tempest-react-sdk 0.22.0 → 0.24.0

package/dist/access/access-control-context.js

@@ -0,0 +1,17 @@
+import { createContext as e, useContext as t } from "react";
+import { jsx as n } from "react/jsx-runtime";
+//#region src/access/access-control-context.tsx
+var r = e(null);
+function i({ control: e, children: t }) {
+	return /* @__PURE__ */ n(r.Provider, {
+		value: e,
+		children: t
+	});
+}
+function a() {
+	return t(r);
+}
+//#endregion
+export { i as AccessControlProvider, a as useAccessControl };
+
+//# sourceMappingURL=access-control-context.js.map

package/dist/access/access-control-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control-context.js","names":[],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":";;;AAIA,IAAM,IAAuB,EAAoC,IAAI;AAmBrE,SAAgB,EAAsB,EAAE,YAAS,eAAwC;CACrF,OACI,kBAAC,EAAqB,UAAtB;EAA+B,OAAO;EAAU;CAAwC,CAAA;AAEhG;AAUA,SAAgB,IAAyC;CACrD,OAAO,EAAW,CAAoB;AAC1C"}

package/dist/access/create-role-access-control.cjs

@@ -0,0 +1,2 @@
+function e(e){let t=new Set(e.permissions??[]),n=e.role?Array.isArray(e.role)?e.role:[e.role]:[];for(let r of n)for(let n of e.roles?.[r]??[])t.add(n);return t}function t(t){let n=e(t);return{can({action:e,resource:t}){return n.has(`*`)||t!==void 0&&(n.has(`${t}:*`)||n.has(`${t}:${e}`))||t===void 0&&n.has(e)?{can:!0}:{can:!1,reason:`missing permission`}}}}exports.createRoleAccessControl=t;
+//# sourceMappingURL=create-role-access-control.cjs.map

package/dist/access/create-role-access-control.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-role-access-control.cjs","names":[],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":"AAWA,SAAS,EAAmB,EAA8C,CACtE,IAAM,EAAM,IAAI,IAAY,EAAO,aAAe,CAAC,CAAC,EAC9C,EAAQ,EAAO,KAAQ,MAAM,QAAQ,EAAO,IAAI,EAAI,EAAO,KAAO,CAAC,EAAO,IAAI,EAAK,CAAC,EAC1F,IAAK,IAAM,KAAQ,EACf,IAAK,IAAM,KAAQ,EAAO,QAAQ,IAAS,CAAC,EACxC,EAAI,IAAI,CAAI,EAGpB,OAAO,CACX,CAwBA,SAAgB,EAAwB,EAAgD,CACpF,IAAM,EAAU,EAAmB,CAAM,EAEzC,MAAO,CACH,IAAI,CAAE,SAAQ,YAAkC,CAO5C,OALI,EAAQ,IAAI,GAAG,GACd,IAAa,IAAA,KACT,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAK,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAQ,IACvE,IAAa,IAAA,IAAa,EAAQ,IAAI,CAAM,EAEhC,CAAE,IAAK,EAAK,EAAI,CAAE,IAAK,GAAO,OAAQ,oBAAqB,CAChF,CACJ,CACJ"}

package/dist/access/create-role-access-control.js

@@ -0,0 +1,19 @@
+//#region src/access/create-role-access-control.ts
+function e(e) {
+	let t = new Set(e.permissions ?? []), n = e.role ? Array.isArray(e.role) ? e.role : [e.role] : [];
+	for (let r of n) for (let n of e.roles?.[r] ?? []) t.add(n);
+	return t;
+}
+function t(t) {
+	let n = e(t);
+	return { can({ action: e, resource: t }) {
+		return n.has("*") || t !== void 0 && (n.has(`${t}:*`) || n.has(`${t}:${e}`)) || t === void 0 && n.has(e) ? { can: !0 } : {
+			can: !1,
+			reason: "missing permission"
+		};
+	} };
+}
+//#endregion
+export { t as createRoleAccessControl };
+
+//# sourceMappingURL=create-role-access-control.js.map

package/dist/access/create-role-access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-role-access-control.js","names":[],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":";AAWA,SAAS,EAAmB,GAA8C;CACtE,IAAM,IAAM,IAAI,IAAY,EAAO,eAAe,CAAC,CAAC,GAC9C,IAAQ,EAAO,OAAQ,MAAM,QAAQ,EAAO,IAAI,IAAI,EAAO,OAAO,CAAC,EAAO,IAAI,IAAK,CAAC;CAC1F,KAAK,IAAM,KAAQ,GACf,KAAK,IAAM,KAAQ,EAAO,QAAQ,MAAS,CAAC,GACxC,EAAI,IAAI,CAAI;CAGpB,OAAO;AACX;AAwBA,SAAgB,EAAwB,GAAgD;CACpF,IAAM,IAAU,EAAmB,CAAM;CAEzC,OAAO,EACH,IAAI,EAAE,WAAQ,eAAkC;EAO5C,OALI,EAAQ,IAAI,GAAG,KACd,MAAa,KAAA,MACT,EAAQ,IAAI,GAAG,EAAS,GAAG,KAAK,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAQ,MACvE,MAAa,KAAA,KAAa,EAAQ,IAAI,CAAM,IAEhC,EAAE,KAAK,GAAK,IAAI;GAAE,KAAK;GAAO,QAAQ;EAAqB;CAChF,EACJ;AACJ"}

package/dist/access/permissions-from-token.cjs

@@ -0,0 +1,2 @@
+const e=require("../auth/jwt.cjs");function t(e){return Array.isArray(e)?e.filter(e=>typeof e==`string`):typeof e==`string`?e.split(/\s+/).filter(Boolean):[]}function n(n,r){try{let{payload:i}=e.decodeJWT(n),a=t(i[r?.claim??`permissions`]);if(a.length>0)return a;if(r?.claim===void 0){let e=t(i.scopes);return e.length>0?e:t(i.scope)}return a}catch{return[]}}exports.permissionsFromToken=n;
+//# sourceMappingURL=permissions-from-token.cjs.map

