypeOptions): boolean {\n  const tokens = parseAcceptTokens(accept);\n  if (tokens.length === 0) return true;\n\n  const allowUnverifiable = (options?.extensionTokens ?? 'allow') === 'allow';\n  const type = mimeType.toLowerCase();\n\n  return tokens.some((token) => {\n    const verdict = tokenMatches(token, '', type);\n    return verdict === 'unverifiable' ? allowUnverifiable : verdict;\n  });\n}\n"],"names":[],"mappings":"AAgBO,SAAS,kBAAkB,QAA2B;AAC3D,MAAI,WAAW,UAAa,WAAW,WAAW,CAAA;AAClD,SAAO,OACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAA,EAAO,YAAA,CAAa,EACzC,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACvC;AAGA,SAAS,aAAa,OAAe,MAAc,MAAwC;AACzF,MAAI,MAAM,WAAW,GAAG,GAAG;AACzB,QAAI,SAAS,GAAI,QAAO;AACxB,WAAO,KAAK,SAAS,KAAK;AAAA,EAC5B;AACA,MAAI,MAAM,SAAS,IAAI,EAAG,QAAO,KAAK,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC;AACnE,SAAO,SAAS;AAClB;AAOO,SAAS,cAAc,MAAgB,QAA0B;AACtE,QAAM,SAAS,kBAAkB,MAAM;AACvC,MAAI,OAAO,WAAW,EAAG,QAAO;AAEhC,QAAM,OAAO,KAAK,KAAK,YAAA;AACvB,QAAM,OAAO,KAAK,KAAK,YAAA;AACvB,SAAO,OAAO,KAAK,CAAC,UAAU,aAAa,OAAO,MAAM,IAAI,MAAM,IAAI;AACxE;AAiBO,SAAS,kBAAkB,UAAkB,QAAiB,SAA6C;AAChH,QAAM,SAAS,kBAAkB,MAAM;AACvC,MAAI,OAAO,WAAW,EAAG,QAAO;AAEhC,QAAM,qBAAqB,SAAS,mBAAmB,aAAa;AACpE,QAAM,OAAO,SAAS,YAAA;AAEtB,SAAO,OAAO,KAAK,CAAC,UAAU;AAC5B,UAAM,UAAU,aAAa,OAAO,IAAI,IAAI;AAC5C,WAAO,YAAY,iBAAiB,oBAAoB;AAAA,EAC1D,CAAC;AACH;"}

package/dist/chunks/Align-DqFtCY3a.js

@@ -0,0 +1,12 @@
+const Align = {
+  /** Refers to alignment at the logical start. */
+  Start: "start",
+  /** Refers to centered alignment. */
+  Center: "center",
+  /** Refers to alignment at the logical end. */
+  End: "end"
+};
+export {
+  Align as A
+};
+//# sourceMappingURL=Align-DqFtCY3a.js.map

package/dist/chunks/Align-DqFtCY3a.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Align-DqFtCY3a.js","sources":["../../src/foundation/utils/Align/Align.ts"],"sourcesContent":["/* Provides the shared simple alignment vocabulary (cluster / inline / dataGrid / timeline / descriptionList). */\n\n/** Defines the alignment of items along an axis. */\nexport const Align = {\n  /** Refers to alignment at the logical start. */\n  Start: 'start',\n  /** Refers to centered alignment. */\n  Center: 'center',\n  /** Refers to alignment at the logical end. */\n  End: 'end',\n} as const;\n\nexport type Align = (typeof Align)[keyof typeof Align];\n"],"names":[],"mappings":"AAGO,MAAM,QAAQ;AAAA;AAAA,EAEnB,OAAO;AAAA;AAAA,EAEP,QAAQ;AAAA;AAAA,EAER,KAAK;AACP;"}