labull-framework 0.1.0

package/LICENSE

@@ -0,0 +1,28 @@
+MIT License
+
+Copyright (c) 2026 Labull
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+第三方组件（随本包分发的成品 CSS / 字形）各自的许可归其作者所有：
+
+- PrimeVue 主题层（`Mira`）与 PrimeIcons 字形：搬入的成品 CSS，均为 MIT。
+- 其余依赖（Django、PyJWT 等）按各自许可（BSD-3-Clause / MIT）分发，未做修改。

package/README.md

@@ -0,0 +1,82 @@
+# labull-framework
+
+Labull 前端 SDK：把原来四个工作区包（`@labull/theme` / `@labull/auth` / `@labull/ui` /
+`@labull/magic-block`）**打成一个包**发布。装一次就有四块，subpath 一个不少。
+
+**产物是编译好的**（`dist/*.js` + `dist/*.d.ts` + `dist/style.css`），不需要你自己编译 `.vue`。
+
+## 装
+
+```bash
+npm i labull-framework vue vue-router
+```
+
+| peerDependency | 什么时候要 |
+|---|---|
+| `vue@^3.4` | **必装**（四块都依赖它） |
+| `vue-router@^4.3` | 只有用 `labull-framework/ui` 或 `labull-framework/magic-block` 才要 |
+
+没有别的运行时依赖：PrimeVue 那套 `.p-*` 样式是**成品 CSS**（`dist/style.css` 里），
+primeicons 的字库已内联成 `data:` URL —— 不用装 `primevue`、`primeicons` 或任何字体包。
+
+## 五分钟上手
+
+```ts
+// main.ts
+import { createApp } from 'vue'
+import { createRouter, createWebHistory } from 'vue-router'
+import { labull } from 'labull-framework'          // 登录态 + 外壳
+import 'labull-framework/style.css'               // 主题 + 组件样式（一份就够）
+
+const app = createApp(App)
+app.use(createRouter({ history: createWebHistory(), routes }))  // 🔴 必须排在 labull 之前
+app.use(labull)                                   // 注册全局组件 + 路由守卫
+app.mount('#app')
+```
+
+```vue
+<script setup lang="ts">
+import { useAuth } from 'labull-framework/auth'
+import { MagicBlockHost } from 'labull-framework/magic-block'
+
+const { user, isStaff, logout } = useAuth()
+</script>
+
+<template>
+  <ProductShell>
+    <template #appbar><b>订单系统</b></template>
+    <MagicBlockHost uuid="6f1c…" />
+  </ProductShell>
+</template>
+```
+
+后端地址走 `VITE_API_BASE`（默认 `http://localhost:3000`）。
+
+## subpath 对照表（原包 → 现在怎么 import）
+
+| 原来 | 现在 | 内容 |
+|---|---|---|
+| `@labull/theme` | `labull-framework/style.css`（或 `labull-framework/theme`） | `--sp-*` token + 完整主题层 + 结构类 + primeicons |
+| `@labull/auth` | `labull-framework/auth` | `useAuth()` / `apiFetch()` / `ensureAuthenticated()` / `createAuthGate()` / `API_BASE` |
+| `@labull/ui` | `labull-framework/ui` | `ProductShell` / `ProductSide` / `ProductTabs` / `AppSearch` / `UserMenu` / `labull` 插件 |
+| `@labull/magic-block` | `labull-framework/magic-block` | `MagicBlockHost` / `MagicBlockConsole` / 清单校验 / bridge |
+
+根入口 `labull-framework` = `auth` + `ui`（最常用的两层）。
+
+🔴 **它故意不 re-export `magic-block`**：`magic-block` 与 `auth` 都导出 `API_BASE`，
+两路 `export *` 撞同一个名字是打包器层面的歧义。要块就从 `labull-framework/magic-block` 拿。
+
+## 两份东西要知道
+
+- 🔴 **前端不做授权**：`isStaff` / `groups` / `permissions` 只是界面显隐，判据全在后端。
+- 🔴 **单例只有一份**：`auth` 的状态是模块级单例，`ui` 与 `magic-block` 共用同一份
+  （产物里共享代码在 `dist/chunk-*.js`，不是各拷贝一份）—— 所以"用户菜单说登录了、
+  宿主说没登录"这种事不会发生。
+
+## 样式说明
+
+`dist/style.css` 是**完整层**（≈478 KB，gzip ≈91 KB）：token + PrimeVue 主题层 + `.labull-*`
+结构类 + shell + 组件样式 + 内联 primeicons。
+
+单包方案里**没有**"只要 token、不要那 450 KB 主题层"的入口（原来 `@labull/theme` 分两层，
+现在只有一份）。真要精简，就在应用里覆盖 `--sp-*` 变量、不引 `style.css` 而自己写需要的部分。

package/dist/auth.d.ts

@@ -0,0 +1 @@
+export * from './types/auth'

package/dist/auth.js

@@ -0,0 +1,17 @@
+import { A as s, a as t, C as r, b as u, c as A, d as c, e as h, f as i, g as n, h as E, l as o, i as S, j as _, u as l } from "./chunk-index-BWpDbB19.js";
+export {
+  s as API_BASE,
+  t as AUTH_DEADLINE_MS,
+  r as CLEAR_SESSION_DEADLINE_MS,
+  u as apiFetch,
+  A as authHeaders,
+  c as createAuthGate,
+  h as currentPath,
+  i as currentUser,
+  n as currentUserInTime,
+  E as ensureAuthenticated,
+  o as loginUrl,
+  S as loginWithRedirect,
+  _ as logout,
+  l as useAuth
+};