package/dist/access/permissions-from-token.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-from-token.cjs","names":[],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":"mCAOA,SAAS,EAAiB,EAA0B,CAQhD,OAPI,MAAM,QAAQ,CAAK,EACZ,EAAM,OAAQ,GAAyB,OAAO,GAAS,QAAQ,EAEtE,OAAO,GAAU,SAEV,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,EAErC,CAAC,CACZ,CAcA,SAAgB,EACZ,EACA,EACQ,CACR,GAAI,CACA,GAAM,CAAE,WAAY,EAAA,UAAU,CAAK,EAE7B,EAAU,EAAiB,EADnB,GAAS,OAAS,cACe,EAC/C,GAAI,EAAQ,OAAS,EAAG,OAAO,EAE/B,GAAI,GAAS,QAAU,IAAA,GAAW,CAC9B,IAAM,EAAS,EAAiB,EAAQ,MAAS,EAEjD,OADI,EAAO,OAAS,EAAU,EACvB,EAAiB,EAAQ,KAAQ,CAC5C,CACA,OAAO,CACX,MAAQ,CACJ,MAAO,CAAC,CACZ,CACJ"}

package/dist/access/permissions-from-token.js

@@ -0,0 +1,22 @@
+import { decodeJWT as e } from "../auth/jwt.js";
+//#region src/access/permissions-from-token.ts
+function t(e) {
+	return Array.isArray(e) ? e.filter((e) => typeof e == "string") : typeof e == "string" ? e.split(/\s+/).filter(Boolean) : [];
+}
+function n(n, r) {
+	try {
+		let { payload: i } = e(n), a = t(i[r?.claim ?? "permissions"]);
+		if (a.length > 0) return a;
+		if (r?.claim === void 0) {
+			let e = t(i.scopes);
+			return e.length > 0 ? e : t(i.scope);
+		}
+		return a;
+	} catch {
+		return [];
+	}
+}
+//#endregion
+export { n as permissionsFromToken };
+
+//# sourceMappingURL=permissions-from-token.js.map

package/dist/access/permissions-from-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-from-token.js","names":[],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":";;AAOA,SAAS,EAAiB,GAA0B;CAQhD,OAPI,MAAM,QAAQ,CAAK,IACZ,EAAM,QAAQ,MAAyB,OAAO,KAAS,QAAQ,IAEtE,OAAO,KAAU,WAEV,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,IAErC,CAAC;AACZ;AAcA,SAAgB,EACZ,GACA,GACQ;CACR,IAAI;EACA,IAAM,EAAE,eAAY,EAAU,CAAK,GAE7B,IAAU,EAAiB,EADnB,GAAS,SAAS,cACe;EAC/C,IAAI,EAAQ,SAAS,GAAG,OAAO;EAE/B,IAAI,GAAS,UAAU,KAAA,GAAW;GAC9B,IAAM,IAAS,EAAiB,EAAQ,MAAS;GAEjD,OADI,EAAO,SAAS,IAAU,IACvB,EAAiB,EAAQ,KAAQ;EAC5C;EACA,OAAO;CACX,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ"}

package/dist/access/use-can.cjs

@@ -0,0 +1,2 @@
+const e=require("./access-control-context.cjs");let t=require("react");function n(e){return typeof e==`boolean`?{can:e}:e}function r(r){let i=e.useAccessControl(),a=JSON.stringify(r),[o,s]=(0,t.useState)(()=>i?{allowed:!1,isLoading:!0}:{allowed:!0,isLoading:!1});return(0,t.useEffect)(()=>{if(!i){s({allowed:!0,isLoading:!1});return}let e=!1;return s(e=>({...e,isLoading:!0})),Promise.resolve(i.can(r)).then(t=>{if(e)return;let r=n(t);s({allowed:r.can,isLoading:!1,reason:r.reason})}).catch(t=>{e||s({allowed:!1,isLoading:!1,reason:t instanceof Error?t.message:`access check failed`})}),()=>{e=!0}},[i,a]),o}exports.useCan=r;
+//# sourceMappingURL=use-can.cjs.map

package/dist/access/use-can.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-can.cjs","names":[],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":"uEAaA,SAAS,EAAU,EAAwC,CACvD,OAAO,OAAO,GAAW,UAAY,CAAE,IAAK,CAAO,EAAI,CAC3D,CAWA,SAAgB,EAAO,EAAiC,CACpD,IAAM,EAAU,EAAA,iBAAiB,EAC3B,EAAY,KAAK,UAAU,CAAM,EAEjC,CAAC,EAAO,IAAA,EAAA,EAAA,SAAA,KACV,EAAU,CAAE,QAAS,GAAO,UAAW,EAAK,EAAI,CAAE,QAAS,GAAM,UAAW,EAAM,CACtF,EAiCA,OA/BA,EAAA,EAAA,UAAA,KAAgB,CACZ,GAAI,CAAC,EAAS,CACV,EAAS,CAAE,QAAS,GAAM,UAAW,EAAM,CAAC,EAC5C,MACJ,CAEA,IAAI,EAAY,GAkBhB,OAjBA,EAAU,IAAU,CAAE,GAAG,EAAM,UAAW,EAAK,EAAE,EAEjD,QAAQ,QAAQ,EAAQ,IAAI,CAAM,CAAC,CAAC,CAC/B,KAAM,GAAQ,CACX,GAAI,EAAW,OACf,IAAM,EAAS,EAAU,CAAG,EAC5B,EAAS,CAAE,QAAS,EAAO,IAAK,UAAW,GAAO,OAAQ,EAAO,MAAO,CAAC,CAC7E,CAAC,CAAC,CACD,MAAO,GAAmB,CACnB,GACJ,EAAS,CACL,QAAS,GACT,UAAW,GACX,OAAQ,aAAiB,MAAQ,EAAM,QAAU,qBACrD,CAAC,CACL,CAAC,MAEQ,CACT,EAAY,EAChB,CAGJ,EAAG,CAAC,EAAS,CAAS,CAAC,EAEhB,CACX"}

