@wow-two-beta/ui-vue 0.0.4 → 0.0.6

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../src/auth/AuthSession.ts","../../src/auth/AuthContext.ts","../../src/auth/AuthProvider.vue","../../src/auth/AuthBridge.ts","../../src/auth/CookieStrategy.ts","../../src/auth/TokenStorage.ts","../../src/auth/BearerStrategy.ts","../../src/auth/RedirectStrategy.ts"],"sourcesContent":["/** Defines the lifecycle phase of the app session state machine. */\nexport const AuthStatus = {\n  /** Refers to a session not yet examined — the provider mounted with `resolveOnMount: false` and no action has run yet. */\n  Unknown: 'unknown',\n  /** Refers to an in-flight me-resolve — render a splash/spinner, not the login gate. */\n  Resolving: 'resolving',\n  /** Refers to a settled, signed-in session carrying a user. */\n  Authenticated: 'authenticated',\n  /** Refers to a settled, signed-out session. */\n  Anonymous: 'anonymous',\n} as const;\n\nexport type AuthStatus = (typeof AuthStatus)[keyof typeof AuthStatus];\n\n/** Defines a snapshot of the session — `user` is non-null exactly when `status` is `authenticated`. */\nexport interface AuthSession<TUser = unknown> {\n  /** The current machine phase (`unknown → resolving → authenticated | anonymous`). */\n  readonly status: AuthStatus;\n\n  /** The signed-in user, or `null` outside `authenticated`. */\n  readonly user: TUser | null;\n}\n\n/** Defines the call context passed to strategy delegates — forward `signal` to the transport when present. */\nexport interface AuthResolveContext {\n  /** An optional cancellation signal for the underlying request. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * Defines the pluggable transport half of the session — how the current user is resolved,\n * established, and torn down. Ship shapes: `createCookieStrategy` (me-resolve over a cookie\n * session), `createBearerStrategy` (token storage + `getAuthToken` wiring), and\n * `createRedirectStrategy` (sign-in = full-page OAuth redirect). Any object matching this\n * contract works — write delegates directly for bespoke flows.\n */\nexport interface AuthStrategy<TUser = unknown, TSignInInput = unknown> {\n  /** Resolves the current user — `null` means signed out; a throw also settles anonymous (reported via the provider's `onResolveError`). */\n  resolveUser(context: AuthResolveContext): Promise<TUser | null>;\n\n  /** Establishes a session. Return the user to authenticate immediately; return `null`/`void` to leave state unchanged (redirect flows navigate away instead). */\n  signIn?(input: TSignInInput, context: AuthResolveContext): Promise<TUser | null | void> | TUser | null | void;\n\n  /** Tears the session down (server sign-out, token revoke) — local state flips to anonymous regardless of the outcome. */\n  signOut?(context: AuthResolveContext): Promise<void> | void;\n\n  /** Reacts to a bridged 401 (e.g. clears a stored bearer token) just before the session flips to anonymous. */\n  onUnauthorized?(): void;\n}\n","import { inject, type InjectionKey } from 'vue';\n\nimport type { AuthStatus } from './AuthSession';\n\n/**\n * Defines the session API exposed by {@link useAuth}.\n *\n * The four state members are REACTIVE PROPERTIES — native getters over the provider's session ref,\n * not snapshots. Read them (`auth.status`, `auth.user`) in a template, a `computed`, or a `watch`\n * and they re-evaluate on every transition. Destructuring (`const { user } = useAuth()`) takes a\n * one-time copy and will not update — bind to the object instead.\n *\n * Getters rather than a `reactive()` wrapper on purpose: `reactive()` would hand back a deep proxy\n * of `user`, so `auth.user !== theUserTheAppPassedIn` and identity checks would silently fail.\n */\nexport interface AuthApi<TUser = unknown, TSignInInput = unknown> {\n  /** The current machine phase (`unknown → resolving → authenticated | anonymous`). */\n  readonly status: AuthStatus;\n\n  /** The signed-in user, or `null` outside `authenticated`. */\n  readonly user: TUser | null;\n\n  /** Whether the session is settled and signed in. */\n  readonly isAuthenticated: boolean;\n\n  /** Whether the session has not settled yet (`unknown` or `resolving`) — render a splash, not the login gate. */\n  readonly isPending: boolean;\n\n  /** Runs the strategy's sign-in. Resolves the user when the exchange returns one (state → `authenticated`); resolves `null` when it doesn't (redirect flows navigate away). Exchange errors reject. */\n  signIn(input?: TSignInInput): Promise<TUser | null>;\n\n  /** Runs the strategy's sign-out — local state flips to `anonymous` regardless; a server-side failure still rejects. */\n  signOut(): Promise<void>;\n\n  /** Re-runs the me-resolve (through `resolving`); resolves the settled user, or `null`. */\n  refresh(): Promise<TUser | null>;\n\n  /** Applies an externally obtained user — e.g. a Google ID-token exchange completed by a button. `null` flips to `anonymous`. */\n  setUser(user: TUser | null): void;\n}\n\n/**\n * React's `createContext<AuthApi | null>(null)` becomes an `InjectionKey`. One untyped key backs\n * every generic instantiation; `useAuth<TUser>()` re-narrows, exactly as the React original did.\n *\n * Deliberately NOT re-exported from `index.ts` — the React original kept its context module-private,\n * and the barrel shape is preserved.\n */\nexport const AuthKey: InjectionKey<AuthApi<unknown, unknown>> = Symbol('wow-two.auth');\n\n/** Accesses the session API. Must be used within an {@link AuthProvider}; `TUser` re-narrows the provider's generic. */\nexport function useAuth<TUser = unknown, TSignInInput = unknown>(): AuthApi<TUser, TSignInInput> {\n  const context = inject(AuthKey, null);\n  if (context === null) throw new Error('useAuth must be used within an AuthProvider.');\n  return context as AuthApi<TUser, TSignInInput>;\n}\n","<script lang=\"ts\">\nimport type { AuthBridge } from './AuthBridge';\nimport { AuthStatus, type AuthSession, type AuthStrategy } from './AuthSession';\n\nconst AnonymousSession = { status: AuthStatus.Anonymous, user: null } as const;\n\n/** Defines the props for {@link AuthProvider}. */\nexport interface AuthProviderProps<TUser = unknown, TSignInInput = unknown> {\n  /** The transport strategy (cookie / bearer / redirect factory, or bespoke delegates). Read live on every call, so swapping it takes effect immediately — it does not re-resolve on its own. */\n  strategy: AuthStrategy<TUser, TSignInInput>;\n\n  /** The module-scope bridge wiring the non-Vue seams — api-client 401s flip this session; router guards read it. */\n  bridge?: AuthBridge<TUser>;\n\n  /** Whether to run the me-resolve on mount. Default `true`; with `false` the session stays `unknown` until `refresh()` or an action settles it. */\n  resolveOnMount?: boolean;\n\n  /** Fires after a bridged 401 flips the session to `anonymous` — wire redirect-to-login here. */\n  onUnauthorized?: (error?: unknown) => void;\n\n  /** Fires when the me-resolve throws (network / 5xx) — the session still settles `anonymous`. */\n  onResolveError?: (error: unknown) => void;\n\n  /** Fires on every session snapshot, including the initial `unknown`. */\n  onSessionChange?: (session: AuthSession<TUser>) => void;\n}\n</script>\n\n<script setup lang=\"ts\" generic=\"TUser = unknown, TSignInInput = unknown\">\nimport { onMounted, provide, shallowRef, watch } from 'vue';\n\n// `AuthStatus` / `AuthSession` are already imported by the plain `<script>` block above — the two\n// blocks compile into ONE module, so importing them again here is a duplicate identifier.\nimport { AuthKey, type AuthApi } from './AuthContext';\n\n/**\n * Owns the app session state machine (`unknown → resolving → authenticated | anonymous`) —\n * me-resolve on mount (deduped, never aborted mid-flight), `signIn`/`signOut`/`refresh`/`setUser`\n * actions, and optional `AuthBridge` wiring so api-client 401s flip the session and router guards\n * can await it. Headless: gates, splash screens, and login UI stay app-side.\n *\n * ```vue\n * <AuthProvider :strategy=\"strategy\" :bridge=\"bridge\">\n *   <App />\n * </AuthProvider>\n * ```\n *\n * Renders no element of its own — the slot passes straight through.\n */\ndefineOptions({ name: 'AuthProvider' });\n\nconst props = withDefaults(defineProps<AuthProviderProps<TUser, TSignInInput>>(), {\n  bridge: undefined,\n  resolveOnMount: true,\n  onUnauthorized: undefined,\n  onResolveError: undefined,\n  onSessionChange: undefined,\n});\n\nconst session = shallowRef<AuthSession<TUser>>({ status: AuthStatus.Unknown, user: null });\n\n// React needed the latest-ref pattern here — four `useRef`s reassigned every render — so its\n// `useCallback` delegates could read fresh props without re-creating. Vue's `props` is already a\n// live reactive object, so reading `props.strategy` / `props.onResolveError` at call time IS the\n// latest-ref pattern, and the whole bookkeeping block collapses to nothing.\n\n// Guards async completions: every explicit transition bumps the generation, so a stale resolve\n// settling later cannot overwrite it. Plain locals — never rendered, so reactivity would be waste.\nlet generation = 0;\nlet inflight: Promise<TUser | null> | null = null;\n\n// Publish every snapshot outward — bridge first (guards may be awaiting), then the app callback.\n// `immediate` publishes the initial `unknown`, which React's mount effect also did. SSR-safe: both\n// sinks are plain callbacks over a Set, with no browser global in reach.\nwatch(\n  [session, () => props.bridge],\n  ([current, bridge]) => {\n    bridge?.publishSession(current);\n    props.onSessionChange?.(current);\n  },\n  { immediate: true },\n);\n\nfunction runResolve(): Promise<TUser | null> {\n  // Shared in-flight promise: a remount and concurrent `refresh()` calls ride one me-request\n  // instead of racing duplicates (the drydock dedupe, per-provider).\n  if (inflight) return inflight;\n\n  const current = ++generation;\n  session.value = { status: AuthStatus.Resolving, user: null };\n\n  const promise = (async (): Promise<TUser | null> => {\n    let user: TUser | null;\n    try {\n      user = await props.strategy.resolveUser({});\n    } catch (error) {\n      user = null;\n      props.onResolveError?.(error);\n    }\n    if (generation === current) {\n      session.value = user == null ? AnonymousSession : { status: AuthStatus.Authenticated, user };\n    }\n    return user;\n  })().finally(() => {\n    if (inflight === promise) inflight = null;\n  });\n\n  inflight = promise;\n  return promise;\n}\n\n// `onMounted` never runs on the server, which is exactly what the me-resolve needs: it is a network\n// call, and a `watch(…, { immediate: true })` here would fire it during SSR.\nonMounted(() => {\n  if (props.resolveOnMount) void runResolve();\n});\n\n// React's mount effect also re-ran when `resolveOnMount` flipped; a non-immediate watcher mirrors\n// that, and cannot double-fire at mount the way an immediate one would.\nwatch(\n  () => props.resolveOnMount,\n  (enabled) => {\n    if (enabled) void runResolve();\n  },\n);\n\n// Bridged 401 → strategy cleanup (bearer drops its token) → anonymous → app callback.\nwatch(\n  () => props.bridge,\n  (bridge, _previous, onCleanup) => {\n    if (!bridge) return;\n    onCleanup(\n      bridge.subscribeUnauthorized((error) => {\n        props.strategy.onUnauthorized?.();\n        generation += 1;\n        inflight = null;\n        session.value = AnonymousSession;\n        props.onUnauthorized?.(error);\n      }),\n    );\n  },\n  { immediate: true },\n);\n\nasync function signIn(input?: TSignInInput): Promise<TUser | null> {\n  const doSignIn = props.strategy.signIn;\n  if (!doSignIn) throw new Error('AuthProvider: the configured strategy does not implement signIn.');\n  const user = (await doSignIn(input as TSignInInput, {})) ?? null;\n  if (user === null) return null; // no user handed back (redirect navigating away) → state unchanged\n  generation += 1;\n  inflight = null;\n  session.value = { status: AuthStatus.Authenticated, user };\n  return user;\n}\n\nasync function signOut(): Promise<void> {\n  generation += 1;\n  inflight = null;\n  try {\n    await props.strategy.signOut?.({});\n  } finally {\n    session.value = AnonymousSession; // local sign-out always lands, even when the server call fails\n  }\n}\n\nfunction setUser(user: TUser | null): void {\n  generation += 1;\n  inflight = null;\n  session.value = user == null ? AnonymousSession : { status: AuthStatus.Authenticated, user };\n}\n\n// React rebuilt this object through `useMemo` on every session change so consumers saw fresh\n// values. Native getters over the `session` ref do it without rebuilding: each read tracks the ref,\n// so a template binding or a `computed` re-evaluates on transition. See `AuthApi` for why these are\n// getters rather than a `reactive()` wrapper — a proxy would break `user`'s identity.\nconst api: AuthApi<TUser, TSignInInput> = {\n  get status() {\n    return session.value.status;\n  },\n  get user() {\n    return session.value.user;\n  },\n  get isAuthenticated() {\n    return session.value.status === AuthStatus.Authenticated;\n  },\n  get isPending() {\n    return session.value.status === AuthStatus.Unknown || session.value.status === AuthStatus.Resolving;\n  },\n  signIn,\n  signOut,\n  refresh: runResolve,\n  setUser,\n};\n\nprovide(AuthKey, api as AuthApi<unknown, unknown>);\n</script>\n\n<template>\n  <slot />\n</template>\n","import { AuthStatus, type AuthSession } from './AuthSession';\n\n/** Defines a listener notified when a bridged 401 arrives. */\nexport type UnauthorizedListener = (error?: unknown) => void;\n\n/** Defines a listener notified on every published session snapshot. */\nexport type SessionListener<TUser = unknown> = (session: AuthSession<TUser>) => void;\n\n/**\n * Defines the module-scope hub wiring the Vue session to the non-Vue seams. Create it once\n * next to the api client and feed both ends:\n *\n * - **401s in** — `createApiClient({ onUnauthorized: bridge.onUnauthorized })`; the mounted\n *   `AuthProvider` subscribes and flips the session to anonymous.\n * - **Guards out** — `requireAuth(bridge.isAuthenticated)` (`/router`); the check waits for the\n *   in-flight me-resolve to settle before allowing or redirecting.