package/dist/chunk-_plugin-vue_export-helper-CHgC5LLL.js

@@ -0,0 +1,9 @@
+const s = (t, r) => {
+  const o = t.__vccOpts || t;
+  for (const [c, e] of r)
+    o[c] = e;
+  return o;
+};
+export {
+  s as _
+};

package/dist/chunk-index-BWpDbB19.js

@@ -0,0 +1,129 @@
+import { ref as c, computed as T } from "vue";
+const l = "http://localhost:3000", h = 8e3, C = 1500, y = "labull.csrf", P = "x-labull-csrf", $ = ["GET", "HEAD", "OPTIONS"], u = c(null);
+function v(t) {
+  for (const e of (typeof document > "u" ? "" : document.cookie).split(";")) {
+    const [n, ...s] = e.trim().split("=");
+    if (n === t) return s.join("=");
+  }
+  return "";
+}
+function m(t = "GET", e = !1) {
+  const n = e ? { "Content-Type": "application/json" } : {}, s = v(y);
+  return s && !$.includes(t.toUpperCase()) && (n[P] = s), n;
+}
+async function E(t, e = {}) {
+  const n = String(e.method ?? "GET").toUpperCase(), s = await fetch(`${l}${t}`, {
+    ...e,
+    method: n,
+    credentials: "include",
+    headers: { ...m(n, e.body !== void 0), ...e.headers ?? {} }
+  });
+  if (!s.ok) {
+    const o = await s.json().catch(() => null), a = typeof o?.message == "string" ? o.message : "";
+    throw Object.assign(new Error(a || `请求失败：${s.status} ${t}`), { status: s.status });
+  }
+  return s.status === 204 ? void 0 : await s.json();
+}
+function f() {
+  if (typeof window > "u") return "/";
+  const t = window.location, e = `${t.pathname}${t.search}`;
+  return e.startsWith("/") && !e.startsWith("//") ? e : "/";
+}
+function O(t = f()) {
+  const e = t.startsWith("/") && !t.startsWith("//") ? t : "/";
+  return `${l}/auth/login?redirect=${encodeURIComponent(e)}`;
+}
+function w(t = f()) {
+  window.location.assign(O(t));
+}
+function _() {
+  u.value = null, window.location.assign(`${l}/auth/logout`);
+}
+async function b() {
+  try {
+    const t = await E("/auth/me");
+    return u.value = t, t;
+  } catch (t) {
+    const e = t?.status;
+    return (e === 401 || e === 403) && await Promise.race([
+      fetch(`${l}/auth/logout`, { method: "POST", credentials: "include", headers: m("POST", !0) }).catch(() => {
+      }),
+      new Promise((n) => setTimeout(n, C))
+    ]), u.value = null, null;
+  }
+}
+async function p(t = h) {
+  let e;
+  const n = new Promise((s) => {
+    e = setTimeout(() => s("timeout"), t);
+  });
+  try {
+    return await Promise.race([b(), n]);
+  } finally {
+    e !== void 0 && clearTimeout(e);
+  }
+}
+async function U(t = f(), e = h) {
+  const n = await p(e);
+  return n !== "timeout" && n ? n : (n !== "timeout" && w(t), null);
+}
+function D(t = {}) {
+  const e = t.deadlineMs ?? h, n = c(!1), s = c(!1), o = c(!1);
+  let a = null, d = !1;
+  async function S(r) {
+    const i = await p(e);
+    if (i !== "timeout" && i) {
+      d = !0, s.value = !1, o.value = !1, n.value = !0;
+      return;
+    }
+    if (n.value = !1, s.value = !0, o.value = i === "timeout", i !== "timeout")
+      try {
+        w(r);
+      } catch {
+        console.warn("[labull] 整页跳登录没成功；界面上的手动登录链接还在。");
+      }
+  }
+  function g(r) {
+    return d ? Promise.resolve() : a || (a = S(r).finally(() => {
+      a = null;
+    }), a);
+  }
+  function A(r) {
+    d = !1, n.value = !1, g(r);
+  }
+  return { open: n, denied: s, unreachable: o, pass: g, recheck: A };
+}
+function R() {
+  async function t() {
+    const e = await p();
+    return e === "timeout" ? null : e;
+  }
+  return {
+    user: u,
+    isStaff: T(() => u.value?.isStaff === !0),
+    /** 🔴 只是界面提示位（本地读得到 CSRF cookie 就算），**不是授权判据**：要挡就在后端挡。 */
+    isAuthenticated: () => v(y) !== "",
+    refresh: t,
+    apiFetch: E,
+    authHeaders: m,
+    currentPath: f,
+    login: w,
+    logout: _
+  };
+}
+export {
+  l as A,
+  C,
+  h as a,
+  E as b,
+  m as c,
+  D as d,
+  f as e,
+  b as f,
+  p as g,
+  U as h,
+  w as i,
+  _ as j,
+  O as l,
+  R as u
+};