package/dist/access/use-can.js

@@ -0,0 +1,49 @@
+import { useAccessControl as e } from "./access-control-context.js";
+import { useEffect as t, useState as n } from "react";
+//#region src/access/use-can.ts
+function r(e) {
+	return typeof e == "boolean" ? { can: e } : e;
+}
+function i(i) {
+	let a = e(), o = JSON.stringify(i), [s, c] = n(() => a ? {
+		allowed: !1,
+		isLoading: !0
+	} : {
+		allowed: !0,
+		isLoading: !1
+	});
+	return t(() => {
+		if (!a) {
+			c({
+				allowed: !0,
+				isLoading: !1
+			});
+			return;
+		}
+		let e = !1;
+		return c((e) => ({
+			...e,
+			isLoading: !0
+		})), Promise.resolve(a.can(i)).then((t) => {
+			if (e) return;
+			let n = r(t);
+			c({
+				allowed: n.can,
+				isLoading: !1,
+				reason: n.reason
+			});
+		}).catch((t) => {
+			e || c({
+				allowed: !1,
+				isLoading: !1,
+				reason: t instanceof Error ? t.message : "access check failed"
+			});
+		}), () => {
+			e = !0;
+		};
+	}, [a, o]), s;
+}
+//#endregion
+export { i as useCan };
+
+//# sourceMappingURL=use-can.js.map

package/dist/access/use-can.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-can.js","names":[],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":";;;AAaA,SAAS,EAAU,GAAwC;CACvD,OAAO,OAAO,KAAW,YAAY,EAAE,KAAK,EAAO,IAAI;AAC3D;AAWA,SAAgB,EAAO,GAAiC;CACpD,IAAM,IAAU,EAAiB,GAC3B,IAAY,KAAK,UAAU,CAAM,GAEjC,CAAC,GAAO,KAAY,QACtB,IAAU;EAAE,SAAS;EAAO,WAAW;CAAK,IAAI;EAAE,SAAS;EAAM,WAAW;CAAM,CACtF;CAiCA,OA/BA,QAAgB;EACZ,IAAI,CAAC,GAAS;GACV,EAAS;IAAE,SAAS;IAAM,WAAW;GAAM,CAAC;GAC5C;EACJ;EAEA,IAAI,IAAY;EAkBhB,OAjBA,GAAU,OAAU;GAAE,GAAG;GAAM,WAAW;EAAK,EAAE,GAEjD,QAAQ,QAAQ,EAAQ,IAAI,CAAM,CAAC,CAAC,CAC/B,MAAM,MAAQ;GACX,IAAI,GAAW;GACf,IAAM,IAAS,EAAU,CAAG;GAC5B,EAAS;IAAE,SAAS,EAAO;IAAK,WAAW;IAAO,QAAQ,EAAO;GAAO,CAAC;EAC7E,CAAC,CAAC,CACD,OAAO,MAAmB;GACnB,KACJ,EAAS;IACL,SAAS;IACT,WAAW;IACX,QAAQ,aAAiB,QAAQ,EAAM,UAAU;GACrD,CAAC;EACL,CAAC,SAEQ;GACT,IAAY;EAChB;CAGJ,GAAG,CAAC,GAAS,CAAS,CAAC,GAEhB;AACX"}

package/dist/app/AppProviders.cjs

@@ -0,0 +1,2 @@
+const e=require("../query/QueryProvider.cjs"),t=require("../theme/ThemeProvider.cjs"),n=require("../i18n/I18nProvider.cjs"),r=require("../error-boundary/ErrorBoundary.cjs");let i=require("react/jsx-runtime");function a({children:a,query:o,theme:s,i18n:c,errorBoundary:l}){let u=a;return c&&(u=(0,i.jsx)(n.I18nProvider,{...c,children:u})),s!==!1&&(u=(0,i.jsx)(t.ThemeProvider,{...s||{},children:u})),o!==!1&&(u=(0,i.jsx)(e.QueryProvider,{...o||{},children:u})),l&&(u=(0,i.jsx)(r.ErrorBoundary,{...l,children:u})),(0,i.jsx)(i.Fragment,{children:u})}exports.AppProviders=a;
+//# sourceMappingURL=AppProviders.cjs.map

package/dist/app/AppProviders.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppProviders.cjs","names":[],"sources":["../../src/app/AppProviders.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { QueryProvider } from \"../query/QueryProvider\";\nimport type { QueryProviderProps } from \"../query/QueryProvider\";\nimport { ThemeProvider } from \"../theme/ThemeProvider\";\nimport type { ThemeProviderProps } from \"../theme/ThemeProvider\";\nimport { I18nProvider } from \"../i18n/I18nProvider\";\nimport type { I18nProviderProps } from \"../i18n/I18nProvider\";\nimport { ErrorBoundary } from \"../error-boundary/ErrorBoundary\";\nimport type { ErrorBoundaryProps } from \"../error-boundary/ErrorBoundary\";\n\nexport interface AppProvidersProps {\n    children: ReactNode;\n    /**\n     * TanStack Query config. Enabled by default with SDK defaults; pass `false`\n     * to opt out (e.g. the app already mounts its own `QueryProvider`).\n     */\n    query?: Omit<QueryProviderProps, \"children\"> | false;\n    /**\n     * Theme config. Enabled by default; pass `false` to opt out.\n     */\n    theme?: Omit<ThemeProviderProps, \"children\"> | false;\n    /**\n     * i18n config. Opt-in: provide `locale` + `messages` to mount the provider.\n     */\n    i18n?: Omit<I18nProviderProps, \"children\">;\n    /**\n     * Top-level error boundary. Opt-in: provide a `fallback` to wrap the tree.\n     */\n    errorBoundary?: Omit<ErrorBoundaryProps, \"children\">;\n}\n\n/**\n * Compose the Tempest app-wide providers in one place: error boundary →\n * TanStack Query → theme → i18n. Query and theme are on by default; i18n and\n * the error boundary mount only when configured. Each provider can be disabled\n * or tuned independently, so an app's `main.tsx` stays a single declarative\n * block instead of a hand-nested provider pyramid.\n *\n * @example\n * <AppProviders\n *     errorBoundary={{ fallback: <Crash /> }}\n *     i18n={{ locale: \"pt-BR\", messages }}\n * >\n *     <AppRouter routes={routes} />\n * </AppProviders>\n */\nexport function AppProviders({ children, query, theme, i18n, errorBoundary }: AppProvidersProps) {\n    let tree: ReactNode = children;\n\n    if (i18n) {\n        tree = <I18nProvider {...i18n}>{tree}</I18nProvider>;\n    }\n\n    if (theme !== false) {\n        tree = <ThemeProvider {...(theme || {})}>{tree}</ThemeProvider>;\n    }\n\n    if (query !== false) {\n        tree = <QueryProvider {...(query || {})}>{tree}</QueryProvider>;\n    }\n\n    if (errorBoundary) {\n        tree = <ErrorBoundary {...errorBoundary}>{tree}</ErrorBoundary>;\n    }\n\n    return <>{tree}</>;\n}\n"],"mappings":"gNA8CA,SAAgB,EAAa,CAAE,WAAU,QAAO,QAAO,OAAM,iBAAoC,CAC7F,IAAI,EAAkB,EAkBtB,OAhBI,IACA,GAAO,EAAA,EAAA,IAAA,CAAC,EAAA,aAAD,CAAc,GAAI,WAAO,CAAmB,CAAA,GAGnD,IAAU,KACV,GAAO,EAAA,EAAA,IAAA,CAAC,EAAA,cAAD,CAAe,GAAK,GAAS,CAAC,WAAK,CAAoB,CAAA,GAG9D,IAAU,KACV,GAAO,EAAA,EAAA,IAAA,CAAC,EAAA,cAAD,CAAe,GAAK,GAAS,CAAC,WAAK,CAAoB,CAAA,GAG9D,IACA,GAAO,EAAA,EAAA,IAAA,CAAC,EAAA,cAAD,CAAe,GAAI,WAAgB,CAAoB,CAAA,IAG3D,EAAA,EAAA,IAAA,CAAA,EAAA,SAAA,CAAA,SAAG,CAAO,CAAA,CACrB"}