\n */\nexport interface AuthBridge<TUser = unknown> {\n  /** Fires the 401 signal — pass as the api client's `onUnauthorized`; safe to call with no provider mounted (no-op). */\n  onUnauthorized(error?: unknown): void;\n\n  /** Resolves whether the session is authenticated, waiting for an unsettled session to settle — matches the router guard's `isAuthenticated` callback shape. */\n  isAuthenticated(): Promise<boolean>;\n\n  /** Reads the latest published session snapshot (`unknown` until a provider publishes). */\n  getSession(): AuthSession<TUser>;\n\n  /** Publishes a session snapshot — called by `AuthProvider` on every transition; call manually only in custom (non-provider) integrations. */\n  publishSession(session: AuthSession<TUser>): void;\n\n  /** Subscribes to bridged 401s — used by `AuthProvider`; returns an unsubscribe. */\n  subscribeUnauthorized(listener: UnauthorizedListener): () => void;\n\n  /** Subscribes to published session snapshots; returns an unsubscribe. */\n  subscribeSession(listener: SessionListener<TUser>): () => void;\n}\n\n/** Checks whether a session has left the pending phases. */\nfunction isSettled(session: AuthSession<unknown>): boolean {\n  return session.status === AuthStatus.Authenticated || session.status === AuthStatus.Anonymous;\n}\n\n/** Creates an {@link AuthBridge} — one per app, module scope, shared by the api client, the router guards, and the `AuthProvider`. */\nexport function createAuthBridge<TUser = unknown>(): AuthBridge<TUser> {\n  let session: AuthSession<TUser> = { status: AuthStatus.Unknown, user: null };\n  const unauthorizedListeners = new Set<UnauthorizedListener>();\n  const sessionListeners = new Set<SessionListener<TUser>>();\n  let settleWaiters: Array<(authenticated: boolean) => void> = [];\n\n  return {\n    onUnauthorized(error?: unknown): void {\n      for (const listener of [...unauthorizedListeners]) listener(error);\n    },\n\n    isAuthenticated(): Promise<boolean> {\n      if (isSettled(session)) return Promise.resolve(session.status === AuthStatus.Authenticated);\n      return new Promise((resolve) => settleWaiters.push(resolve));\n    },\n\n    getSession: () => session,\n\n    publishSession(next: AuthSession<TUser>): void {\n      session = next;\n      for (const listener of [...sessionListeners]) listener(next);\n      if (!isSettled(next)) return;\n      const waiters = settleWaiters;\n      settleWaiters = [];\n      const authenticated = next.status === AuthStatus.Authenticated;\n      for (const waiter of waiters) waiter(authenticated);\n    },\n\n    subscribeUnauthorized(listener: UnauthorizedListener): () => void {\n      unauthorizedListeners.add(listener);\n      return () => unauthorizedListeners.delete(listener);\n    },\n\n    subscribeSession(listener: SessionListener<TUser>): () => void {\n      sessionListeners.add(listener);\n      return () => sessionListeners.delete(listener);\n    },\n  };\n}\n","import { ApiError, type ApiClient } from '../foundation/http';\n\nimport type { AuthResolveContext, AuthStrategy } from './AuthSession';\n\n/** Defines the slice of the SDK `ApiClient` the cookie strategy calls — any object with `get`/`post` fits (fakes included). */\nexport type CookieAuthClient = Pick<ApiClient, 'get' | 'post'>;\n\n/** Defines the context passed to a cookie strategy's custom `signIn` delegate. */\nexport interface CookieSignInContext extends AuthResolveContext {\n  /** The strategy's HTTP client — call sign-in endpoints (guest creation, credential/ID-token exchange) through it. */\n  readonly client: CookieAuthClient;\n}\n\n/** Defines the options for {@link createCookieStrategy}. */\nexport interface CreateCookieStrategyOptions<TUser, TSignInInput = unknown> {\n  /** The HTTP client the strategy calls — the app's `createApiClient` (same-origin, or `credentials: 'include'` cross-origin). */\n  readonly client: CookieAuthClient;\n\n  /** The me-resolve endpoint (GET). Default `/api/identity/me` — the backend SDK identity baseline. */\n  readonly mePath?: string;\n\n  /** The sign-out endpoint (POST). Default `/api/identity/sign-out`; pass `null` to skip the server call and clear locally only. */\n  readonly signOutPath?: string | null;\n\n  /** Treats a 200 me-response as signed out (e.g. smart-qr's `kind === 'anonymous'` guest gate). Default: every resolved user counts as authenticated. */\n  readonly isAnonymous?: (user: TUser) => boolean;\n\n  /** A custom sign-in exchange (guest creation, password post, Google ID-token swap) — return the user to authenticate immediately. */\n  readonly signIn?: (input: TSignInInput, context: CookieSignInContext) => Promise<TUser | null | void> | TUser | null | void;\n}\n\n/**\n * Creates the cookie-session strategy — the session cookie is owned by the backend; the client\n * only resolves `GET {mePath}` on mount (401 → anonymous, other failures settle anonymous and are\n * reported) and posts `{signOutPath}` on sign-out. Covers the drydock and smart-qr shapes; pair\n * with `isAnonymous`/`signIn` for guest gates, or use `createRedirectStrategy` for OAuth sign-in.\n */\nexport function createCookieStrategy<TUser, TSignInInput = unknown>(\n  options: CreateCookieStrategyOptions<TUser, TSignInInput>,\n): AuthStrategy<TUser, TSignInInput> {\n  const { client, mePath = '/api/identity/me', signOutPath = '/api/identity/sign-out', isAnonymous, signIn } = options;\n\n  const strategy: AuthStrategy<TUser, TSignInInput> = {\n    async resolveUser(context: AuthResolveContext): Promise<TUser | null> {\n      let user: TUser | undefined;\n      try {\n        user = await client.get<TUser>(mePath, context.signal ? { signal: context.signal } : undefined);\n      } catch (error) {\n        // 401 = simply signed out — not a failure. Anything else propagates: the provider settles\n        // anonymous and reports it via `onResolveError` (the drydock/smart-qr posture).\n        if (error instanceof ApiError && error.status === 401) return null;\n        throw error;\n      }\n      if (user == null) return null;\n      return isAnonymous?.(user) ? null : user;\n    },\n\n    async signOut(context: AuthResolveContext): Promise<void> {\n      if (signOutPath === null) return;\n      await client.post<void>(signOutPath, context.signal ? { signal: context.signal } : undefined);\n    },\n  };\n\n  if (signIn) {\n    strategy.signIn = (input: TSignInInput, context: AuthResolveContext) => signIn(input, { ...context, client });\n  }\n\n  return strategy;\n}\n","/** Defines where a bearer strategy keeps its token — implement over `localStorage`/`StorageBroker` when a session must survive reloads. */\nexport interface TokenStorage {\n  /** Reads the stored token, or `null` when signed out. */\n  get(): string | null;\n\n  /** Stores a new token, or clears it with `null`. */\n  set(token: string | null): void;\n}\n\n/** Creates the default in-memory token storage — deliberately never persisted, so a reload requires re-login (keeps the token off disk). */\nexport function createMemoryTokenStorage(): TokenStorage {\n  let token: string | null = null;\n  return {\n    get: () => token,\n    set: (next) => {\n      token = next;\n    },\n  };\n}\n","import type { AuthResolveContext, AuthStrategy } from './AuthSession';\nimport { createMemoryTokenStorage, type TokenStorage } from './TokenStorage';\n\n/** Defines the outcome of a bearer credential exchange. */\nexport interface BearerAuthenticateResult<TUser> {\n  /** The bearer token stored and sent on subsequent requests. */\n  readonly token: string;\n\n  /** The signed-in user the session becomes. */\n  readonly user: TUser;\n}\n\n/** Defines the options for {@link createBearerStrategy}. */\nexport interface CreateBearerStrategyOptions<TUser, TSignInInput = unknown> {\n  /** Exchanges credentials for a token + user (e.g. `POST` a password) — a throw propagates to the `signIn` caller (show it on the form). */\n  readonly authenticate: (input: TSignInInput, context: AuthResolveContext) => Promise<BearerAuthenticateResult<TUser>>;\n\n  /** Where the token lives. Default `createMemoryTokenStorage()` — never persisted, a reload requires re-login (the secrets-vault posture). */\n  readonly tokenStorage?: TokenStorage;\n\n  /** Restores the user behind a persisted token (me-resolve with the token). Without it, a token found on mount is discarded — sessions restore only when the user can be rebuilt. */\n  readonly resolveUser?: (context: AuthResolveContext & { readonly token: string }) => Promise<TUser | null>;\n\n  /** An optional server-side revoke called on sign-out — the token clears locally regardless of the outcome. */\n  readonly signOut?: (context: AuthResolveContext) => Promise<void> | void;\n}\n\n/** Defines the bearer strategy — an {@link AuthStrategy} plus the `getAuthToken` reader that feeds the api client. */\nexport interface BearerStrategy<TUser, TSignInInput = unknown> extends AuthStrategy<TUser, TSignInInput> {\n  /** Feeds `createApiClient({ getAuthToken })` — re-read on every request, so headers always reflect the live session. */\n  readonly getAuthToken: () => string | null;\n\n  /** The storage behind the strategy — exposed for tests and advanced wiring. */\n  readonly tokenStorage: TokenStorage;\n}\n\n/**\n * Creates the bearer-token strategy — the token lives in a {@link TokenStorage} delegate\n * (in-memory by default), `signIn` runs the credential exchange, and a bridged 401 clears the\n * token before the session flips to anonymous. Wire the api client with the returned\n * `getAuthToken`. Covers the secrets-vault shape.\n */\nexport function createBearerStrategy<TUser, TSignInInput = unknown>(\n  options: CreateBearerStrategyOptions<TUser, TSignInInput>,\n): BearerStrategy<TUser, TSignInInput> {\n  const storage = options.tokenStorage ?? createMemoryTokenStorage();\n\n  return {\n    tokenStorage: storage,\n    getAuthToken: () => storage.get(),\n\n    async resolveUser(context: AuthResolveContext): Promise<TUser | null> {\n      const token = storage.get();\n      if (token == null) return null;\n      if (!options.resolveUser) {\n        // A token we cannot turn back into a user is dead weight — drop it so the api client\n        // stops sending a header the session no longer stands behind.\n        storage.set(null);\n        return null;\n      }\n      // A throw keeps the token (transient failure ≠ revoked session); a `null` result clears it.\n      const user = await options.resolveUser({ ...context, token });\n      if (user == null) storage.set(null);\n      return user;\n    },\n\n    async signIn(input: TSignInInput, context: AuthResolveContext): Promise<TUser> {\n      const { token, user } = await options.authenticate(input, context);\n      storage.set(token);\n      return user;\n    },\n\n    async signOut(context: AuthResolveContext): Promise<void> {\n      try {\n        await options.signOut?.(context);\n      } finally {\n        storage.set(null);\n      }\n    },\n\n    onUnauthorized(): void {\n      storage.set(null);\n    },\n  };\n}\n","import type { AuthStrategy } from './AuthSession';\nimport { createCookieStrategy, type CreateCookieStrategyOptions } from './CookieStrategy';\n\n/** Defines the options for {@link createRedirectStrategy}. */\nexport interface CreateRedirectStrategyOptions<TUser> extends Omit<CreateCookieStrategyOptions<TUser, never>, 'signIn'> {\n  /** The sign-in challenge endpoint the browser navigates to. Default `/api/identity/sign-in` — the backend SDK identity baseline. */\n  readonly signInPath?: string;\n\n  /** The query param carrying the post-login return path. Default `returnUrl` (the drydock shape). */\n  readonly returnUrlParam?: string;\n\n  /** Builds the full challenge URL from the return path — overrides `signInPath` + `returnUrlParam` entirely. */\n  readonly buildSignInUrl?: (returnUrl: string) => string;\n\n  /** Performs the navigation. Default `window.location.assign` — injectable for tests, and the seam that keeps this strategy testable without a DOM. */\n  readonly navigate?: (url: string) => void;\n}\n\n/**\n * Reads the current location as the default return path.\n *\n * SSR-safe: `createRedirectStrategy` is built at module scope in an app, so this module is imported\n * on the server. There is no location there, so a bare `/` stands in rather than letting\n * `window.location` throw a bare `ReferenceError`.\n */\nfunction currentPath(): string {\n  if (typeof window === 'undefined') return '/';\n  return window.location.pathname + window.location.search;\n}\n\n/**\n * Creates the external-redirect OAuth strategy — a cookie session whose `signIn(returnUrl?)`\n * navigates the browser to the backend's sign-in challenge (`{signInPath}?{returnUrlParam}=…`);\n * the OAuth callback is handled server-side, which sets the cookie and redirects back. `returnUrl`\n * defaults to the current `pathname + search`. Covers the drydock shape.\n *\n * Construction is SSR-safe — every browser global is read inside `signIn`, never at factory time —\n * but `signIn` itself is a browser-only operation, and says so with a real message instead of a\n * bare `ReferenceError` if it is ever reached on the server.\n */\nexport function createRedirectStrategy<TUser>(options: CreateRedirectStrategyOptions<TUser>): AuthStrategy<TUser, string | undefined> {\n  const { signInPath = '/api/identity/sign-in', returnUrlParam = 'returnUrl', buildSignInUrl, navigate, ...cookieOptions } = options;\n\n  const base = createCookieStrategy<TUser, never>(cookieOptions);\n  const buildUrl = buildSignInUrl ?? ((returnUrl: string) => `${signInPath}?${returnUrlParam}=${encodeURIComponent(returnUrl)}`);\n  const doNavigate =\n    navigate ??\n    ((url: string) => {\n      // A full-page redirect needs a browser. Reaching this on the server means `signIn` was called\n      // from a render rather than a user action — fail loudly, since silently dropping a sign-in\n      // leaves the session stuck with no signal at all. Pass `navigate` to drive it in a test.\n      if (typeof window === 'undefined') {\n        throw new Error('createRedirectStrategy: signIn needs a browser to navigate. Pass `navigate` to drive it elsewhere.');\n      }\n      window.location.assign(url);\n    });\n\n  return {\n    // Closure-based delegates off the cookie strategy — no `this`, safe to re-home.\n    resolveUser: base.resolveUser,\n    signOut: base.signOut,\n\n    // Returns void on purpose: the session state stays as-is while the browser navigates away.\n    signIn(returnUrl?: string): void {\n      doNavigate(buildUrl(returnUrl ?? currentPath()));\n    },\n  };\n}\n"],"names":["_renderSlot"],"mappings":";;AACO,MAAM,aAAa;AAAA;AAAA,EAExB,SAAS;AAAA;AAAA,EAET,WAAW;AAAA;AAAA,EAEX,eAAe;AAAA;AAAA,EAEf,WAAW;AACb;ACsCO,MAAM,UAAmD,OAAO,cAAc;AAG9E,SAAS,UAAiF;AAC/F,QAAM,UAAU,OAAO,SAAS,IAAI;AACpC,MAAI,YAAY,KAAM,OAAM,IAAI,MAAM,8CAA8C;AACpF,SAAO;AACT;ACnDA,MAAM,mBAAmB,EAAE,QAAQ,WAAW,WAAW,MAAM,KAAA;;;;;;;;;;;;;AA+C/D,UAAM,QAAQ;AAQd,UAAM,UAAU,WAA+B,EAAE,QAAQ,WAAW,SAAS,MAAM,MAAM;AASzF,QAAI,aAAa;AACjB,QAAI,WAAyC;AAK7C;AAAA,MACE,CAAC,SAAS,MAAM,MAAM,MAAM;AAAA,MAC5B,CAAC,CAAC,SAAS,MAAM,MAAM;AACrB,gBAAQ,eAAe,OAAO;AAC9B,cAAM,kBAAkB,OAAO;AAAA,MACjC;AAAA,MACA,EAAE,WAAW,KAAA;AAAA,IAAK;AAGpB,aAAS,aAAoC;AAG3C,UAAI,SAAU,QAAO;AAErB,YAAM,UAAU,EAAE;AAClB,cAAQ,QAAQ,EAAE,QAAQ,WAAW,WAAW,MAAM,KAAA;AAEtD,YAAM,WAAW,YAAmC;AAClD,YAAI;AACJ,YAAI;AACF,iBAAO,MAAM,MAAM,SAAS,YAAY,CAAA,CAAE;AAAA,QAC5C,SAAS,OAAO;AACd,iBAAO;AACP,gBAAM,iBAAiB,KAAK;AAAA,QAC9B;AACA,YAAI,eAAe,SAAS;AAC1B,kBAAQ,QAAQ,QAAQ,OAAO,mBAAmB,EAAE,QAAQ,WAAW,eAAe,KAAA;AAAA,QACxF;AACA,eAAO;AAAA,MACT,GAAA,EAAK,QAAQ,MAAM;AACjB,YAAI,aAAa,QAAS,YAAW;AAAA,MACvC,CAAC;AAED,iBAAW;AACX,aAAO;AAAA,IACT;AAIA,cAAU,MAAM;AACd,UAAI,MAAM,eAAgB,MAAK,WAAA;AAAA,IACjC,CAAC;AAID;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,CAAC,YAAY;AACX,YAAI,cAAc,WAAA;AAAA,MACpB;AAAA,IAAA;AAIF;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,CAAC,QAAQ,WAAW,cAAc;AAChC,YAAI,CAAC,OAAQ;AACb;AAAA,UACE,OAAO,sBAAsB,CAAC,UAAU;AACtC,kBAAM,SAAS,iBAAA;AACf,0BAAc;AACd,uBAAW;AACX,oBAAQ,QAAQ;AAChB,kBAAM,iBAAiB,KAAK;AAAA,UAC9B,CAAC;AAAA,QAAA;AAAA,MAEL;AAAA,MACA,EAAE,WAAW,KAAA;AAAA,IAAK;AAGpB,mBAAe,OAAO,OAA6C;AACjE,YAAM,WAAW,MAAM,SAAS;AAChC,UAAI,CAAC,SAAU,OAAM,IAAI,MAAM,kEAAkE;AACjG,YAAM,OAAQ,MAAM,SAAS,OAAuB,CAAA,CAAE,KAAM;AAC5D,UAAI,SAAS,KAAM,QAAO;AAC1B,oBAAc;AACd,iBAAW;AACX,cAAQ,QAAQ,EAAE,QAAQ,WAAW,eAAe,KAAA;AACpD,aAAO;AAAA,IACT;AAEA,mBAAe,UAAyB;AACtC,oBAAc;AACd,iBAAW;AACX,UAAI;AACF,cAAM,MAAM,SAAS,UAAU,EAAE;AAAA,MACnC,UAAA;AACE,gBAAQ,QAAQ;AAAA,MAClB;AAAA,IACF;AAEA,aAAS,QAAQ,MAA0B;AACzC,oBAAc;AACd,iBAAW;AACX,cAAQ,QAAQ,QAAQ,OAAO,mBAAmB,EAAE,QAAQ,WAAW,eAAe,KAAA;AAAA,IACxF;AAMA,UAAM,MAAoC;AAAA,MACxC,IAAI,SAAS;AACX,eAAO,QAAQ,MAAM;AAAA,MACvB;AAAA,MACA,IAAI,OAAO;AACT,eAAO,QAAQ,MAAM;AAAA,MACvB;AAAA,MACA,IAAI,kBAAkB;AACpB,eAAO,QAAQ,MAAM,WAAW,WAAW;AAAA,MAC7C;AAAA,MACA,IAAI,YAAY;AACd,eAAO,QAAQ,MAAM,WAAW,WAAW,WAAW,QAAQ,MAAM,WAAW,WAAW;AAAA,MAC5F;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IAAA;AAGF,YAAQ,SAAS,GAAgC;;aAI/CA,WAAQ,KAAA,QAAA,SAAA;AAAA;;;AChKV,SAAS,UAAU,SAAwC;AACzD,SAAO,QAAQ,WAAW,WAAW,iBAAiB,QAAQ,WAAW,WAAW;AACtF;AAGO,SAAS,mBAAuD;AACrE,MAAI,UAA8B,EAAE,QAAQ,WAAW,SAAS,MAAM,KAAA;AACtE,QAAM,4CAA4B,IAAA;AAClC,QAAM,uCAAuB,IAAA;AAC7B,MAAI,gBAAyD,CAAA;AAE7D,SAAO;AAAA,IACL,eAAe,OAAuB;AACpC,iBAAW,YAAY,CAAC,GAAG,qBAAqB,YAAY,KAAK;AAAA,IACnE;AAAA,IAEA,kBAAoC;AAClC,UAAI,UAAU,OAAO,EAAG,QAAO,QAAQ,QAAQ,QAAQ,WAAW,WAAW,aAAa;AAC1F,aAAO,IAAI,QAAQ,CAAC,YAAY,cAAc,KAAK,OAAO,CAAC;AAAA,IAC7D;AAAA,IAEA,YAAY,MAAM;AAAA,IAElB,eAAe,MAAgC;AAC7C,gBAAU;AACV,iBAAW,YAAY,CAAC,GAAG,gBAAgB,YAAY,IAAI;AAC3D,UAAI,CAAC,UAAU,IAAI,EAAG;AACtB,YAAM,UAAU;AAChB,sBAAgB,CAAA;AAChB,YAAM,gBAAgB,KAAK,WAAW,WAAW;AACjD,iBAAW,UAAU,QAAS,QAAO,aAAa;AAAA,IACpD;AAAA,IAEA,sBAAsB,UAA4C;AAChE,4BAAsB,IAAI,QAAQ;AAClC,aAAO,MAAM,sBAAsB,OAAO,QAAQ;AAAA,IACpD;AAAA,IAEA,iBAAiB,UAA8C;AAC7D,uBAAiB,IAAI,QAAQ;AAC7B,aAAO,MAAM,iBAAiB,OAAO,QAAQ;AAAA,IAC/C;AAAA,EAAA;AAEJ;AC5CO,SAAS,qBACd,SACmC;AACnC,QAAM,EAAE,QAAQ,SAAS,oBAAoB,cAAc,0BAA0B,aAAa,WAAW;AAE7G,QAAM,WAA8C;AAAA,IAClD,MAAM,YAAY,SAAoD;AACpE,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,OAAO,IAAW,QAAQ,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAA,IAAW,MAAS;AAAA,MAChG,SAAS,OAAO;AAGd,YAAI,iBAAiB,YAAY,MAAM,WAAW,IAAK,QAAO;AAC9D,cAAM;AAAA,MACR;AACA,UAAI,QAAQ,KAAM,QAAO;AACzB,aAAO,cAAc,IAAI,IAAI,OAAO;AAAA,IACtC;AAAA,IAEA,MAAM,QAAQ,SAA4C;AACxD,UAAI,gBAAgB,KAAM;AAC1B,YAAM,OAAO,KAAW,aAAa,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAA,IAAW,MAAS;AAAA,IAC9F;AAAA,EAAA;AAGF,MAAI,QAAQ;AACV,aAAS,SAAS,CAAC,OAAqB,YAAgC,OAAO,OAAO,EAAE,GAAG,SAAS,QAAQ;AAAA,EAC9G;AAEA,SAAO;AACT;AC1DO,SAAS,2BAAyC;AACvD,MAAI,QAAuB;AAC3B,SAAO;AAAA,IACL,KAAK,MAAM;AAAA,IACX,KAAK,CAAC,SAAS;AACb,cAAQ;AAAA,IACV;AAAA,EAAA;AAEJ;ACwBO,SAAS,qBACd,SACqC;AACrC,QAAM,UAAU,QAAQ,gBAAgB,yBAAA;AAExC,SAAO;AAAA,IACL,cAAc;AAAA,IACd,cAAc,MAAM,QAAQ,IAAA;AAAA,IAE5B,MAAM,YAAY,SAAoD;AACpE,YAAM,QAAQ,QAAQ,IAAA;AACtB,UAAI,SAAS,KAAM,QAAO;AAC1B,UAAI,CAAC,QAAQ,aAAa;AAGxB,gBAAQ,IAAI,IAAI;AAChB,eAAO;AAAA,MACT;AAEA,YAAM,OAAO,MAAM,QAAQ,YAAY,EAAE,GAAG,SAAS,OAAO;AAC5D,UAAI,QAAQ,KAAM,SAAQ,IAAI,IAAI;AAClC,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,OAAqB,SAA6C;AAC7E,YAAM,EAAE,OAAO,KAAA,IAAS,MAAM,QAAQ,aAAa,OAAO,OAAO;AACjE,cAAQ,IAAI,KAAK;AACjB,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,SAA4C;AACxD,UAAI;AACF,cAAM,QAAQ,UAAU,OAAO;AAAA,MACjC,UAAA;AACE,gBAAQ,IAAI,IAAI;AAAA,MAClB;AAAA,IACF;AAAA,IAEA,iBAAuB;AACrB,cAAQ,IAAI,IAAI;AAAA,IAClB;AAAA,EAAA;AAEJ;AC3DA,SAAS,cAAsB;AAC7B,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,SAAO,OAAO,SAAS,WAAW,OAAO,SAAS;AACpD;AAYO,SAAS,uBAA8B,SAAwF;AACpI,QAAM,EAAE,aAAa,yBAAyB,iBAAiB,aAAa,gBAAgB,UAAU,GAAG,cAAA,IAAkB;AAE3H,QAAM,OAAO,qBAAmC,aAAa;AAC7D,QAAM,WAAW,mBAAmB,CAAC,cAAsB,GAAG,UAAU,IAAI,cAAc,IAAI,mBAAmB,SAAS,CAAC;AAC3H,QAAM,aACJ,aACC,CAAC,QAAgB;AAIhB,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI,MAAM,oGAAoG;AAAA,IACtH;AACA,WAAO,SAAS,OAAO,GAAG;AAAA,EAC5B;AAEF,SAAO;AAAA;AAAA,IAEL,aAAa,KAAK;AAAA,IAClB,SAAS,KAAK;AAAA;AAAA,IAGd,OAAO,WAA0B;AAC/B,iBAAW,SAAS,aAAa,YAAA,CAAa,CAAC;AAAA,IACjD;AAAA,EAAA;AAEJ;"}
+{"version":3,"file":"index.js","sources":["../../src/auth/AuthSession.ts","../../src/auth/providers/AuthContext.ts","../../src/auth/providers/AuthProvider.vue","../../src/auth/AuthBridge.ts","../../src/auth/CookieStrategy.ts","../../src/auth/TokenStorage.ts","../../src/auth/BearerStrategy.ts","../../src/auth/RedirectStrategy.ts"],"sourcesContent":["import type { AppError, Result } from '../foundation/results';\n/** Defines the lifecycle phase of the app session state machine. */\nexport const AuthStatus = {\n  /** Refers to a session not yet examined — provider mounted with `resolveOnMount: false`, no action run yet. */\n  Unknown: 'unknown',\n  /** Refers to an in-flight me-resolve — render a splash/spinner, not the login gate. */\n  Resolving: 'resolving',\n  /** Refers to a settled, signed-in session carrying a user. */\n  Authenticated: 'authenticated',\n  /** Refers to a settled, signed-out session. */\n  Anonymous: 'anonymous',\n} as const;\n\nexport type AuthStatus = (typeof AuthStatus)[keyof typeof AuthStatus];\n\n/** Defines a snapshot of the session — `user` is non-null exactly when `status` is `authenticated`. */\nexport interface AuthSession<TUser = unknown> {\n  /** The current machine phase (`unknown → resolving → authenticated | anonymous`). */\n  readonly status: AuthStatus;\n\n  /** The signed-in user, or `null` outside `authenticated`. */\n  readonly user: TUser | null;\n}\n\n/** Defines the call context passed to strategy delegates — forward `signal` to the transport when present. */\nexport interface AuthResolveContext {\n  /** An optional cancellation signal for the underlying request. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * Defines the pluggable transport half of the session — how the current user is resolved,\n * established, and torn down. Ship shapes: `createCookieStrategy` (me-resolve over a cookie\n * session), `createBearerStrategy` (token storage + `getAuthToken` wiring), and\n * `createRedirectStrategy` (sign-in = full-page OAuth redirect). Any object matching this\n * contract works — write delegates directly for bespoke flows.\n */\nexport interface AuthStrategy<TUser = unknown, TSignInInput = unknown> {\n  /**\n   * Resolves the current user — a successful `null` means signed out; an expected failure settles anonymous\n   * (reported via the provider's `onResolveError`).\n   */\n  resolveUser(context: AuthResolveContext): Promise<Result<TUser | null, AppError>>;\n\n  /**\n   * Establishes a session. Return a successful user to authenticate immediately; return successful `null`/`void`\n   * to leave state unchanged (redirect flows navigate away instead).\n   */\n  signIn?(\n    input: TSignInInput,\n    context: AuthResolveContext,\n  ): Promise<Result<TUser | null | void, AppError>> | Result<TUser | null | void, AppError>;\n\n  /** Tears the session down (server sign-out, token revoke) — state flips to anonymous regardless. */\n  signOut?(context: AuthResolveContext): Promise<Result<void, AppError>> | Result<void, AppError>;\n\n  /** Reacts to a bridged 401 (e.g. clears a stored bearer token) just before the session flips to anonymous. */\n  onUnauthorized?(): void;\n}\n","import type { AppError, Result } from '../../foundation/results';\nimport { inject, type InjectionKey } from 'vue';\n\nimport type { AuthStatus } from '../AuthSession';\n\n/**\n * Defines the session API exposed by {@link useAuth}.\n *\n * The four state members are REACTIVE PROPERTIES — native getters over the provider's session ref,\n * not snapshots. Read them (`auth.status`, `auth.user`) in a template, a `computed`, or a `watch`\n * and they re-evaluate on every transition. Destructuring (`const { user } = useAuth()`) takes a\n * one-time copy and will not update — bind to the object instead.\n *\n * Getters rather than a `reactive()` wrapper on purpose: `reactive()` would hand back a deep proxy\n * of `user`, so `auth.user !== theUserTheAppPassedIn` and identity checks would silently fail.\n */\nexport interface AuthApi<TUser = unknown, TSignInInput = unknown> {\n  /** The current machine phase (`unknown → resolving → authenticated | anonymous`). */\n  readonly status: AuthStatus;\n\n  /** The signed-in user, or `null` outside `authenticated`. */\n  readonly user: TUser | null;\n\n  /** Whether the session is settled and signed in. */\n  readonly isAuthenticated: boolean;\n\n  /** Whether the session has not settled yet (`unknown` or `resolving`) — render a splash, not the login gate. */\n  readonly isPending: boolean;\n\n  /**\n   * Runs the strategy's sign-in. Resolves the user when the exchange returns one (state →\n   * `authenticated`), or `null` when it doesn't (redirect flows navigate away). Expected failures are returned.\n   */\n  signIn(input?: TSignInInput): Promise<Result<TUser | null, AppError>>;\n\n  /** Runs the strategy's sign-out — state flips to `anonymous` regardless; a server failure is returned. */\n  signOut(): Promise<Result<void, AppError>>;\n\n  /** Re-runs the me-resolve (through `resolving`); resolves the settled user, or `null`. */\n  refresh(): Promise<Result<TUser | null, AppError>>;\n\n  /** Applies an externally obtained user — e.g. a Google ID-token exchange. `null` flips to `anonymous`. */\n  setUser(user: TUser | null): void;\n}\n\n/**\n * One untyped `InjectionKey` backs every generic instantiation; `useAuth<TUser>()` re-narrows it.\n *\n * Deliberately NOT re-exported from `index.ts` — the context stays module-private.\n */\nexport const AuthKey: InjectionKey<AuthApi<unknown, unknown>> = Symbol('wow-two.auth');\n\n/** Accesses the session API. Must be used within an {@link AuthProvider}; `TUser` re-narrows the provider's generic. */\nexport function useAuth<TUser = unknown, TSignInInput = unknown>(): AuthApi<TUser, TSignInInput> {\n  const context = inject(AuthKey, null);\n  if (context === null) throw new Error('useAuth must be used within an AuthProvider.');\n  return context as AuthApi<TUser, TSignInInput>;\n}\n","<script lang=\"ts\">\nimport type { AuthBridge } from '../AuthBridge';\nimport { AuthStatus, type AuthSession, type AuthStrategy } from '../AuthSession';\n\nconst AnonymousSession = { status: AuthStatus.Anonymous, user: null } as const;\n\n/** Defines the props for {@link AuthProvider}. */\nexport interface AuthProviderProps<TUser = unknown, TSignInInput = unknown> {\n  /**\n   * The transport strategy (cookie / bearer / redirect factory, or bespoke delegates). Read live\n   * on every call, so a swap takes effect immediately — it does not re-resolve on its own.\n   */\n  readonly strategy: AuthStrategy<TUser, TSignInInput>;\n\n  /** The module-scope bridge wiring the non-Vue seams — api-client 401s flip this session; router guards read it. */\n  readonly bridge?: AuthBridge<TUser>;\n\n  /**\n   * Whether to run the me-resolve on mount. Default `true`; with `false` the session stays\n   * `unknown` until `refresh()` or an action settles it.\n   */\n  readonly resolveOnMount?: boolean;\n\n  /** Fires after a bridged 401 flips the session to `anonymous` — wire redirect-to-login here. */\n  readonly onUnauthorized?: (error?: unknown) => void;\n\n  /** Fires when the me-resolve returns an expected failure — the session still settles `anonymous`. */\n  readonly onResolveError?: (error: unknown) => void;\n\n  /** Fires on every session snapshot, including the initial `unknown`. */\n  readonly onSessionChange?: (session: AuthSession<TUser>) => void;\n}\n</script>\n\n<script setup lang=\"ts\" generic=\"TUser = unknown, TSignInInput = unknown\">\nimport { onMounted, onScopeDispose, provide, shallowRef, watch } from 'vue';\n\n// `AuthStatus` / `AuthSession` are already imported by the plain `<script>` block above — the two\n// blocks compile into ONE module, so importing them again here is a duplicate identifier.\nimport { AuthKey, type AuthApi } from './AuthContext';\nimport { AppErrorFactory, ResultExtensions, type AppError, type Result } from '../../foundation/results';\n\n/**\n * Renders no element of its own — the slot passes straight through — while owning the app session state\n * machine (`unknown → resolving → authenticated | anonymous`). Superseded requests are cancelled.\n * Sign-in/out/refresh actions and the optional AuthBridge connect transport failures to the session;\n * 401s flip the session and router guards can await it. Headless: gates, splash screens, and login UI stay\n * app-side.\n */\ndefineOptions({ name: 'AuthProvider' });\n\ndefineSlots<{\n  /** The subtree with access to the session — gates and login UI live here. */\n  default(): unknown;\n}>();\n\nconst props = withDefaults(defineProps<AuthProviderProps<TUser, TSignInInput>>(), {\n  bridge: undefined,\n  resolveOnMount: true,\n  onUnauthorized: undefined,\n  onResolveError: undefined,\n  onSessionChange: undefined,\n});\n\nconst session = shallowRef<AuthSession<TUser>>({ status: AuthStatus.Unknown, user: null });\n\nlet generation = 0;\nlet controller: AbortController | null = null;\nlet inflight: Promise<Result<TUser | null, AppError>> | null = null;\nlet disposed = false;\n\nfunction invalidate(): number {\n  generation += 1;\n  controller?.abort();\n  controller = null;\n  inflight = null;\n  return generation;\n}\nfunction begin(): { current: number; signal: AbortSignal } {\n  const current = invalidate();\n  controller = new AbortController();\n  return { current, signal: controller.signal };\n}\nfunction owns(current: number): boolean {\n  return !disposed && current === generation;\n}\nconst cancelled = (): Result<never, AppError> => ResultExtensions.fail(AppErrorFactory.cancelled());\n\nwatch(\n  [session, () => props.bridge],\n  ([current, bridge]) => {\n    bridge?.publishSession(current);\n    props.onSessionChange?.