package/dist/app/AppProviders.js

@@ -0,0 +1,26 @@
+import { QueryProvider as e } from "../query/QueryProvider.js";
+import { ThemeProvider as t } from "../theme/ThemeProvider.js";
+import { I18nProvider as n } from "../i18n/I18nProvider.js";
+import { ErrorBoundary as r } from "../error-boundary/ErrorBoundary.js";
+import { Fragment as i, jsx as a } from "react/jsx-runtime";
+//#region src/app/AppProviders.tsx
+function o({ children: o, query: s, theme: c, i18n: l, errorBoundary: u }) {
+	let d = o;
+	return l && (d = /* @__PURE__ */ a(n, {
+		...l,
+		children: d
+	})), c !== !1 && (d = /* @__PURE__ */ a(t, {
+		...c || {},
+		children: d
+	})), s !== !1 && (d = /* @__PURE__ */ a(e, {
+		...s || {},
+		children: d
+	})), u && (d = /* @__PURE__ */ a(r, {
+		...u,
+		children: d
+	})), /* @__PURE__ */ a(i, { children: d });
+}
+//#endregion
+export { o as AppProviders };
+
+//# sourceMappingURL=AppProviders.js.map

package/dist/app/AppProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppProviders.js","names":[],"sources":["../../src/app/AppProviders.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { QueryProvider } from \"../query/QueryProvider\";\nimport type { QueryProviderProps } from \"../query/QueryProvider\";\nimport { ThemeProvider } from \"../theme/ThemeProvider\";\nimport type { ThemeProviderProps } from \"../theme/ThemeProvider\";\nimport { I18nProvider } from \"../i18n/I18nProvider\";\nimport type { I18nProviderProps } from \"../i18n/I18nProvider\";\nimport { ErrorBoundary } from \"../error-boundary/ErrorBoundary\";\nimport type { ErrorBoundaryProps } from \"../error-boundary/ErrorBoundary\";\n\nexport interface AppProvidersProps {\n    children: ReactNode;\n    /**\n     * TanStack Query config. Enabled by default with SDK defaults; pass `false`\n     * to opt out (e.g. the app already mounts its own `QueryProvider`).\n     */\n    query?: Omit<QueryProviderProps, \"children\"> | false;\n    /**\n     * Theme config. Enabled by default; pass `false` to opt out.\n     */\n    theme?: Omit<ThemeProviderProps, \"children\"> | false;\n    /**\n     * i18n config. Opt-in: provide `locale` + `messages` to mount the provider.\n     */\n    i18n?: Omit<I18nProviderProps, \"children\">;\n    /**\n     * Top-level error boundary. Opt-in: provide a `fallback` to wrap the tree.\n     */\n    errorBoundary?: Omit<ErrorBoundaryProps, \"children\">;\n}\n\n/**\n * Compose the Tempest app-wide providers in one place: error boundary →\n * TanStack Query → theme → i18n. Query and theme are on by default; i18n and\n * the error boundary mount only when configured. Each provider can be disabled\n * or tuned independently, so an app's `main.tsx` stays a single declarative\n * block instead of a hand-nested provider pyramid.\n *\n * @example\n * <AppProviders\n *     errorBoundary={{ fallback: <Crash /> }}\n *     i18n={{ locale: \"pt-BR\", messages }}\n * >\n *     <AppRouter routes={routes} />\n * </AppProviders>\n */\nexport function AppProviders({ children, query, theme, i18n, errorBoundary }: AppProvidersProps) {\n    let tree: ReactNode = children;\n\n    if (i18n) {\n        tree = <I18nProvider {...i18n}>{tree}</I18nProvider>;\n    }\n\n    if (theme !== false) {\n        tree = <ThemeProvider {...(theme || {})}>{tree}</ThemeProvider>;\n    }\n\n    if (query !== false) {\n        tree = <QueryProvider {...(query || {})}>{tree}</QueryProvider>;\n    }\n\n    if (errorBoundary) {\n        tree = <ErrorBoundary {...errorBoundary}>{tree}</ErrorBoundary>;\n    }\n\n    return <>{tree}</>;\n}\n"],"mappings":";;;;;;AA8CA,SAAgB,EAAa,EAAE,aAAU,UAAO,UAAO,SAAM,oBAAoC;CAC7F,IAAI,IAAkB;CAkBtB,OAhBI,MACA,IAAO,kBAAC,GAAD;EAAc,GAAI;YAAO;CAAmB,CAAA,IAGnD,MAAU,OACV,IAAO,kBAAC,GAAD;EAAe,GAAK,KAAS,CAAC;YAAK;CAAoB,CAAA,IAG9D,MAAU,OACV,IAAO,kBAAC,GAAD;EAAe,GAAK,KAAS,CAAC;YAAK;CAAoB,CAAA,IAG9D,MACA,IAAO,kBAAC,GAAD;EAAe,GAAI;YAAgB;CAAoB,CAAA,IAG3D,kBAAA,GAAA,EAAA,UAAG,EAAO,CAAA;AACrB"}