(current);\n  },\n  { immediate: true, flush: 'sync' },\n);\n\nfunction runResolve(): Promise<Result<TUser | null, AppError>> {\n  if (inflight) return inflight;\n  const { current, signal } = begin();\n  const strategy = props.strategy;\n  session.value = { status: AuthStatus.Resolving, user: null };\n  const promise = (async (): Promise<Result<TUser | null, AppError>> => {\n    try {\n      const outcome = await strategy.resolveUser({ signal });\n      if (!owns(current)) return cancelled();\n      session.value =\n        outcome.ok && outcome.value !== null\n          ? { status: AuthStatus.Authenticated, user: outcome.value }\n          : AnonymousSession;\n      if (!outcome.ok && outcome.failure.type !== 'cancelled') props.onResolveError?.(outcome.failure);\n      return outcome;\n    } catch (error) {\n      if (owns(current)) session.value = AnonymousSession;\n      throw error;\n    }\n  })().finally(() => {\n    if (inflight === promise) inflight = null;\n  });\n  inflight = promise;\n  return promise;\n}\nasync function resolveInitialSession(): Promise<void> {\n  if (props.resolveOnMount) await runResolve();\n}\nonMounted(resolveInitialSession);\nwatch(\n  () => props.resolveOnMount,\n  (enabled) => {\n    if (enabled) return resolveInitialSession();\n  },\n);\nwatch(\n  () => props.strategy,\n  () => {\n    invalidate();\n    session.value = { status: AuthStatus.Unknown, user: null };\n    return resolveInitialSession();\n  },\n  { flush: 'sync' },\n);\nonScopeDispose(() => {\n  disposed = true;\n  invalidate();\n});\nwatch(\n  () => props.bridge,\n  (bridge, _previous, onCleanup) => {\n    if (!bridge) return;\n    onCleanup(\n      bridge.subscribeUnauthorized((error) => {\n        invalidate();\n        try {\n          props.strategy.onUnauthorized?.();\n        } finally {\n          session.value = AnonymousSession;\n          props.onUnauthorized?.(error);\n        }\n      }),\n    );\n  },\n  { immediate: true },\n);\n\nasync function signIn(input?: TSignInInput): Promise<Result<TUser | null, AppError>> {\n  const strategy = props.strategy;\n  if (!strategy.signIn) return ResultExtensions.fail(AppErrorFactory.unavailable());\n  const { current, signal } = begin();\n  if (session.value.status === AuthStatus.Resolving) session.value = AnonymousSession;\n  const outcome = await strategy.signIn(input as TSignInInput, { signal });\n  if (!owns(current)) return cancelled();\n  if (!outcome.ok) return outcome;\n  const user = outcome.value ?? null;\n  if (user !== null) session.value = { status: AuthStatus.Authenticated, user };\n  return ResultExtensions.ok(user);\n}\nasync function signOut(): Promise<Result<void, AppError>> {\n  const strategy = props.strategy;\n  const { current, signal } = begin();\n  session.value = AnonymousSession;\n  try {\n    return (await strategy.signOut?.({ signal })) ?? ResultExtensions.ok(undefined);\n  } finally {\n    if (owns(current)) session.value = AnonymousSession;\n  }\n}\nfunction setUser(user: TUser | null): void {\n  invalidate();\n  session.value = user === null ? AnonymousSession : { status: AuthStatus.Authenticated, user };\n}\n\n// React rebuilt this object through `useMemo` on every session change so consumers saw fresh\n// values. Native getters over the `session` ref do it without rebuilding: each read tracks the ref,\n// so a template binding or a `computed` re-evaluates on transition. See `AuthApi` for why these are\n// getters rather than a `reactive()` wrapper — a proxy would break `user`'s identity.\nconst api: AuthApi<TUser, TSignInInput> = {\n  get status() {\n    return session.value.status;\n  },\n  get user() {\n    return session.value.user;\n  },\n  get isAuthenticated() {\n    return session.value.status === AuthStatus.Authenticated;\n  },\n  get isPending() {\n    return session.value.status === AuthStatus.Unknown || session.value.status === AuthStatus.Resolving;\n  },\n  signIn,\n  signOut,\n  refresh: runResolve,\n  setUser,\n};\n\nprovide(AuthKey, api as AuthApi<unknown, unknown>);\n</script>\n\n<template>\n  <slot />\n</template>\n","import { AuthStatus, type AuthSession } from './AuthSession';\n\n/** Defines a listener notified when a bridged 401 arrives. */\nexport type UnauthorizedListener = (error?: unknown) => void;\n\n/** Defines a listener notified on every published session snapshot. */\nexport type SessionListener<TUser = unknown> = (session: AuthSession<TUser>) => void;\n\n/**\n * Defines the module-scope hub wiring the Vue session to the non-Vue seams. Create it once\n * next to the api client and feed both ends:\n *\n * - **401s in** — `createApiClient({ onUnauthorized: bridge.onUnauthorized })`; the mounted\n *   `AuthProvider` subscribes and flips the session to anonymous.\n * - **Guards out** — `requireAuth(bridge.isAuthenticated)` (`/router`); the check waits for the\n *   in-flight me-resolve to settle before allowing or redirecting.\n */\nexport interface AuthBridge<TUser = unknown> {\n  /** Fires the 401 signal — pass as the api client's `onUnauthorized`; a no-op with no provider mounted. */\n  onUnauthorized(error?: unknown): void;\n\n  /** Resolves whether the session is authenticated, waiting for an unsettled session to settle. */\n  isAuthenticated(): Promise<boolean>;\n\n  /** Reads the latest published session snapshot (`unknown` until a provider publishes). */\n  getSession(): AuthSession<TUser>;\n\n  /** Publishes a session snapshot — `AuthProvider` publishes every transition; call it manually only without one. */\n  publishSession(session: AuthSession<TUser>): void;\n\n  /** Subscribes to bridged 401s — used by `AuthProvider`; returns an unsubscribe. */\n  subscribeUnauthorized(listener: UnauthorizedListener): () => void;\n\n  /** Subscribes to published session snapshots; returns an unsubscribe. */\n  subscribeSession(listener: SessionListener<TUser>): () => void;\n}\n\n/** Checks whether a session has left the pending phases. */\nfunction isSettled(session: AuthSession<unknown>): boolean {\n  return session.status === AuthStatus.Authenticated || session.status === AuthStatus.Anonymous;\n}\n\n/** Creates an {@link AuthBridge} — one per app, at module scope, shared by the api client, guards, and provider. */\nexport function createAuthBridge<TUser = unknown>(): AuthBridge<TUser> {\n  let session: AuthSession<TUser> = { status: AuthStatus.Unknown, user: null };\n  const unauthorizedListeners = new Set<UnauthorizedListener>();\n  const sessionListeners = new Set<SessionListener<TUser>>();\n  let settleWaiters: Array<(authenticated: boolean) => void> = [];\n\n  return {\n    onUnauthorized(error?: unknown): void {\n      const failures: unknown[] = [];\n      for (const listener of [...unauthorizedListeners]) {\n        try {\n          listener(error);\n        } catch (failure) {\n          failures.push(failure);\n        }\n      }\n      if (failures.length) throw new AggregateError(failures, 'An authentication listener failed.');\n    },\n\n    isAuthenticated(): Promise<boolean> {\n      if (isSettled(session)) return Promise.resolve(session.status === AuthStatus.Authenticated);\n      return new Promise((resolve) => settleWaiters.push(resolve));\n    },\n\n    getSession: () => session,\n\n    publishSession(next: AuthSession<TUser>): void {\n      session = next;\n      const failures: unknown[] = [];\n      for (const listener of [...sessionListeners]) {\n        try {\n          listener(next);\n        } catch (failure) {\n          failures.push(failure);\n        }\n      }\n      if (!isSettled(next)) {\n        if (failures.length) throw new AggregateError(failures, 'A session listener failed.');\n        return;\n      }\n      const waiters = settleWaiters;\n      settleWaiters = [];\n      const authenticated = next.status === AuthStatus.Authenticated;\n      for (const waiter of waiters) waiter(authenticated);\n      if (failures.length) throw new AggregateError(failures, 'A session listener failed.');\n    },\n\n    subscribeUnauthorized(listener: UnauthorizedListener): () => void {\n      unauthorizedListeners.add(listener);\n      return () => unauthorizedListeners.delete(listener);\n    },\n\n    subscribeSession(listener: SessionListener<TUser>): () => void {\n      sessionListeners.add(listener);\n      return () => sessionListeners.delete(listener);\n    },\n  };\n}\n","import { ResultExtensions, type AppError, type Result } from '../foundation/results';\nimport { type ApiClient, type ApiDecoder } from '../foundation/http';\n\nimport type { AuthResolveContext, AuthStrategy } from './AuthSession';\n\n/** Defines the slice of `ApiClient` the cookie strategy calls — any object with `get`/`post` fits, fakes included. */\nexport type CookieAuthClient = Pick<ApiClient, 'get' | 'post'>;\n\n/** Defines the context passed to a cookie strategy's custom `signIn` delegate. */\nexport interface CookieSignInContext extends AuthResolveContext {\n  /** The strategy's HTTP client — call sign-in endpoints (guest creation, token exchange) through it. */\n  readonly client: CookieAuthClient;\n}\n\n/** Defines the options for {@link createCookieStrategy}. */\nexport interface CreateCookieStrategyOptions<TUser, TSignInInput = unknown> {\n  /** The HTTP client the strategy calls — the app's `createApiClient`, same-origin or `credentials: 'include'`. */\n  readonly client: CookieAuthClient;\n\n  /** Validates and decodes the user payload at the transport edge. */\n  readonly decodeUser: ApiDecoder<TUser>;\n\n  /** The me-resolve endpoint (GET). Default `/api/identity/me` — the backend SDK identity baseline. */\n  readonly mePath?: string;\n\n  /** The sign-out endpoint (POST). Default `/api/identity/sign-out`; `null` skips it and clears locally only. */\n  readonly signOutPath?: string | null;\n\n  /** Treats a 200 me-response as signed out (guest gate). Default: every resolved user is authenticated. */\n  readonly isAnonymous?: (user: TUser) => boolean;\n\n  /** A custom sign-in exchange (guest creation, password post, ID-token swap) — return the user to authenticate. */\n  readonly signIn?: (\n    input: TSignInInput,\n    context: CookieSignInContext,\n  ) => Promise<Result<TUser | null | void, AppError>> | Result<TUser | null | void, AppError>;\n}\n\n/**\n * Creates the cookie-session strategy — the session cookie is owned by the backend; the client\n * only resolves `GET {mePath}` on mount (401 → anonymous, other failures settle anonymous and are\n * reported) and posts `{signOutPath}` on sign-out. Covers the drydock and smart-qr shapes; pair\n * with `isAnonymous`/`signIn` for guest gates, or use `createRedirectStrategy` for OAuth sign-in.\n */\nexport function createCookieStrategy<TUser, TSignInInput = unknown>(\n  options: CreateCookieStrategyOptions<TUser, TSignInInput>,\n): AuthStrategy<TUser, TSignInInput> {\n  const { client, mePath = '/api/identity/me', signOutPath = '/api/identity/sign-out', isAnonymous, signIn } = options;\n\n  const strategy: AuthStrategy<TUser, TSignInInput> = {\n    async resolveUser(context: AuthResolveContext): Promise<Result<TUser | null, AppError>> {\n      const outcome = await client.get(mePath, { ...context, decode: options.decodeUser });\n      if (!outcome.ok) return outcome.failure.status === 401 ? ResultExtensions.ok(null) : outcome;\n      return ResultExtensions.ok(isAnonymous?.(outcome.value) ? null : outcome.value);\n    },\n    async signOut(context: AuthResolveContext): Promise<Result<void, AppError>> {\n      if (signOutPath === null) return ResultExtensions.ok(undefined);\n      return client.post(signOutPath, { ...context, response: 'empty' });\n    },\n  };\n\n  if (signIn) {\n    strategy.signIn = (input: TSignInInput, context: AuthResolveContext) => signIn(input, { ...context, client });\n  }\n\n  return strategy;\n}\n","/** Defines a bearer credential store. Use isolated memory by default; persistence needs explicit app policy. */\nexport interface TokenStorage {\n  /** Reads the stored token, or `null` when signed out. */\n  get(): string | null;\n\n  /** Stores a new token, or clears it with `null`. */\n  set(token: string | null): void;\n}\n\n/** Creates the default in-memory token storage — never persisted, so a reload requires re-login. */\nexport function createMemoryTokenStorage(): TokenStorage {\n  let token: string | null = null;\n  return {\n    get: () => token,\n    set: (next) => {\n      token = next;\n    },\n  };\n}\n","import { AppErrorFactory, ResultExtensions, type AppError, type Result } from '../foundation/results';\nimport type { AuthResolveContext, AuthStrategy } from './AuthSession';\nimport { createMemoryTokenStorage, type TokenStorage } from './TokenStorage';\n\n/** Defines the outcome of a bearer credential exchange. */\nexport interface BearerCredentials<TUser> {\n  /** The bearer token stored and sent on subsequent requests. */\n  readonly token: string;\n\n  /** The signed-in user the session becomes. */\n  readonly user: TUser;\n}\n\n/** Defines the options for {@link createBearerStrategy}. */\nexport interface CreateBearerStrategyOptions<TUser, TSignInInput = unknown> {\n  /** Exchanges credentials for a token + user — expected failure is returned for the sign-in form. */\n  readonly authenticate: (\n    input: TSignInInput,\n    context: AuthResolveContext,\n  ) => Promise<Result<BearerCredentials<TUser>, AppError>>;\n\n  /** Where the token lives. Default `createMemoryTokenStorage()` — never persisted, a reload requires re-login. */\n  readonly tokenStorage?: TokenStorage;\n\n  /**\n   * Restores the user behind a persisted token (me-resolve with the token). Without it, a token\n   * found on mount is discarded — sessions restore only when the user can be rebuilt.\n   */\n  readonly resolveUser?: (\n    context: AuthResolveContext & { readonly token: string },\n  ) => Promise<Result<TUser | null, AppError>>;\n\n  /** An optional server-side revoke called on sign-out — the token clears locally regardless of the outcome. */\n  readonly signOut?: (context: AuthResolveContext) => Promise<Result<void, AppError>> | Result<void, AppError>;\n}\n\n/** Defines the bearer strategy — an {@link AuthStrategy} plus the `getAuthToken` reader that feeds the api client. */\nexport interface BearerStrategy<TUser, TSignInInput = unknown> extends AuthStrategy<TUser, TSignInInput> {\n  /** Feeds `createApiClient({ getAuthToken })` — re-read per request, so headers reflect the live session. */\n  readonly getAuthToken: () => string | null;\n\n  /** The storage behind the strategy — exposed for tests and advanced wiring. */\n  readonly tokenStorage: TokenStorage;\n}\n\n/**\n * Creates the bearer-token strategy — the token lives in a {@link TokenStorage} delegate\n * (in-memory by default), `signIn` runs the credential exchange, and a bridged 401 clears the\n * token before the session flips to anonymous. Wire the api client with the returned\n * `getAuthToken`. Covers the secrets-vault shape.\n */\nexport function createBearerStrategy<TUser, TSignInInput = unknown>(\n  options: CreateBearerStrategyOptions<TUser, TSignInInput>,\n): BearerStrategy<TUser, TSignInInput> {\n  const storage = options.tokenStorage ?? createMemoryTokenStorage();\n\n  let generation = 0;\n  const cancelled = () => ResultExtensions.fail(AppErrorFactory.cancelled());\n\n  return {\n    tokenStorage: storage,\n    getAuthToken: () => storage.get(),\n\n    async resolveUser(context: AuthResolveContext): Promise<Result<TUser | null, AppError>> {\n      const current = ++generation;\n      const token = storage.get();\n      if (token == null) return ResultExtensions.ok(null);\n      if (!options.resolveUser) {\n        storage.set(null);\n        return ResultExtensions.ok(null);\n      }\n      const outcome = await options.resolveUser({ ...context, token });\n      if (current !== generation || context.signal?.aborted) return cancelled();\n      if (outcome.ok && outcome.value === null && storage.get() === token) storage.set(null);\n      return outcome;\n    },\n    async signIn(input: TSignInInput, context: AuthResolveContext): Promise<Result<TUser, AppError>> {\n      const current = ++generation;\n      const outcome = await options.authenticate(input, context);\n      if (current !== generation || context.signal?.aborted) return cancelled();\n      if (!outcome.ok) return outcome;\n      storage.set(outcome.value.token);\n      return ResultExtensions.ok(outcome.value.user);\n    },\n    async signOut(context: AuthResolveContext): Promise<Result<void, AppError>> {\n      const current = ++generation;\n      storage.set(null);\n      try {\n        return (await options.signOut?.(context)) ?? ResultExtensions.ok(undefined);\n      } finally {\n        if (current === generation) storage.set(null);\n      }\n    },\n    onUnauthorized(): void {\n      generation += 1;\n      storage.set(null);\n    },\n  };\n}\n","import { AppErrorFactory, ResultExtensions, type AppError, type Result } from '../foundation/results';\nimport type { AuthStrategy } from './AuthSession';\nimport { createCookieStrategy, type CreateCookieStrategyOptions } from './CookieStrategy';\n\n/** Defines the options for {@link createRedirectStrategy}. */\nexport interface CreateRedirectStrategyOptions<TUser> extends Omit<\n  CreateCookieStrategyOptions<TUser, never>,\n  'signIn'\n> {\n  /** The sign-in challenge endpoint the browser navigates to. Default `/api/identity/sign-in` (SDK baseline). */\n  readonly signInPath?: string;\n\n  /** The query param carrying the post-login return path. Default `returnUrl` (the drydock shape). */\n  readonly returnUrlParam?: string;\n\n  /** Builds the full challenge URL from the return path — overrides `signInPath` + `returnUrlParam` entirely. */\n  readonly buildSignInUrl?: (returnUrl: string) => string;\n\n  /** Navigates. Default `window.location.assign` — inject to drive the strategy without a DOM in tests. */\n  readonly navigate?: (url: string) => void;\n}\n\n/**\n * Reads the current location as the default return path.\n *\n * SSR-safe: `createRedirectStrategy` is built at module scope in an app, so this module is imported\n * on the server. There is no location there, so a bare `/` stands in rather than letting\n * `window.location` throw a bare `ReferenceError`.\n */\nfunction currentPath(): string {\n  if (typeof window === 'undefined') return '/';\n  return window.location.pathname + window.location.search;\n}\n\n/**\n * Creates the external-redirect OAuth strategy — a cookie session whose `signIn(returnUrl?)`\n * navigates the browser to the backend's sign-in challenge (`{signInPath}?{returnUrlParam}=…`);\n * the OAuth callback is handled server-side, which sets the cookie and redirects back. `returnUrl`\n * defaults to the current `pathname + search`. Covers the drydock shape.\n *\n * Construction is SSR-safe — every browser global is read inside `signIn`, never at factory time —\n * but `signIn` itself is a browser-only operation, and says so with a real message instead of a\n * bare `ReferenceError` if it is ever reached on the server.\n */\nexport function createRedirectStrategy<TUser>(\n  options: CreateRedirectStrategyOptions<TUser>,\n): AuthStrategy<TUser, string | undefined> {\n  const {\n    signInPath = '/api/identity/sign-in',\n    returnUrlParam = 'returnUrl',\n    buildSignInUrl,\n    navigate,\n    ...cookieOptions\n  } = options;\n\n  const base = createCookieStrategy<TUser, never>(cookieOptions);\n  const buildUrl =\n    buildSignInUrl ?? ((returnUrl: string) => `${signInPath}?${returnUrlParam}=${encodeURIComponent(returnUrl)}`);\n  const doNavigate =\n    navigate ??\n    ((url: string) => {\n      // A full-page redirect needs a browser. Reaching this on the server means `signIn` was called\n      // from a render rather than a user action — fail loudly, since silently dropping a sign-in\n      // leaves the session stuck with no signal at all. Pass `navigate` to drive it in a test.\n      if (typeof window === 'undefined') {\n        throw new Error(\n          'createRedirectStrategy: signIn needs a browser to navigate. Pass `navigate` to drive it elsewhere.',\n        );\n      }\n      window.location.assign(url);\n    });\n\n  return {\n    // Closure-based delegates off the cookie strategy — no `this`, safe to re-home.\n    resolveUser: base.resolveUser,\n    signOut: base.signOut,\n\n    // Returns void on purpose: the session state stays as-is while the browser navigates away.\n    signIn(returnUrl?: string): Result<void, AppError> {\n      const target = returnUrl ?? currentPath();\n      if (\n        !buildSignInUrl &&\n        (!target.startsWith('/') ||\n          target.startsWith('//') ||\n          [...target].some((character) => character === '\\\\' || character.charCodeAt(0) < 32))\n      ) {\n        return ResultExtensions.fail(AppErrorFactory.validation());\n      }\n      if (!navigate && typeof window === 'undefined') return ResultExtensions.fail(AppErrorFactory.unavailable());\n      doNavigate(buildUrl(target));\n      return ResultExtensions.ok(undefined);\n    },\n  };\n}\n"],"names":["_renderSlot"],"mappings":";;;AAEO,MAAM,aAAa;AAAA;AAAA,EAExB,SAAS;AAAA;AAAA,EAET,WAAW;AAAA;AAAA,EAEX,eAAe;AAAA;AAAA,EAEf,WAAW;AACb;ACuCO,MAAM,UAAmD,OAAO,cAAc;AAG9E,SAAS,UAAiF;AAC/F,QAAM,UAAU,OAAO,SAAS,IAAI;AACpC,MAAI,YAAY,KAAM,OAAM,IAAI,MAAM,8CAA8C;AACpF,SAAO;AACT;ACrDA,MAAM,mBAAmB,EAAE,QAAQ,WAAW,WAAW,MAAM,KAAA;;;;;;;;;;;;;AAoD/D,UAAM,QAAQ;AAQd,UAAM,UAAU,WAA+B,EAAE,QAAQ,WAAW,SAAS,MAAM,MAAM;AAEzF,QAAI,aAAa;AACjB,QAAI,aAAqC;AACzC,QAAI,WAA2D;AAC/D,QAAI,WAAW;AAEf,aAAS,aAAqB;AAC5B,oBAAc;AACd,kBAAY,MAAA;AACZ,mBAAa;AACb,iBAAW;AACX,aAAO;AAAA,IACT;AACA,aAAS,QAAkD;AACzD,YAAM,UAAU,WAAA;AAChB,mBAAa,IAAI,gBAAA;AACjB,aAAO,EAAE,SAAS,QAAQ,WAAW,OAAA;AAAA,IACvC;AACA,aAAS,KAAK,SAA0B;AACtC,aAAO,CAAC,YAAY,YAAY;AAAA,IAClC;AACA,UAAM,YAAY,MAA+B,iBAAiB,KAAK,gBAAgB,WAAW;AAElG;AAAA,MACE,CAAC,SAAS,MAAM,MAAM,MAAM;AAAA,MAC5B,CAAC,CAAC,SAAS,MAAM,MAAM;AACrB,gBAAQ,eAAe,OAAO;AAC9B,cAAM,kBAAkB,OAAO;AAAA,MACjC;AAAA,MACA,EAAE,WAAW,MAAM,OAAO,OAAA;AAAA,IAAO;AAGnC,aAAS,aAAsD;AAC7D,UAAI,SAAU,QAAO;AACrB,YAAM,EAAE,SAAS,OAAA,IAAW,MAAA;AAC5B,YAAM,WAAW,MAAM;AACvB,cAAQ,QAAQ,EAAE,QAAQ,WAAW,WAAW,MAAM,KAAA;AACtD,YAAM,WAAW,YAAqD;AACpE,YAAI;AACF,gBAAM,UAAU,MAAM,SAAS,YAAY,EAAE,QAAQ;AACrD,cAAI,CAAC,KAAK,OAAO,UAAU,UAAA;AAC3B,kBAAQ,QACN,QAAQ,MAAM,QAAQ,UAAU,OAC5B,EAAE,QAAQ,WAAW,eAAe,MAAM,QAAQ,UAClD;AACN,cAAI,CAAC,QAAQ,MAAM,QAAQ,QAAQ,SAAS,YAAa,OAAM,iBAAiB,QAAQ,OAAO;AAC/F,iBAAO;AAAA,QACT,SAAS,OAAO;AACd,cAAI,KAAK,OAAO,EAAG,SAAQ,QAAQ;AACnC,gBAAM;AAAA,QACR;AAAA,MACF,GAAA,EAAK,QAAQ,MAAM;AACjB,YAAI,aAAa,QAAS,YAAW;AAAA,MACvC,CAAC;AACD,iBAAW;AACX,aAAO;AAAA,IACT;AACA,mBAAe,wBAAuC;AACpD,UAAI,MAAM,eAAgB,OAAM,WAAA;AAAA,IAClC;AACA,cAAU,qBAAqB;AAC/B;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,CAAC,YAAY;AACX,YAAI,gBAAgB,sBAAA;AAAA,MACtB;AAAA,IAAA;AAEF;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,MAAM;AACJ,mBAAA;AACA,gBAAQ,QAAQ,EAAE,QAAQ,WAAW,SAAS,MAAM,KAAA;AACpD,eAAO,sBAAA;AAAA,MACT;AAAA,MACA,EAAE,OAAO,OAAA;AAAA,IAAO;AAElB,mBAAe,MAAM;AACnB,iBAAW;AACX,iBAAA;AAAA,IACF,CAAC;AACD;AAAA,MACE,MAAM,MAAM;AAAA,MACZ,CAAC,QAAQ,WAAW,cAAc;AAChC,YAAI,CAAC,OAAQ;AACb;AAAA,UACE,OAAO,sBAAsB,CAAC,UAAU;AACtC,uBAAA;AACA,gBAAI;AACF,oBAAM,SAAS,iBAAA;AAAA,YACjB,UAAA;AACE,sBAAQ,QAAQ;AAChB,oBAAM,iBAAiB,KAAK;AAAA,YAC9B;AAAA,UACF,CAAC;AAAA,QAAA;AAAA,MAEL;AAAA,MACA,EAAE,WAAW,KAAA;AAAA,IAAK;AAGpB,mBAAe,OAAO,OAA+D;AACnF,YAAM,WAAW,MAAM;AACvB,UAAI,CAAC,SAAS,OAAQ,QAAO,iBAAiB,KAAK,gBAAgB,aAAa;AAChF,YAAM,EAAE,SAAS,OAAA,IAAW,MAAA;AAC5B,UAAI,QAAQ,MAAM,WAAW,WAAW,mBAAmB,QAAQ;AACnE,YAAM,UAAU,MAAM,SAAS,OAAO,OAAuB,EAAE,QAAQ;AACvE,UAAI,CAAC,KAAK,OAAO,UAAU,UAAA;AAC3B,UAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,YAAM,OAAO,QAAQ,SAAS;AAC9B,UAAI,SAAS,KAAM,SAAQ,QAAQ,EAAE,QAAQ,WAAW,eAAe,KAAA;AACvE,aAAO,iBAAiB,GAAG,IAAI;AAAA,IACjC;AACA,mBAAe,UAA2C;AACxD,YAAM,WAAW,MAAM;AACvB,YAAM,EAAE,SAAS,OAAA,IAAW,MAAA;AAC5B,cAAQ,QAAQ;AAChB,UAAI;AACF,eAAQ,MAAM,SAAS,UAAU,EAAE,QAAQ,KAAM,iBAAiB,GAAG,MAAS;AAAA,MAChF,UAAA;AACE,YAAI,KAAK,OAAO,EAAG,SAAQ,QAAQ;AAAA,MACrC;AAAA,IACF;AACA,aAAS,QAAQ,MAA0B;AACzC,iBAAA;AACA,cAAQ,QAAQ,SAAS,OAAO,mBAAmB,EAAE,QAAQ,WAAW,eAAe,KAAA;AAAA,IACzF;AAMA,UAAM,MAAoC;AAAA,MACxC,IAAI,SAAS;AACX,eAAO,QAAQ,MAAM;AAAA,MACvB;AAAA,MACA,IAAI,OAAO;AACT,eAAO,QAAQ,MAAM;AAAA,MACvB;AAAA,MACA,IAAI,kBAAkB;AACpB,eAAO,QAAQ,MAAM,WAAW,WAAW;AAAA,MAC7C;AAAA,MACA,IAAI,YAAY;AACd,eAAO,QAAQ,MAAM,WAAW,WAAW,WAAW,QAAQ,MAAM,WAAW,WAAW;AAAA,MAC5F;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IAAA;AAGF,YAAQ,SAAS,GAAgC;;aAI/CA,WAAQ,KAAA,QAAA,SAAA;AAAA;;;ACpLV,SAAS,UAAU,SAAwC;AACzD,SAAO,QAAQ,WAAW,WAAW,iBAAiB,QAAQ,WAAW,WAAW;AACtF;AAGO,SAAS,mBAAuD;AACrE,MAAI,UAA8B,EAAE,QAAQ,WAAW,SAAS,MAAM,KAAA;AACtE,QAAM,4CAA4B,IAAA;AAClC,QAAM,uCAAuB,IAAA;AAC7B,MAAI,gBAAyD,CAAA;AAE7D,SAAO;AAAA,IACL,eAAe,OAAuB;AACpC,YAAM,WAAsB,CAAA;AAC5B,iBAAW,YAAY,CAAC,GAAG,qBAAqB,GAAG;AACjD,YAAI;AACF,mBAAS,KAAK;AAAA,QAChB,SAAS,SAAS;AAChB,mBAAS,KAAK,OAAO;AAAA,QACvB;AAAA,MACF;AACA,UAAI,SAAS,OAAQ,OAAM,IAAI,eAAe,UAAU,oCAAoC;AAAA,IAC9F;AAAA,IAEA,kBAAoC;AAClC,UAAI,UAAU,OAAO,EAAG,QAAO,QAAQ,QAAQ,QAAQ,WAAW,WAAW,aAAa;AAC1F,aAAO,IAAI,QAAQ,CAAC,YAAY,cAAc,KAAK,OAAO,CAAC;AAAA,IAC7D;AAAA,IAEA,YAAY,MAAM;AAAA,IAElB,eAAe,MAAgC;AAC7C,gBAAU;AACV,YAAM,WAAsB,CAAA;AAC5B,iBAAW,YAAY,CAAC,GAAG,gBAAgB,GAAG;AAC5C,YAAI;AACF,mBAAS,IAAI;AAAA,QACf,SAAS,SAAS;AAChB,mBAAS,KAAK,OAAO;AAAA,QACvB;AAAA,MACF;AACA,UAAI,CAAC,UAAU,IAAI,GAAG;AACpB,YAAI,SAAS,OAAQ,OAAM,IAAI,eAAe,UAAU,4BAA4B;AACpF;AAAA,MACF;AACA,YAAM,UAAU;AAChB,sBAAgB,CAAA;AAChB,YAAM,gBAAgB,KAAK,WAAW,WAAW;AACjD,iBAAW,UAAU,QAAS,QAAO,aAAa;AAClD,UAAI,SAAS,OAAQ,OAAM,IAAI,eAAe,UAAU,4BAA4B;AAAA,IACtF;AAAA,IAEA,sBAAsB,UAA4C;AAChE,4BAAsB,IAAI,QAAQ;AAClC,aAAO,MAAM,sBAAsB,OAAO,QAAQ;AAAA,IACpD;AAAA,IAEA,iBAAiB,UAA8C;AAC7D,uBAAiB,IAAI,QAAQ;AAC7B,aAAO,MAAM,iBAAiB,OAAO,QAAQ;AAAA,IAC/C;AAAA,EAAA;AAEJ;ACxDO,SAAS,qBACd,SACmC;AACnC,QAAM,EAAE,QAAQ,SAAS,oBAAoB,cAAc,0BAA0B,aAAa,WAAW;AAE7G,QAAM,WAA8C;AAAA,IAClD,MAAM,YAAY,SAAsE;AACtF,YAAM,UAAU,MAAM,OAAO,IAAI,QAAQ,EAAE,GAAG,SAAS,QAAQ,QAAQ,YAAY;AACnF,UAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ,QAAQ,WAAW,MAAM,iBAAiB,GAAG,IAAI,IAAI;AACrF,aAAO,iBAAiB,GAAG,cAAc,QAAQ,KAAK,IAAI,OAAO,QAAQ,KAAK;AAAA,IAChF;AAAA,IACA,MAAM,QAAQ,SAA8D;AAC1E,UAAI,gBAAgB,KAAM,QAAO,iBAAiB,GAAG,MAAS;AAC9D,aAAO,OAAO,KAAK,aAAa,EAAE,GAAG,SAAS,UAAU,SAAS;AAAA,IACnE;AAAA,EAAA;AAGF,MAAI,QAAQ;AACV,aAAS,SAAS,CAAC,OAAqB,YAAgC,OAAO,OAAO,EAAE,GAAG,SAAS,QAAQ;AAAA,EAC9G;AAEA,SAAO;AACT;ACxDO,SAAS,2BAAyC;AACvD,MAAI,QAAuB;AAC3B,SAAO;AAAA,IACL,KAAK,MAAM;AAAA,IACX,KAAK,CAAC,SAAS;AACb,cAAQ;AAAA,IACV;AAAA,EAAA;AAEJ;ACiCO,SAAS,qBACd,SACqC;AACrC,QAAM,UAAU,QAAQ,gBAAgB,yBAAA;AAExC,MAAI,aAAa;AACjB,QAAM,YAAY,MAAM,iBAAiB,KAAK,gBAAgB,WAAW;AAEzE,SAAO;AAAA,IACL,cAAc;AAAA,IACd,cAAc,MAAM,QAAQ,IAAA;AAAA,IAE5B,MAAM,YAAY,SAAsE;AACtF,YAAM,UAAU,EAAE;AAClB,YAAM,QAAQ,QAAQ,IAAA;AACtB,UAAI,SAAS,KAAM,QAAO,iBAAiB,GAAG,IAAI;AAClD,UAAI,CAAC,QAAQ,aAAa;AACxB,gBAAQ,IAAI,IAAI;AAChB,eAAO,iBAAiB,GAAG,IAAI;AAAA,MACjC;AACA,YAAM,UAAU,MAAM,QAAQ,YAAY,EAAE,GAAG,SAAS,OAAO;AAC/D,UAAI,YAAY,cAAc,QAAQ,QAAQ,gBAAgB,UAAA;AAC9D,UAAI,QAAQ,MAAM,QAAQ,UAAU,QAAQ,QAAQ,IAAA,MAAU,MAAO,SAAQ,IAAI,IAAI;AACrF,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,OAAqB,SAA+D;AAC/F,YAAM,UAAU,EAAE;AAClB,YAAM,UAAU,MAAM,QAAQ,aAAa,OAAO,OAAO;AACzD,UAAI,YAAY,cAAc,QAAQ,QAAQ,gBAAgB,UAAA;AAC9D,UAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,cAAQ,IAAI,QAAQ,MAAM,KAAK;AAC/B,aAAO,iBAAiB,GAAG,QAAQ,MAAM,IAAI;AAAA,IAC/C;AAAA,IACA,MAAM,QAAQ,SAA8D;AAC1E,YAAM,UAAU,EAAE;AAClB,cAAQ,IAAI,IAAI;AAChB,UAAI;AACF,eAAQ,MAAM,QAAQ,UAAU,OAAO,KAAM,iBAAiB,GAAG,MAAS;AAAA,MAC5E,UAAA;AACE,YAAI,YAAY,WAAY,SAAQ,IAAI,IAAI;AAAA,MAC9C;AAAA,IACF;AAAA,IACA,iBAAuB;AACrB,oBAAc;AACd,cAAQ,IAAI,IAAI;AAAA,IAClB;AAAA,EAAA;AAEJ;ACrEA,SAAS,cAAsB;AAC7B,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,SAAO,OAAO,SAAS,WAAW,OAAO,SAAS;AACpD;AAYO,SAAS,uBACd,SACyC;AACzC,QAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB;AAAA,IACjB;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EAAA,IACD;AAEJ,QAAM,OAAO,qBAAmC,aAAa;AAC7D,QAAM,WACJ,mBAAmB,CAAC,cAAsB,GAAG,UAAU,IAAI,cAAc,IAAI,mBAAmB,SAAS,CAAC;AAC5G,QAAM,aACJ,aACC,CAAC,QAAgB;AAIhB,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AACA,WAAO,SAAS,OAAO,GAAG;AAAA,EAC5B;AAEF,SAAO;AAAA;AAAA,IAEL,aAAa,KAAK;AAAA,IAClB,SAAS,KAAK;AAAA;AAAA,IAGd,OAAO,WAA4C;AACjD,YAAM,SAAS,aAAa,YAAA;AAC5B,UACE,CAAC,mBACA,CAAC,OAAO,WAAW,GAAG,KACrB,OAAO,WAAW,IAAI,KACtB,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,cAAc,cAAc,QAAQ,UAAU,WAAW,CAAC,IAAI,EAAE,IACpF;AACA,eAAO,iBAAiB,KAAK,gBAAgB,WAAA,CAAY;AAAA,MAC3D;AACA,UAAI,CAAC,YAAY,OAAO,WAAW,oBAAoB,iBAAiB,KAAK,gBAAgB,aAAa;AAC1G,iBAAW,SAAS,MAAM,CAAC;AAC3B,aAAO,iBAAiB,GAAG,MAAS;AAAA,IACtC;AAAA,EAAA;AAEJ;"}