package/dist/audio/audio-player.cjs

@@ -0,0 +1,2 @@
+function e(){let e=null;async function t(t,{volume:n=1,loop:r=!1,autoplay:i=!0,stopPrevious:a=!1,onEnded:o,onError:s}={}){try{a&&e&&(e.pause(),e.currentTime=0);let c=new Audio(t);return c.volume=Math.max(0,Math.min(1,n)),c.loop=r,c.preload=`auto`,o&&(c.onended=o),s&&(c.onerror=e=>s(e)),e=c,i&&await c.play(),c}catch(e){return s?.(e),null}}function n(){e&&(e.pause(),e.currentTime=0)}return{play:t,stop:n,current:()=>e}}var t=null;function n(){return t||=e(),t}async function r(e,t){return n().play(e,t)}function i(){n().stop()}exports.createAudioPlayer=e,exports.playAudio=r,exports.stopAudio=i;
+//# sourceMappingURL=audio-player.cjs.map

package/dist/audio/audio-player.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"audio-player.cjs","names":[],"sources":["../../src/audio/audio-player.ts"],"sourcesContent":["export interface PlayAudioOptions {\n    /** Volume between 0 and 1. Default: 1. */\n    volume?: number;\n    /** Loop the clip. Default: false. */\n    loop?: boolean;\n    /** Begin playback immediately. Default: true. */\n    autoplay?: boolean;\n    /** Stop the previous clip managed by this player. Default: false. */\n    stopPrevious?: boolean;\n    /** Fired when playback ends naturally. */\n    onEnded?: () => void;\n    /** Fired on playback error. */\n    onError?: (error: unknown) => void;\n}\n\nexport interface AudioPlayer {\n    /** Play `src`. Returns the underlying element, or `null` when the browser blocked autoplay. */\n    play: (src: string, options?: PlayAudioOptions) => Promise<HTMLAudioElement | null>;\n    /** Stop the currently-playing clip and rewind it. */\n    stop: () => void;\n    /** Currently playing audio element, or `null`. */\n    current: () => HTMLAudioElement | null;\n}\n\n/**\n * Create an isolated audio player that tracks a single \"current\" clip.\n * Multiple players coexist independently; use this when several layers of UI\n * need their own playback state.\n */\nexport function createAudioPlayer(): AudioPlayer {\n    let current: HTMLAudioElement | null = null;\n\n    async function play(\n        src: string,\n        {\n            volume = 1,\n            loop = false,\n            autoplay = true,\n            stopPrevious = false,\n            onEnded,\n            onError,\n        }: PlayAudioOptions = {},\n    ): Promise<HTMLAudioElement | null> {\n        try {\n            if (stopPrevious && current) {\n                current.pause();\n                current.currentTime = 0;\n            }\n            const audio = new Audio(src);\n            audio.volume = Math.max(0, Math.min(1, volume));\n            audio.loop = loop;\n            audio.preload = \"auto\";\n            if (onEnded) audio.onended = onEnded;\n            if (onError) audio.onerror = (event) => onError(event);\n            current = audio;\n            if (autoplay) await audio.play();\n            return audio;\n        } catch (error) {\n            onError?.(error);\n            return null;\n        }\n    }\n\n    function stop(): void {\n        if (!current) return;\n        current.pause();\n        current.currentTime = 0;\n    }\n\n    return { play, stop, current: () => current };\n}\n\nlet defaultPlayer: AudioPlayer | null = null;\n\nfunction getDefaultPlayer(): AudioPlayer {\n    if (!defaultPlayer) defaultPlayer = createAudioPlayer();\n    return defaultPlayer;\n}\n\n/**\n * Convenience wrapper around a shared {@link AudioPlayer}. Use this for\n * one-off notification sounds. For more complex flows (e.g. several\n * simultaneous channels), build a dedicated player with {@link createAudioPlayer}.\n */\nexport async function playAudio(\n    src: string,\n    options?: PlayAudioOptions,\n): Promise<HTMLAudioElement | null> {\n    return getDefaultPlayer().play(src, options);\n}\n\n/** Stop the clip currently playing on the shared default player. */\nexport function stopAudio(): void {\n    getDefaultPlayer().stop();\n}\n"],"mappings":"AA6BA,SAAgB,GAAiC,CAC7C,IAAI,EAAmC,KAEvC,eAAe,EACX,EACA,CACI,SAAS,EACT,OAAO,GACP,WAAW,GACX,eAAe,GACf,UACA,WACkB,CAAC,EACS,CAChC,GAAI,CACI,GAAgB,IAChB,EAAQ,MAAM,EACd,EAAQ,YAAc,GAE1B,IAAM,EAAQ,IAAI,MAAM,CAAG,EAQ3B,MAPA,GAAM,OAAS,KAAK,IAAI,EAAG,KAAK,IAAI,EAAG,CAAM,CAAC,EAC9C,EAAM,KAAO,EACb,EAAM,QAAU,OACZ,IAAS,EAAM,QAAU,GACzB,IAAS,EAAM,QAAW,GAAU,EAAQ,CAAK,GACrD,EAAU,EACN,GAAU,MAAM,EAAM,KAAK,EACxB,CACX,OAAS,EAAO,CAEZ,OADA,IAAU,CAAK,EACR,IACX,CACJ,CAEA,SAAS,GAAa,CACb,IACL,EAAQ,MAAM,EACd,EAAQ,YAAc,EAC1B,CAEA,MAAO,CAAE,OAAM,OAAM,YAAe,CAAQ,CAChD,CAEA,IAAI,EAAoC,KAExC,SAAS,GAAgC,CAErC,MADA,CAAoB,IAAgB,EAAkB,EAC/C,CACX,CAOA,eAAsB,EAClB,EACA,EACgC,CAChC,OAAO,EAAiB,CAAC,CAAC,KAAK,EAAK,CAAO,CAC/C,CAGA,SAAgB,GAAkB,CAC9B,EAAiB,CAAC,CAAC,KAAK,CAC5B"}

package/dist/audio/audio-player.js

@@ -0,0 +1,35 @@
+//#region src/audio/audio-player.ts
+function e() {
+	let e = null;
+	async function t(t, { volume: n = 1, loop: r = !1, autoplay: i = !0, stopPrevious: a = !1, onEnded: o, onError: s } = {}) {
+		try {
+			a && e && (e.pause(), e.currentTime = 0);
+			let c = new Audio(t);
+			return c.volume = Math.max(0, Math.min(1, n)), c.loop = r, c.preload = "auto", o && (c.onended = o), s && (c.onerror = (e) => s(e)), e = c, i && await c.play(), c;
+		} catch (e) {
+			return s?.(e), null;
+		}
+	}
+	function n() {
+		e && (e.pause(), e.currentTime = 0);
+	}
+	return {
+		play: t,
+		stop: n,
+		current: () => e
+	};
+}
+var t = null;
+function n() {
+	return t ||= e(), t;
+}
+async function r(e, t) {
+	return n().play(e, t);
+}
+function i() {
+	n().stop();
+}
+//#endregion
+export { e as createAudioPlayer, r as playAudio, i as stopAudio };
+
+//# sourceMappingURL=audio-player.js.map

package/dist/audio/audio-player.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audio-player.js","names":[],"sources":["../../src/audio/audio-player.ts"],"sourcesContent":["export interface PlayAudioOptions {\n    /** Volume between 0 and 1. Default: 1. */\n    volume?: number;\n    /** Loop the clip. Default: false. */\n    loop?: boolean;\n    /** Begin playback immediately. Default: true. */\n    autoplay?: boolean;\n    /** Stop the previous clip managed by this player. Default: false. */\n    stopPrevious?: boolean;\n    /** Fired when playback ends naturally. */\n    onEnded?: () => void;\n    /** Fired on playback error. */\n    onError?: (error: unknown) => void;\n}\n\nexport interface AudioPlayer {\n    /** Play `src`. Returns the underlying element, or `null` when the browser blocked autoplay. */\n    play: (src: string, options?: PlayAudioOptions) => Promise<HTMLAudioElement | null>;\n    /** Stop the currently-playing clip and rewind it. */\n    stop: () => void;\n    /** Currently playing audio element, or `null`. */\n    current: () => HTMLAudioElement | null;\n}\n\n/**\n * Create an isolated audio player that tracks a single \"current\" clip.\n * Multiple players coexist independently; use this when several layers of UI\n * need their own playback state.\n */\nexport function createAudioPlayer(): AudioPlayer {\n    let current: HTMLAudioElement | null = null;\n\n    async function play(\n        src: string,\n        {\n            volume = 1,\n            loop = false,\n            autoplay = true,\n            stopPrevious = false,\n            onEnded,\n            onError,\n        }: PlayAudioOptions = {},\n    ): Promise<HTMLAudioElement | null> {\n        try {\n            if (stopPrevious && current) {\n                current.pause();\n                current.currentTime = 0;\n            }\n            const audio = new Audio(src);\n            audio.volume = Math.max(0, Math.min(1, volume));\n            audio.loop = loop;\n            audio.preload = \"auto\";\n            if (onEnded) audio.onended = onEnded;\n            if (onError) audio.onerror = (event) => onError(event);\n            current = audio;\n            if (autoplay) await audio.play();\n            return audio;\n        } catch (error) {\n            onError?.(error);\n            return null;\n        }\n    }\n\n    function stop(): void {\n        if (!current) return;\n        current.pause();\n        current.currentTime = 0;\n    }\n\n    return { play, stop, current: () => current };\n}\n\nlet defaultPlayer: AudioPlayer | null = null;\n\nfunction getDefaultPlayer(): AudioPlayer {\n    if (!defaultPlayer) defaultPlayer = createAudioPlayer();\n    return defaultPlayer;\n}\n\n/**\n * Convenience wrapper around a shared {@link AudioPlayer}. Use this for\n * one-off notification sounds. For more complex flows (e.g. several\n * simultaneous channels), build a dedicated player with {@link createAudioPlayer}.\n */\nexport async function playAudio(\n    src: string,\n    options?: PlayAudioOptions,\n): Promise<HTMLAudioElement | null> {\n    return getDefaultPlayer().play(src, options);\n}\n\n/** Stop the clip currently playing on the shared default player. */\nexport function stopAudio(): void {\n    getDefaultPlayer().stop();\n}\n"],"mappings":";AA6BA,SAAgB,IAAiC;CAC7C,IAAI,IAAmC;CAEvC,eAAe,EACX,GACA,EACI,YAAS,GACT,UAAO,IACP,cAAW,IACX,kBAAe,IACf,YACA,eACkB,CAAC,GACS;EAChC,IAAI;GACA,AAAI,KAAgB,MAChB,EAAQ,MAAM,GACd,EAAQ,cAAc;GAE1B,IAAM,IAAQ,IAAI,MAAM,CAAG;GAQ3B,OAPA,EAAM,SAAS,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,CAAM,CAAC,GAC9C,EAAM,OAAO,GACb,EAAM,UAAU,QACZ,MAAS,EAAM,UAAU,IACzB,MAAS,EAAM,WAAW,MAAU,EAAQ,CAAK,IACrD,IAAU,GACN,KAAU,MAAM,EAAM,KAAK,GACxB;EACX,SAAS,GAAO;GAEZ,OADA,IAAU,CAAK,GACR;EACX;CACJ;CAEA,SAAS,IAAa;EACb,MACL,EAAQ,MAAM,GACd,EAAQ,cAAc;CAC1B;CAEA,OAAO;EAAE;EAAM;EAAM,eAAe;CAAQ;AAChD;AAEA,IAAI,IAAoC;AAExC,SAAS,IAAgC;CAErC,OADA,AAAoB,MAAgB,EAAkB,GAC/C;AACX;AAOA,eAAsB,EAClB,GACA,GACgC;CAChC,OAAO,EAAiB,CAAC,CAAC,KAAK,GAAK,CAAO;AAC/C;AAGA,SAAgB,IAAkB;CAC9B,EAAiB,CAAC,CAAC,KAAK;AAC5B"}