package/dist/auth/providers/AuthContext.d.ts

@@ -0,0 +1,43 @@
+import { AppError, Result } from '../../foundation/results';
+import { InjectionKey } from 'vue';
+import { AuthStatus } from '../AuthSession';
+/**
+ * Defines the session API exposed by {@link useAuth}.
+ *
+ * The four state members are REACTIVE PROPERTIES — native getters over the provider's session ref,
+ * not snapshots. Read them (`auth.status`, `auth.user`) in a template, a `computed`, or a `watch`
+ * and they re-evaluate on every transition. Destructuring (`const { user } = useAuth()`) takes a
+ * one-time copy and will not update — bind to the object instead.
+ *
+ * Getters rather than a `reactive()` wrapper on purpose: `reactive()` would hand back a deep proxy
+ * of `user`, so `auth.user !== theUserTheAppPassedIn` and identity checks would silently fail.
+ */
+export interface AuthApi<TUser = unknown, TSignInInput = unknown> {
+    /** The current machine phase (`unknown → resolving → authenticated | anonymous`). */
+    readonly status: AuthStatus;
+    /** The signed-in user, or `null` outside `authenticated`. */
+    readonly user: TUser | null;
+    /** Whether the session is settled and signed in. */
+    readonly isAuthenticated: boolean;
+    /** Whether the session has not settled yet (`unknown` or `resolving`) — render a splash, not the login gate. */
+    readonly isPending: boolean;
+    /**
+     * Runs the strategy's sign-in. Resolves the user when the exchange returns one (state →
+     * `authenticated`), or `null` when it doesn't (redirect flows navigate away). Expected failures are returned.
+     */
+    signIn(input?: TSignInInput): Promise<Result<TUser | null, AppError>>;
+    /** Runs the strategy's sign-out — state flips to `anonymous` regardless; a server failure is returned. */
+    signOut(): Promise<Result<void, AppError>>;
+    /** Re-runs the me-resolve (through `resolving`); resolves the settled user, or `null`. */
+    refresh(): Promise<Result<TUser | null, AppError>>;
+    /** Applies an externally obtained user — e.g. a Google ID-token exchange. `null` flips to `anonymous`. */
+    setUser(user: TUser | null): void;
+}
+/**
+ * One untyped `InjectionKey` backs every generic instantiation; `useAuth<TUser>()` re-narrows it.
+ *
+ * Deliberately NOT re-exported from `index.ts` — the context stays module-private.
+ */
+export declare const AuthKey: InjectionKey<AuthApi<unknown, unknown>>;
+/** Accesses the session API. Must be used within an {@link AuthProvider}; `TUser` re-narrows the provider's generic. */
+export declare function useAuth<TUser = unknown, TSignInInput = unknown>(): AuthApi<TUser, TSignInInput>;

package/dist/auth/providers/AuthProvider.vue.d.ts

@@ -0,0 +1,39 @@
+import { AuthBridge } from '../AuthBridge';
+import { AuthSession, AuthStrategy } from '../AuthSession';
+/** Defines the props for {@link AuthProvider}. */
+export interface AuthProviderProps<TUser = unknown, TSignInInput = unknown> {
+    /**
+     * The transport strategy (cookie / bearer / redirect factory, or bespoke delegates). Read live
+     * on every call, so a swap takes effect immediately — it does not re-resolve on its own.
+     */
+    readonly strategy: AuthStrategy<TUser, TSignInInput>;
+    /** The module-scope bridge wiring the non-Vue seams — api-client 401s flip this session; router guards read it. */
+    readonly bridge?: AuthBridge<TUser>;
+    /**
+     * Whether to run the me-resolve on mount. Default `true`; with `false` the session stays
+     * `unknown` until `refresh()` or an action settles it.
+     */
+    readonly resolveOnMount?: boolean;
+    /** Fires after a bridged 401 flips the session to `anonymous` — wire redirect-to-login here. */
+    readonly onUnauthorized?: (error?: unknown) => void;
+    /** Fires when the me-resolve returns an expected failure — the session still settles `anonymous`. */
+    readonly onResolveError?: (error: unknown) => void;
+    /** Fires on every session snapshot, including the initial `unknown`. */
+    readonly onSessionChange?: (session: AuthSession<TUser>) => void;
+}
+declare const _default: <TUser = unknown, TSignInInput = unknown>(__VLS_props: NonNullable<Awaited<typeof __VLS_setup>>["props"], __VLS_ctx?: __VLS_PrettifyLocal<Pick<NonNullable<Awaited<typeof __VLS_setup>>, "attrs" | "emit" | "slots">>, __VLS_expose?: NonNullable<Awaited<typeof __VLS_setup>>["expose"], __VLS_setup?: Promise<{
+    props: __VLS_PrettifyLocal<Pick<Partial<{}> & Omit<{} & import('vue').VNodeProps & import('vue').AllowedComponentProps & import('vue').ComponentCustomProps, never>, never> & AuthProviderProps<TUser, TSignInInput> & Partial<{}>> & import('vue').PublicProps;
+    expose(exposed: import('vue').ShallowUnwrapRef<{}>): void;
+    attrs: any;
+    slots: {
+        /** The subtree with access to the session — gates and login UI live here. */
+        default(): unknown;
+    };
+    emit: {};
+}>) => import('vue').VNode & {
+    __ctx?: Awaited<typeof __VLS_setup>;
+};
+export default _default;
+type __VLS_PrettifyLocal<T> = {
+    [K in keyof T]: T[K];
+} & {};

package/dist/chunks/Align-DqFtCY3a.js.map

@@ -1 +1 @@
-{"version":3,"file":"Align-DqFtCY3a.js","sources":["../../src/foundation/utils/Align/Align.ts"],"sourcesContent":["/* Provides the shared simple alignment vocabulary (cluster / inline / dataGrid / timeline / descriptionList). */\n\n/** Defines the alignment of items along an axis. */\nexport const Align = {\n  /** Refers to alignment at the logical start. */\n  Start: 'start',\n  /** Refers to centered alignment. */\n  Center: 'center',\n  /** Refers to alignment at the logical end. */\n  End: 'end',\n} as const;\n\nexport type Align = (typeof Align)[keyof typeof Align];\n"],"names":[],"mappings":"AAGO,MAAM,QAAQ;AAAA;AAAA,EAEnB,OAAO;AAAA;AAAA,EAEP,QAAQ;AAAA;AAAA,EAER,KAAK;AACP;"}
+{"version":3,"file":"Align-DqFtCY3a.js","sources":["../../src/foundation/styles/enums/Align.ts"],"sourcesContent":["/* Provides the shared simple alignment vocabulary (cluster / inline / dataGrid / timeline / descriptionList). */\n\n/** Defines the alignment of items along an axis. */\nexport const Align = {\n  /** Refers to alignment at the logical start. */\n  Start: 'start',\n  /** Refers to centered alignment. */\n  Center: 'center',\n  /** Refers to alignment at the logical end. */\n  End: 'end',\n} as const;\n\nexport type Align = (typeof Align)[keyof typeof Align];\n"],"names":[],"mappings":"AAGO,MAAM,QAAQ;AAAA;AAAA,EAEnB,OAAO;AAAA;AAAA,EAEP,QAAQ;AAAA;AAAA,EAER,KAAK;AACP;"}

package/dist/chunks/AnchoredPositioner.vue_vue_type_script_setup_true_lang-BpBVI2Cu.js.map