package/dist/audio/use-audio.cjs

@@ -0,0 +1,2 @@
+const e=require("./audio-player.cjs");let t=require("react");function n(){let n=(0,t.useRef)(null),[r,i]=(0,t.useState)(!1);return n.current||=e.createAudioPlayer(),(0,t.useEffect)(()=>()=>{n.current?.stop()},[]),{play:(0,t.useCallback)(async(e,t)=>{await n.current.play(e,t)&&i(!0)},[]),stop:(0,t.useCallback)(()=>{n.current?.stop()},[]),unlocked:r}}exports.useAudio=n;
+//# sourceMappingURL=use-audio.cjs.map

package/dist/audio/use-audio.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-audio.cjs","names":[],"sources":["../../src/audio/use-audio.ts"],"sourcesContent":["import { useCallback, useEffect, useRef, useState } from \"react\";\nimport { createAudioPlayer, type AudioPlayer, type PlayAudioOptions } from \"./audio-player\";\n\nexport interface UseAudioResult {\n    /** Play `src` on the hook's private player. */\n    play: (src: string, options?: PlayAudioOptions) => Promise<void>;\n    /** Stop the current clip. */\n    stop: () => void;\n    /**\n     * Whether the browser's autoplay policy has been satisfied. Becomes\n     * `true` after the first successful `play()`.\n     */\n    unlocked: boolean;\n}\n\n/**\n * Hook-managed audio player. Each component instance gets its own\n * {@link AudioPlayer}, so unmounting cleanly stops playback. Useful for\n * notification chimes, UI feedback sounds, and per-component soundtracks.\n */\nexport function useAudio(): UseAudioResult {\n    const playerRef = useRef<AudioPlayer | null>(null);\n    const [unlocked, setUnlocked] = useState<boolean>(false);\n\n    if (!playerRef.current) {\n        playerRef.current = createAudioPlayer();\n    }\n\n    useEffect(() => {\n        return () => {\n            playerRef.current?.stop();\n        };\n    }, []);\n\n    const play = useCallback(async (src: string, options?: PlayAudioOptions): Promise<void> => {\n        const result = await playerRef.current!.play(src, options);\n        if (result) setUnlocked(true);\n    }, []);\n\n    const stop = useCallback((): void => {\n        playerRef.current?.stop();\n    }, []);\n\n    return { play, stop, unlocked };\n}\n"],"mappings":"6DAoBA,SAAgB,GAA2B,CACvC,IAAM,GAAA,EAAA,EAAA,OAAA,CAAuC,IAAI,EAC3C,CAAC,EAAU,IAAA,EAAA,EAAA,SAAA,CAAiC,EAAK,EAqBvD,MAnBA,CACI,EAAU,UAAU,EAAA,kBAAkB,GAG1C,EAAA,EAAA,UAAA,SACiB,CACT,EAAU,SAAS,KAAK,CAC5B,EACD,CAAC,CAAC,EAWE,CAAE,MAAA,EAAA,EAAA,YAAA,CATgB,MAAO,EAAa,IAA8C,CAEnF,MADiB,EAAU,QAAS,KAAK,EAAK,CAAO,GAC7C,EAAY,EAAI,CAChC,EAAG,CAAC,CAMK,EAAM,MAAA,EAAA,EAAA,YAAA,KAJsB,CACjC,EAAU,SAAS,KAAK,CAC5B,EAAG,CAAC,CAEW,EAAM,UAAS,CAClC"}

package/dist/audio/use-audio.js

@@ -0,0 +1,21 @@
+import { createAudioPlayer as e } from "./audio-player.js";
+import { useCallback as t, useEffect as n, useRef as r, useState as i } from "react";
+//#region src/audio/use-audio.ts
+function a() {
+	let a = r(null), [o, s] = i(!1);
+	return a.current ||= e(), n(() => () => {
+		a.current?.stop();
+	}, []), {
+		play: t(async (e, t) => {
+			await a.current.play(e, t) && s(!0);
+		}, []),
+		stop: t(() => {
+			a.current?.stop();
+		}, []),
+		unlocked: o
+	};
+}
+//#endregion
+export { a as useAudio };
+
+//# sourceMappingURL=use-audio.js.map