@@ -1 +1 @@
-{"version":3,"file":"AnchoredPositioner.vue_vue_type_script_setup_true_lang-BpBVI2Cu.js","sources":["../../src/foundation/primitives/anchoredPositioner/AnchoredPositioner.vue"],"sourcesContent":["<script lang=\"ts\">\nimport type { Placement } from '@floating-ui/vue';\nimport type { HTMLAttributes } from 'vue';\n\nexport interface AnchoredPositionerProps extends /* @vue-ignore */ HTMLAttributes {\n  /** The element the floating layer should be anchored to. */\n  anchor: HTMLElement | null;\n\n  /** The Floating UI placement. Default `bottom`. */\n  placement?: Placement;\n\n  /** The distance between anchor and floating element in px. Default 8. */\n  offset?: number;\n\n  /** The open flag — renders the floating element only when open. */\n  isOpen?: boolean;\n}\n</script>\n\n<script setup lang=\"ts\">\nimport {\n  autoUpdate,\n  flip,\n  offset as offsetMiddleware,\n  shift,\n  size as sizeMiddleware,\n  useFloating,\n} from '@floating-ui/vue';\nimport { computed, useAttrs, useTemplateRef, type CSSProperties } from 'vue';\n\n/**\n * Position slot content relative to an anchor element using Floating UI.\n * Auto-flips and shifts to stay in viewport. Use as the positioning surface\n * for Tooltip, Popover, Menu, HoverCard.\n *\n * Exposes the anchor's measured size as CSS variables on the floating\n * element, enabling consumers to size content relative to the trigger:\n *\n *     style=\"--anchor-width: 240px; --anchor-height: 36px;\"\n *\n * Common pattern: `min-w-[var(--anchor-width)]` on a Select dropdown so\n * the panel never narrows below the trigger.\n *\n * `@floating-ui/vue` takes the reference and floating elements as refs rather\n * than React's `refs.setFloating` callback; the middleware list and\n * `autoUpdate` are the same core API as `@floating-ui/react`.\n */\ndefineOptions({ name: 'AnchoredPositioner', inheritAttrs: false });\n\nconst props = withDefaults(\n  defineProps<{\n    anchor: HTMLElement | null;\n    placement?: Placement;\n    offset?: number;\n    isOpen?: boolean;\n  }>(),\n  { placement: 'bottom', offset: 8, isOpen: true },\n);\n\nconst attrs = useAttrs();\nconst floating = useTemplateRef<HTMLDivElement>('floating');\n/** A `computed` satisfies Floating UI's `Readonly<Ref<…>>` reference parameter. */\nconst reference = computed(() => props.anchor);\n\nconst { floatingStyles } = useFloating(reference, floating, {\n  open: () => props.isOpen,\n  placement: () => props.placement,\n  middleware: computed(() => [\n    offsetMiddleware(props.offset),\n    flip(),\n    shift({ padding: 8 }),\n    sizeMiddleware({\n      apply({ rects, elements }) {\n        elements.floating.style.setProperty('--anchor-width', `${rects.reference.width}px`);\n        elements.floating.style.setProperty('--anchor-height', `${rects.reference.height}px`);\n      },\n    }),\n  ]),\n  whileElementsMounted: autoUpdate,\n});\n\nconst rest = computed(() => {\n  const { style: _style, ...others } = attrs;\n  return others;\n});\n\n/** The caller's inline style lands last, so it wins over the computed position. */\nconst styles = computed(() => [floatingStyles.value, attrs.style as CSSProperties | undefined]);\n\ndefineExpose({ el: floating });\n</script>\n\n<template>\n  <div v-if=\"props.isOpen\" ref=\"floating\" v-bind=\"rest\" :style=\"styles\"><slot /></div>\n</template>\n"],"names":["offsetMiddleware","sizeMiddleware","_openBlock","_createElementBlock","_mergeProps","_renderSlot"],"mappings":";;;;;;;;;;;;AAiDA,UAAM,QAAQ;AAUd,UAAM,QAAQ,SAAA;AACd,UAAM,WAAW,eAA+B,UAAU;AAE1D,UAAM,YAAY,SAAS,MAAM,MAAM,MAAM;AAE7C,UAAM,EAAE,eAAA,IAAmB,YAAY,WAAW,UAAU;AAAA,MAC1D,MAAM,MAAM,MAAM;AAAA,MAClB,WAAW,MAAM,MAAM;AAAA,MACvB,YAAY,SAAS,MAAM;AAAA,QACzBA,OAAiB,MAAM,MAAM;AAAA,QAC7B,KAAA;AAAA,QACA,MAAM,EAAE,SAAS,GAAG;AAAA,QACpBC,KAAe;AAAA,UACb,MAAM,EAAE,OAAO,YAAY;AACzB,qBAAS,SAAS,MAAM,YAAY,kBAAkB,GAAG,MAAM,UAAU,KAAK,IAAI;AAClF,qBAAS,SAAS,MAAM,YAAY,mBAAmB,GAAG,MAAM,UAAU,MAAM,IAAI;AAAA,UACtF;AAAA,QAAA,CACD;AAAA,MAAA,CACF;AAAA,MACD,sBAAsB;AAAA,IAAA,CACvB;AAED,UAAM,OAAO,SAAS,MAAM;AAC1B,YAAM,EAAE,OAAO,QAAQ,GAAG,WAAW;AACrC,aAAO;AAAA,IACT,CAAC;AAGD,UAAM,SAAS,SAAS,MAAM,CAAC,eAAe,OAAO,MAAM,KAAkC,CAAC;AAE9F,aAAa,EAAE,IAAI,UAAU;;AAIhB,aAAA,MAAM,UAAjBC,UAAA,GAAAC,mBAAoF,OAApFC,WAAoF;AAAA;iBAAvD;AAAA,QAAJ,KAAI;AAAA,MAAA,GAAmB,KAAA,OAAI,EAAG,OAAO,OAAA,MAAA,CAAM,GAAA;AAAA,QAAEC,WAAQ,KAAA,QAAA,SAAA;AAAA,MAAA;;;;"}
+{"version":3,"file":"AnchoredPositioner.vue_vue_type_script_setup_true_lang-BpBVI2Cu.js","sources":["../../src/foundation/primitives/anchoredPositioner/AnchoredPositioner.vue"],"sourcesContent":["<script lang=\"ts\">\nimport type { Placement } from '@floating-ui/vue';\nimport type { HTMLAttributes } from 'vue';\n\nexport interface AnchoredPositionerProps extends /* @vue-ignore */ HTMLAttributes {\n  /** The element the floating layer should be anchored to. */\n  readonly anchor: HTMLElement | null;\n\n  /** The Floating UI placement. Default `bottom`. */\n  readonly placement?: Placement;\n\n  /** The distance between anchor and floating element in px. Default 8. */\n  readonly offset?: number;\n\n  /** The open flag — renders the floating element only when open. */\n  readonly isOpen?: boolean;\n}\n</script>\n\n<script setup lang=\"ts\">\nimport {\n  autoUpdate,\n  flip,\n  offset as offsetMiddleware,\n  shift,\n  size as sizeMiddleware,\n  useFloating,\n} from '@floating-ui/vue';\nimport { computed, useAttrs, useTemplateRef, type CSSProperties } from 'vue';\n\n/**\n * Renders the slot inside a floating element positioned against an anchor via\n * Floating UI. Auto-flips and shifts to stay in viewport. Use as the positioning\n * surface for Tooltip, Popover, Menu, HoverCard.\n *\n * Exposes the anchor's measured size as CSS variables on the floating\n * element, enabling consumers to size content relative to the trigger:\n *\n *     style=\"--anchor-width: 240px; --anchor-height: 36px;\"\n *\n * Common pattern: `min-w-[var(--anchor-width)]` on a Select dropdown so\n * the panel never narrows below the trigger.\n *\n * `@floating-ui/vue` takes the reference and floating elements as refs rather\n * than React's `refs.setFloating` callback; the middleware list and\n * `autoUpdate` are the same core API as `@floating-ui/react`.\n */\ndefineOptions({ name: 'AnchoredPositioner', inheritAttrs: false });\n\nconst props = withDefaults(\n  defineProps<{\n    anchor: HTMLElement | null;\n    placement?: Placement;\n    offset?: number;\n    isOpen?: boolean;\n  }>(),\n  { placement: 'bottom', offset: 8, isOpen: true },\n);\n\ndefineSlots<{\n  /** The floating content positioned against the anchor. */\n  default(): unknown;\n}>();\n\nconst attrs = useAttrs();\nconst floating = useTemplateRef<HTMLDivElement>('floating');\n/** A `computed` satisfies Floating UI's `Readonly<Ref<…>>` reference parameter. */\nconst reference = computed(() => props.anchor);\n\nconst { floatingStyles } = useFloating(reference, floating, {\n  open: () => props.isOpen,\n  placement: () => props.placement,\n  middleware: computed(() => [\n    offsetMiddleware(props.offset),\n    flip(),\n    shift({ padding: 8 }),\n    sizeMiddleware({\n      apply({ rects, elements }) {\n        elements.floating.style.setProperty('--anchor-width', `${rects.reference.width}px`);\n        elements.floating.style.setProperty('--anchor-height', `${rects.reference.height}px`);\n      },\n    }),\n  ]),\n  whileElementsMounted: autoUpdate,\n});\n\nconst rest = computed(() => {\n  const { style: _style, ...others } = attrs;\n  return others;\n});\n\n/** The caller's inline style lands last, so it wins over the computed position. */\nconst styles = computed(() => [floatingStyles.value, attrs.style as CSSProperties | undefined]);\n\ndefineExpose({ el: floating });\n</script>\n\n<template>\n  <div v-if=\"props.isOpen\" ref=\"floating\" v-bind=\"rest\" :style=\"styles\"><slot /></div>\n</template>\n"],"names":["offsetMiddleware","sizeMiddleware","_openBlock","_createElementBlock","_mergeProps","_renderSlot"],"mappings":";;;;;;;;;;;;AAiDA,UAAM,QAAQ;AAed,UAAM,QAAQ,SAAA;AACd,UAAM,WAAW,eAA+B,UAAU;AAE1D,UAAM,YAAY,SAAS,MAAM,MAAM,MAAM;AAE7C,UAAM,EAAE,eAAA,IAAmB,YAAY,WAAW,UAAU;AAAA,MAC1D,MAAM,MAAM,MAAM;AAAA,MAClB,WAAW,MAAM,MAAM;AAAA,MACvB,YAAY,SAAS,MAAM;AAAA,QACzBA,OAAiB,MAAM,MAAM;AAAA,QAC7B,KAAA;AAAA,QACA,MAAM,EAAE,SAAS,GAAG;AAAA,QACpBC,KAAe;AAAA,UACb,MAAM,EAAE,OAAO,YAAY;AACzB,qBAAS,SAAS,MAAM,YAAY,kBAAkB,GAAG,MAAM,UAAU,KAAK,IAAI;AAClF,qBAAS,SAAS,MAAM,YAAY,mBAAmB,GAAG,MAAM,UAAU,MAAM,IAAI;AAAA,UACtF;AAAA,QAAA,CACD;AAAA,MAAA,CACF;AAAA,MACD,sBAAsB;AAAA,IAAA,CACvB;AAED,UAAM,OAAO,SAAS,MAAM;AAC1B,YAAM,EAAE,OAAO,QAAQ,GAAG,WAAW;AACrC,aAAO;AAAA,IACT,CAAC;AAGD,UAAM,SAAS,SAAS,MAAM,CAAC,eAAe,OAAO,MAAM,KAAkC,CAAC;AAE9F,aAAa,EAAE,IAAI,UAAU;;AAIhB,aAAA,MAAM,UAAjBC,UAAA,GAAAC,mBAAoF,OAApFC,WAAoF;AAAA;iBAAvD;AAAA,QAAJ,KAAI;AAAA,MAAA,GAAmB,KAAA,OAAI,EAAG,OAAO,OAAA,MAAA,CAAM,GAAA;AAAA,QAAEC,WAAQ,KAAA,QAAA,SAAA;AAAA,MAAA;;;;"}

package/dist/chunks/Announce.vue_vue_type_script_setup_true_lang-QM4vCs2n.js

@@ -0,0 +1,46 @@
+import { defineComponent, useAttrs, computed, openBlock, createElementBlock, mergeProps, renderSlot } from "vue";
+import { c as cn } from "./Cn-CzDCF-Ah.js";
+const _hoisted_1 = ["role", "aria-live"];
+const Politeness = {
+  /** Refers to a non-urgent announcement — `role="status"`, waits for idle. */
+  Polite: "polite",
+  /** Refers to an urgent announcement — `role="alert"`, interrupts. */
+  Assertive: "assertive"
+};
+const _sfc_main = /* @__PURE__ */ defineComponent({
+  ...{ name: "Announce", inheritAttrs: false },
+  __name: "Announce",
+  props: {
+    politeness: { default: Politeness.Polite }
+  },
+  setup(__props) {
+    const props = __props;
+    const attrs = useAttrs();
+    const classes = computed(
+      () => cn(
+        "absolute h-px w-px overflow-hidden whitespace-nowrap border-0 p-0",
+        "m-[-1px] [clip:rect(0_0_0_0)] [clip-path:inset(50%)]",
+        attrs.class
+      )
+    );
+    const rest = computed(() => {
+      const { class: _class, ...others } = attrs;
+      return others;
+    });
+    return (_ctx, _cache) => {
+      return openBlock(), createElementBlock("div", mergeProps(rest.value, {
+        role: props.politeness === Politeness.Assertive ? "alert" : "status",
+        "aria-live": props.politeness,
+        "aria-atomic": "true",
+        class: classes.value
+      }), [
+        renderSlot(_ctx.$slots, "default")
+      ], 16, _hoisted_1);
+    };
+  }
+});
+export {
+  Politeness as P,
+  _sfc_main as _
+};
+//# sourceMappingURL=Announce.vue_vue_type_script_setup_true_lang-QM4vCs2n.js.map

package/dist/chunks/Announce.vue_vue_type_script_setup_true_lang-QM4vCs2n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Announce.vue_vue_type_script_setup_true_lang-QM4vCs2n.js","sources":["../../src/foundation/primitives/announce/Announce.vue"],"sourcesContent":["<script lang=\"ts\">\nimport type { HTMLAttributes } from 'vue';\n\n/** Defines the urgency of an ARIA live-region announcement. */\nexport const Politeness = {\n  /** Refers to a non-urgent announcement — `role=\"status\"`, waits for idle. */\n  Polite: 'polite',\n  /** Refers to an urgent announcement — `role=\"alert\"`, interrupts. */\n  Assertive: 'assertive',\n} as const;\n\nexport type Politeness = (typeof Politeness)[keyof typeof Politeness];\n\nexport interface AnnounceProps extends /* @vue-ignore */ HTMLAttributes {\n  /** The live-region urgency — `polite` → `role=\"status\"`, `assertive` → `role=\"alert\"`. Default `polite`. */\n  readonly politeness?: Politeness;\n}\n</script>\n\n<script setup lang=\"ts\">\nimport { computed, useAttrs } from 'vue';\nimport { cn } from '../../styles/Cn';\n\n/**\n * Renders a visually-hidden ARIA live region wrapping the slot, so screen readers announce its content\n * whenever it changes. Pair with a stable mount + swappable content for\n * lightweight transient announcements (status updates, toast messages, etc.).\n */\ndefineOptions({ name: 'Announce', inheritAttrs: false });\n\nconst props = withDefaults(defineProps<{ politeness?: Politeness }>(), {\n  politeness: Politeness.Polite,\n});\n\ndefineSlots<{\n  /** The live-region content, announced whenever it changes. */\n  default(): unknown;\n}>();\n\nconst attrs = useAttrs();\n\nconst classes = computed(() =>\n  cn(\n    'absolute h-px w-px overflow-hidden whitespace-nowrap border-0 p-0',\n    'm-[-1px] [clip:rect(0_0_0_0)] [clip-path:inset(50%)]',\n    attrs.class as string | undefined,\n  ),\n);\n\nconst rest = computed(() => {\n  const { class: _class, ...others } = attrs;\n  return others;\n});\n</script>\n\n<template>\n  <div\n    v-bind=\"rest\"\n    :role=\"props.politeness === Politeness.Assertive ? 'alert' : 'status'\"\n    :aria-live=\"props.politeness\"\n    aria-atomic=\"true\"\n    :class=\"classes\"\n  >\n    <slot />\n  </div>\n</template>\n"],"names":["_createElementBlock","_mergeProps","_renderSlot"],"mappings":";;;AAIO,MAAM,aAAa;AAAA;AAAA,EAExB,QAAQ;AAAA;AAAA,EAER,WAAW;AACb;;;;;;;;AAqBA,UAAM,QAAQ;AASd,UAAM,QAAQ,SAAA;AAEd,UAAM,UAAU;AAAA,MAAS,MACvB;AAAA,QACE;AAAA,QACA;AAAA,QACA,MAAM;AAAA,MAAA;AAAA,IACR;AAGF,UAAM,OAAO,SAAS,MAAM;AAC1B,YAAM,EAAE,OAAO,QAAQ,GAAG,WAAW;AACrC,aAAO;AAAA,IACT,CAAC;;0BAICA,mBAQM,OARNC,WAQM,KAAA,OAPQ;AAAA,QACX,MAAM,MAAM,eAAe,WAAW,YAAS,UAAA;AAAA,QAC/C,aAAW,MAAM;AAAA,QAClB,eAAY;AAAA,QACX,OAAO,QAAA;AAAA,MAAA;QAERC,WAAQ,KAAA,QAAA,SAAA;AAAA,MAAA;;;;"}

package/dist/chunks/ApiError-_AOua_XE.js

@@ -0,0 +1,41 @@
+import { A as AppErrorFactory } from "./AppErrorFactory-DCdNbVfv.js";
+const ApiFailureCode = {
+  Http: "http",
+  Transport: "transport",
+  Cancelled: "cancelled",
+  Timeout: "timeout",
+  Protocol: "protocol",
+  Validation: "validation"
+};
+const ApiFailureFactory = {
+  create(code, response, problem = null) {
+    const status = response?.status ?? 0;
+    const error = code === "cancelled" ? AppErrorFactory.cancelled() : code === "timeout" ? AppErrorFactory.timeout() : code === "validation" ? AppErrorFactory.validation() : status === 401 ? AppErrorFactory.unauthorized() : status === 403 ? AppErrorFactory.forbidden() : status === 404 ? AppErrorFactory.notFound() : status === 409 ? AppErrorFactory.conflict() : code === "transport" ? AppErrorFactory.unavailable() : AppErrorFactory.unexpected();
+    return { ...error, code, status, headers: Object.fromEntries(response?.headers.entries() ?? []), problem };
+  }
+};
+class ApiError extends Error {
+  failure;
+  status;
+  /** Unvalidated response diagnostics; numeric values follow the configured JSON codec. */
+  problem;
+  constructor(input, problem = null) {
+    const failure = typeof input === "number" ? ApiFailureFactory.create(
+      input === 0 ? "transport" : "http",
+      { status: input, headers: new Headers() },
+      problem
+    ) : input;
+    super(failure.message);
+    this.name = "ApiError";
+    this.failure = failure;
+    this.status = failure.status;
+    this.problem = failure.problem;
+    Object.setPrototypeOf(this, ApiError.prototype);
+  }
+}
+export {
+  ApiError as A,
+  ApiFailureFactory as a,
+  ApiFailureCode as b
+};
+//# sourceMappingURL=ApiError-_AOua_XE.js.map

package/dist/chunks/ApiError-_AOua_XE.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiError-_AOua_XE.js","sources":["../../src/foundation/http/ApiFailure.ts","../../src/foundation/http/ApiError.ts"],"sourcesContent":["import { AppErrorFactory, type AppError } from '../results';\n\nexport const ApiFailureCode = {\n  Http: 'http',\n  Transport: 'transport',\n  Cancelled: 'cancelled',\n  Timeout: 'timeout',\n  Protocol: 'protocol',\n  Validation: 'validation',\n} as const;\nexport type ApiFailureCode = (typeof ApiFailureCode)[keyof typeof ApiFailureCode];\n\n/** A display-safe failure with transport diagnostics kept separately. */\nexport interface ApiFailure extends AppError {\n  readonly code: ApiFailureCode;\n  readonly status: number;\n  readonly headers: Readonly<Record<string, string>>;\n  /** Unvalidated response diagnostics; numeric values follow the configured JSON codec. */\n  readonly problem: Readonly<Record<string, unknown>> | null;\n}\nexport const ApiFailureFactory = {\n  create(\n    code: ApiFailureCode,\n    response?: Pick<Response, 'status' | 'headers'>,\n    problem: Readonly<Record<string, unknown>> | null = null,\n  ): ApiFailure {\n    const status = response?.status ?? 0;\n    const error =\n      code === 'cancelled'\n        ? AppErrorFactory.cancelled()\n        : code === 'timeout'\n          ? AppErrorFactory.timeout()\n          : code === 'validation'\n            ? AppErrorFactory.validation()\n            : status === 401\n              ? AppErrorFactory.unauthorized()\n              : status === 403\n                ? AppErrorFactory.forbidden()\n                : status === 404\n                  ? AppErrorFactory.notFound()\n                  : status === 409\n                    ? AppErrorFactory.conflict()\n                    : code === 'transport'\n                      ? AppErrorFactory.unavailable()\n                      : AppErrorFactory.unexpected();\n    return { ...error, code, status, headers: Object.fromEntries(response?.headers.entries() ?? []), problem };\n  },\n} as const;\n","import { ApiFailureFactory, type ApiFailure } from './ApiFailure';\n\n/** Exception bridge for third-party APIs whose protocol requires rejection. */\nexport class ApiError extends Error {\n  readonly failure: ApiFailure;\n  readonly status: number;\n  /** Unvalidated response diagnostics; numeric values follow the configured JSON codec. */\n  readonly problem: Readonly<Record<string, unknown>> | null;\n\n  constructor(failure: ApiFailure);\n  constructor(status: number, problem: Readonly<Record<string, unknown>> | null);\n  constructor(input: ApiFailure | number, problem: Readonly<Record<string, unknown>> | null = null) {\n    const failure =\n      typeof input === 'number'\n        ? ApiFailureFactory.create(\n            input === 0 ? 'transport' : 'http',\n            { status: input, headers: new Headers() },\n            problem,\n          )\n        : input;\n    super(failure.message);\n    this.name = 'ApiError';\n    this.failure = failure;\n    this.status = failure.status;\n    this.problem = failure.problem;\n    Object.setPrototypeOf(this, ApiError.prototype);\n  }\n}\n"],"names":[],"mappings":";AAEO,MAAM,iBAAiB;AAAA,EAC5B,MAAM;AAAA,EACN,WAAW;AAAA,EACX,WAAW;AAAA,EACX,SAAS;AAAA,EACT,UAAU;AAAA,EACV,YAAY;AACd;AAWO,MAAM,oBAAoB;AAAA,EAC/B,OACE,MACA,UACA,UAAoD,MACxC;AACZ,UAAM,SAAS,UAAU,UAAU;AACnC,UAAM,QACJ,SAAS,cACL,gBAAgB,cAChB,SAAS,YACP,gBAAgB,YAChB,SAAS,eACP,gBAAgB,WAAA,IAChB,WAAW,MACT,gBAAgB,aAAA,IAChB,WAAW,MACT,gBAAgB,cAChB,WAAW,MACT,gBAAgB,aAChB,WAAW,MACT,gBAAgB,SAAA,IAChB,SAAS,cACP,gBAAgB,YAAA,IAChB,gBAAgB,WAAA;AACpC,WAAO,EAAE,GAAG,OAAO,MAAM,QAAQ,SAAS,OAAO,YAAY,UAAU,QAAQ,QAAA,KAAa,CAAA,CAAE,GAAG,QAAA;AAAA,EACnG;AACF;AC5CO,MAAM,iBAAiB,MAAM;AAAA,EACzB;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EAIT,YAAY,OAA4B,UAAoD,MAAM;AAChG,UAAM,UACJ,OAAO,UAAU,WACb,kBAAkB;AAAA,MAChB,UAAU,IAAI,cAAc;AAAA,MAC5B,EAAE,QAAQ,OAAO,SAAS,IAAI,UAAQ;AAAA,MACtC;AAAA,IAAA,IAEF;AACN,UAAM,QAAQ,OAAO;AACrB,SAAK,OAAO;AACZ,SAAK,UAAU;AACf,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ;AACvB,WAAO,eAAe,MAAM,SAAS,SAAS;AAAA,EAChD;AACF;"}

package/dist/chunks/AppErrorFactory-DCdNbVfv.js

@@ -0,0 +1,54 @@
+const AppErrorType = {
+  Validation: "validation",
+  Unavailable: "unavailable",
+  Unauthorized: "unauthorized",
+  Forbidden: "forbidden",
+  NotFound: "notFound",
+  Conflict: "conflict",
+  Cancelled: "cancelled",
+  Timeout: "timeout",
+  Unexpected: "unexpected"
+};
+const AppErrorFactory = {
+  /** Creates a validation failure. */
+  validation() {
+    return { type: AppErrorType.Validation, message: "The value is invalid." };
+  },
+  /** Creates an unavailable failure. */
+  unavailable() {
+    return { type: AppErrorType.Unavailable, message: "The operation is unavailable." };
+  },
+  /** Creates an authentication failure. */
+  unauthorized() {
+    return { type: AppErrorType.Unauthorized, message: "Sign in to continue." };
+  },
+  /** Creates a permission failure. */
+  forbidden() {
+    return { type: AppErrorType.Forbidden, message: "The operation is not permitted." };
+  },
+  /** Creates a missing-resource failure. */
+  notFound() {
+    return { type: AppErrorType.NotFound, message: "The requested item was not found." };
+  },
+  /** Creates a conflicting-update failure. */
+  conflict() {
+    return { type: AppErrorType.Conflict, message: "The operation conflicts with the current state." };
+  },
+  /** Creates a cancellation outcome; no user notice is required. */
+  cancelled() {
+    return { type: AppErrorType.Cancelled, message: "The operation was cancelled." };
+  },
+  /** Creates a deadline failure. */
+  timeout() {
+    return { type: AppErrorType.Timeout, message: "The operation timed out." };
+  },
+  /** Creates an unexpected failure without exposing an exception message. */
+  unexpected() {
+    return { type: AppErrorType.Unexpected, message: "The operation could not be completed." };
+  }
+};
+export {
+  AppErrorFactory as A,
+  AppErrorType as a
+};
+//# sourceMappingURL=AppErrorFactory-DCdNbVfv.js.map

package/dist/chunks/AppErrorFactory-DCdNbVfv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppErrorFactory-DCdNbVfv.js","sources":["../../src/foundation/results/AppErrorType.ts","../../src/foundation/results/AppErrorFactory.ts"],"sourcesContent":["/** Defines transport-independent failure categories. */\nexport const AppErrorType = {\n  Validation: 'validation',\n  Unavailable: 'unavailable',\n  Unauthorized: 'unauthorized',\n  Forbidden: 'forbidden',\n  NotFound: 'notFound',\n  Conflict: 'conflict',\n  Cancelled: 'cancelled',\n  Timeout: 'timeout',\n  Unexpected: 'unexpected',\n} as const;\n\nexport type AppErrorType = (typeof AppErrorType)[keyof typeof AppErrorType];\n","import { AppErrorType } from './AppErrorType';\nimport type { AppError } from './models/AppError';\n\n/** Creates display-safe failures from the shared catalog. */\nexport const AppErrorFactory = {\n  /** Creates a validation failure. */\n  validation(): AppError {\n    return { type: AppErrorType.Validation, message: 'The value is invalid.' };\n  },\n  /** Creates an unavailable failure. */\n  unavailable(): AppError {\n    return { type: AppErrorType.Unavailable, message: 'The operation is unavailable.' };\n  },\n  /** Creates an authentication failure. */\n  unauthorized(): AppError {\n    return { type: AppErrorType.Unauthorized, message: 'Sign in to continue.' };\n  },\n  /** Creates a permission failure. */\n  forbidden(): AppError {\n    return { type: AppErrorType.Forbidden, message: 'The operation is not permitted.' };\n  },\n  /** Creates a missing-resource failure. */\n  notFound(): AppError {\n    return { type: AppErrorType.NotFound, message: 'The requested item was not found.' };\n  },\n  /** Creates a conflicting-update failure. */\n  conflict(): AppError {\n    return { type: AppErrorType.Conflict, message: 'The operation conflicts with the current state.' };\n  },\n  /** Creates a cancellation outcome; no user notice is required. */\n  cancelled(): AppError {\n    return { type: AppErrorType.Cancelled, message: 'The operation was cancelled.' };\n  },\n  /** Creates a deadline failure. */\n  timeout(): AppError {\n    return { type: AppErrorType.Timeout, message: 'The operation timed out.' };\n  },\n  /** Creates an unexpected failure without exposing an exception message. */\n  unexpected(): AppError {\n    return { type: AppErrorType.Unexpected, message: 'The operation could not be completed.' };\n  },\n} as const;\n"],"names":[],"mappings":"AACO,MAAM,eAAe;AAAA,EAC1B,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,UAAU;AAAA,EACV,UAAU;AAAA,EACV,WAAW;AAAA,EACX,SAAS;AAAA,EACT,YAAY;AACd;ACPO,MAAM,kBAAkB;AAAA;AAAA,EAE7B,aAAuB;AACrB,WAAO,EAAE,MAAM,aAAa,YAAY,SAAS,wBAAA;AAAA,EACnD;AAAA;AAAA,EAEA,cAAwB;AACtB,WAAO,EAAE,MAAM,aAAa,aAAa,SAAS,gCAAA;AAAA,EACpD;AAAA;AAAA,EAEA,eAAyB;AACvB,WAAO,EAAE,MAAM,aAAa,cAAc,SAAS,uBAAA;AAAA,EACrD;AAAA;AAAA,EAEA,YAAsB;AACpB,WAAO,EAAE,MAAM,aAAa,WAAW,SAAS,kCAAA;AAAA,EAClD;AAAA;AAAA,EAEA,WAAqB;AACnB,WAAO,EAAE,MAAM,aAAa,UAAU,SAAS,oCAAA;AAAA,EACjD;AAAA;AAAA,EAEA,WAAqB;AACnB,WAAO,EAAE,MAAM,aAAa,UAAU,SAAS,kDAAA;AAAA,EACjD;AAAA;AAAA,EAEA,YAAsB;AACpB,WAAO,EAAE,MAAM,aAAa,WAAW,SAAS,+BAAA;AAAA,EAClD;AAAA;AAAA,EAEA,UAAoB;AAClB,WAAO,EAAE,MAAM,aAAa,SAAS,SAAS,2BAAA;AAAA,EAChD;AAAA;AAAA,EAEA,aAAuB;AACrB,WAAO,EAAE,MAAM,aAAa,YAAY,SAAS,wCAAA;AAAA,EACnD;AACF;"}

package/dist/chunks/AriaAttribute-CmUjjXjp.js

@@ -0,0 +1,42 @@
+const AriaAttribute = {
+  /** Refers to the accessible name carried on the element itself. */
+  Label: "aria-label",
+  /** Refers to the id list of elements naming this one. */
+  LabelledBy: "aria-labelledby",
+  /** Refers to the id list of elements describing this one. */
+  DescribedBy: "aria-describedby",
+  /** Refers to the flag hiding an element from the accessibility tree. */
+  Hidden: "aria-hidden",
+  /** Refers to the disabled state announced without removing focusability. */
+  Disabled: "aria-disabled",
+  /** Refers to the selected state of an option or tab. */
+  Selected: "aria-selected",
+  /** Refers to the expanded state of a disclosure or combobox. */
+  Expanded: "aria-expanded",
+  /** Refers to the required state of a form control. */
+  Required: "aria-required",
+  /** Refers to the busy state of a region loading its content. */
+  Busy: "aria-busy",
+  /** Refers to the announcement priority of a live region. */
+  Live: "aria-live",
+  /** Refers to the direction of a composite widget. */
+  Orientation: "aria-orientation",
+  /** Refers to the validation state of a control. */
+  Invalid: "aria-invalid",
+  /** Refers to the pressed state of a toggle button. */
+  Pressed: "aria-pressed",
+  /** Refers to the type of popup opened by an element. */
+  HasPopup: "aria-haspopup",
+  /** Refers to a localized description of an element's role. */
+  RoleDescription: "aria-roledescription",
+  /** Refers to the minimum value of a range widget. */
+  ValueMin: "aria-valuemin",
+  /** Refers to the maximum value of a range widget. */
+  ValueMax: "aria-valuemax",
+  /** Refers to the current value of a range widget. */
+  ValueNow: "aria-valuenow"
+};
+export {
+  AriaAttribute as A
+};
+//# sourceMappingURL=AriaAttribute-CmUjjXjp.js.map

package/dist/chunks/AriaAttribute-CmUjjXjp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AriaAttribute-CmUjjXjp.js","sources":["../../src/foundation/dom/enums/AriaAttribute.ts"],"sourcesContent":["/* Provides the ARIA attribute names components read off or write to `$attrs` and the DOM directly. */\n\n/**\n * Defines an ARIA attribute name.\n *\n * Values are the DOM spelling, kebab-case, because that is what `getAttribute` / `setAttribute` and a\n * `$attrs` key literally are — the house camelCase value rule does not apply to a wire format. The\n * constant exists so the spelling is written once: a typo'd `'aria-lable'` is silently inert in the\n * accessibility tree, and no test that renders the component will fail on it.\n */\nexport const AriaAttribute = {\n  /** Refers to the accessible name carried on the element itself. */\n  Label: 'aria-label',\n\n  /** Refers to the id list of elements naming this one. */\n  LabelledBy: 'aria-labelledby',\n\n  /** Refers to the id list of elements describing this one. */\n  DescribedBy: 'aria-describedby',\n\n  /** Refers to the flag hiding an element from the accessibility tree. */\n  Hidden: 'aria-hidden',\n\n  /** Refers to the disabled state announced without removing focusability. */\n  Disabled: 'aria-disabled',\n\n  /** Refers to the selected state of an option or tab. */\n  Selected: 'aria-selected',\n\n  /** Refers to the expanded state of a disclosure or combobox. */\n  Expanded: 'aria-expanded',\n\n  /** Refers to the required state of a form control. */\n  Required: 'aria-required',\n\n  /** Refers to the busy state of a region loading its content. */\n  Busy: 'aria-busy',\n\n  /** Refers to the announcement priority of a live region. */\n  Live: 'aria-live',\n\n  /** Refers to the direction of a composite widget. */\n  Orientation: 'aria-orientation',\n\n  /** Refers to the validation state of a control. */\n  Invalid: 'aria-invalid',\n\n  /** Refers to the pressed state of a toggle button. */\n  Pressed: 'aria-pressed',\n\n  /** Refers to the type of popup opened by an element. */\n  HasPopup: 'aria-haspopup',\n\n  /** Refers to a localized description of an element's role. */\n  RoleDescription: 'aria-roledescription',\n\n  /** Refers to the minimum value of a range widget. */\n  ValueMin: 'aria-valuemin',\n\n  /** Refers to the maximum value of a range widget. */\n  ValueMax: 'aria-valuemax',\n\n  /** Refers to the current value of a range widget. */\n  ValueNow: 'aria-valuenow',\n} as const;\n\n/** Defines an ARIA attribute name. */\nexport type AriaAttribute = (typeof AriaAttribute)[keyof typeof AriaAttribute];\n"],"names":[],"mappings":"AAUO,MAAM,gBAAgB;AAAA;AAAA,EAE3B,OAAO;AAAA;AAAA,EAGP,YAAY;AAAA;AAAA,EAGZ,aAAa;AAAA;AAAA,EAGb,QAAQ;AAAA;AAAA,EAGR,UAAU;AAAA;AAAA,EAGV,UAAU;AAAA;AAAA,EAGV,UAAU;AAAA;AAAA,EAGV,UAAU;AAAA;AAAA,EAGV,MAAM;AAAA;AAAA,EAGN,MAAM;AAAA;AAAA,EAGN,aAAa;AAAA;AAAA,EAGb,SAAS;AAAA;AAAA,EAGT,SAAS;AAAA;AAAA,EAGT,UAAU;AAAA;AAAA,EAGV,iBAAiB;AAAA;AAAA,EAGjB,UAAU;AAAA;AAAA,EAGV,UAAU;AAAA;AAAA,EAGV,UAAU;AACZ;"}