package/dist/audio/use-audio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-audio.js","names":[],"sources":["../../src/audio/use-audio.ts"],"sourcesContent":["import { useCallback, useEffect, useRef, useState } from \"react\";\nimport { createAudioPlayer, type AudioPlayer, type PlayAudioOptions } from \"./audio-player\";\n\nexport interface UseAudioResult {\n    /** Play `src` on the hook's private player. */\n    play: (src: string, options?: PlayAudioOptions) => Promise<void>;\n    /** Stop the current clip. */\n    stop: () => void;\n    /**\n     * Whether the browser's autoplay policy has been satisfied. Becomes\n     * `true` after the first successful `play()`.\n     */\n    unlocked: boolean;\n}\n\n/**\n * Hook-managed audio player. Each component instance gets its own\n * {@link AudioPlayer}, so unmounting cleanly stops playback. Useful for\n * notification chimes, UI feedback sounds, and per-component soundtracks.\n */\nexport function useAudio(): UseAudioResult {\n    const playerRef = useRef<AudioPlayer | null>(null);\n    const [unlocked, setUnlocked] = useState<boolean>(false);\n\n    if (!playerRef.current) {\n        playerRef.current = createAudioPlayer();\n    }\n\n    useEffect(() => {\n        return () => {\n            playerRef.current?.stop();\n        };\n    }, []);\n\n    const play = useCallback(async (src: string, options?: PlayAudioOptions): Promise<void> => {\n        const result = await playerRef.current!.play(src, options);\n        if (result) setUnlocked(true);\n    }, []);\n\n    const stop = useCallback((): void => {\n        playerRef.current?.stop();\n    }, []);\n\n    return { play, stop, unlocked };\n}\n"],"mappings":";;;AAoBA,SAAgB,IAA2B;CACvC,IAAM,IAAY,EAA2B,IAAI,GAC3C,CAAC,GAAU,KAAe,EAAkB,EAAK;CAqBvD,OAnBA,AACI,EAAU,YAAU,EAAkB,GAG1C,cACiB;EACT,EAAU,SAAS,KAAK;CAC5B,GACD,CAAC,CAAC,GAWE;EAAE,MATI,EAAY,OAAO,GAAa,MAA8C;GAEvF,AAAI,MADiB,EAAU,QAAS,KAAK,GAAK,CAAO,KAC7C,EAAY,EAAI;EAChC,GAAG,CAAC,CAMK;EAAM,MAJF,QAAwB;GACjC,EAAU,SAAS,KAAK;EAC5B,GAAG,CAAC,CAEW;EAAM;CAAS;AAClC"}

package/dist/auth/AuthGuard.cjs

@@ -0,0 +1,2 @@
+let e=require("react/jsx-runtime");function t({isAuthenticated:t,children:n,fallback:r}){return(0,e.jsx)(e.Fragment,{children:t?n:r})}exports.AuthGuard=t;
+//# sourceMappingURL=AuthGuard.cjs.map

package/dist/auth/AuthGuard.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthGuard.cjs","names":[],"sources":["../../src/auth/AuthGuard.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\n\nexport interface AuthGuardProps {\n    /** Whether the current user is authenticated. */\n    isAuthenticated: boolean;\n    /** Element to render when authenticated. */\n    children: ReactNode;\n    /** Element to render when not authenticated. Use this to redirect (e.g. `<Navigate to=\"/login\" />`). */\n    fallback: ReactNode;\n}\n\n/**\n * Router-agnostic auth gate. The caller decides what to render in either\n * branch — typically `<Outlet />` for protected layouts and `<Navigate />` for\n * the redirect. Pair with {@link createAuthStore} or any custom auth source.\n *\n * @example\n * <AuthGuard\n *     isAuthenticated={useAuthStore((s) => s.isAuthenticated)}\n *     fallback={<Navigate to=\"/login\" replace />}\n * >\n *     <Outlet />\n * </AuthGuard>\n */\nexport function AuthGuard({ isAuthenticated, children, fallback }: AuthGuardProps) {\n    return <>{isAuthenticated ? children : fallback}</>;\n}\n"],"mappings":"mCAwBA,SAAgB,EAAU,CAAE,kBAAiB,WAAU,YAA4B,CAC/E,OAAO,EAAA,EAAA,IAAA,CAAA,EAAA,SAAA,CAAA,SAAG,EAAkB,EAAW,CAAW,CAAA,CACtD"}

package/dist/auth/AuthGuard.js

@@ -0,0 +1,9 @@
+import { Fragment as e, jsx as t } from "react/jsx-runtime";
+//#region src/auth/AuthGuard.tsx
+function n({ isAuthenticated: n, children: r, fallback: i }) {
+	return /* @__PURE__ */ t(e, { children: n ? r : i });
+}
+//#endregion
+export { n as AuthGuard };
+
+//# sourceMappingURL=AuthGuard.js.map

package/dist/auth/AuthGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthGuard.js","names":[],"sources":["../../src/auth/AuthGuard.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\n\nexport interface AuthGuardProps {\n    /** Whether the current user is authenticated. */\n    isAuthenticated: boolean;\n    /** Element to render when authenticated. */\n    children: ReactNode;\n    /** Element to render when not authenticated. Use this to redirect (e.g. `<Navigate to=\"/login\" />`). */\n    fallback: ReactNode;\n}\n\n/**\n * Router-agnostic auth gate. The caller decides what to render in either\n * branch — typically `<Outlet />` for protected layouts and `<Navigate />` for\n * the redirect. Pair with {@link createAuthStore} or any custom auth source.\n *\n * @example\n * <AuthGuard\n *     isAuthenticated={useAuthStore((s) => s.isAuthenticated)}\n *     fallback={<Navigate to=\"/login\" replace />}\n * >\n *     <Outlet />\n * </AuthGuard>\n */\nexport function AuthGuard({ isAuthenticated, children, fallback }: AuthGuardProps) {\n    return <>{isAuthenticated ? children : fallback}</>;\n}\n"],"mappings":";;AAwBA,SAAgB,EAAU,EAAE,oBAAiB,aAAU,eAA4B;CAC/E,OAAO,kBAAA,GAAA,EAAA,UAAG,IAAkB,IAAW,EAAW,CAAA;AACtD"}

package/dist/auth/create-auth-store.cjs

@@ -0,0 +1,2 @@
+let e=require("zustand"),t=require("zustand/middleware");function n(n={}){let r=n.name??`tempest-auth`,i=n.storage===`session`?()=>sessionStorage:()=>localStorage;return(0,e.create)()((0,t.persist)(e=>({user:n.initialUser??null,token:n.initialToken??null,isAuthenticated:!!n.initialToken,setSession:({user:t,token:n})=>e({user:t,token:n,isAuthenticated:!0}),setUser:t=>e({user:t}),setToken:t=>e({token:t,isAuthenticated:!!t}),logout:()=>e({user:null,token:null,isAuthenticated:!1})}),{name:r,storage:(0,t.createJSONStorage)(i),partialize:e=>({user:e.user,token:e.token}),onRehydrateStorage:()=>e=>{e&&(e.isAuthenticated=!!e.token)}}))}exports.createAuthStore=n;
+//# sourceMappingURL=create-auth-store.cjs.map

package/dist/auth/create-auth-store.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-auth-store.cjs","names":[],"sources":["../../src/auth/create-auth-store.ts"],"sourcesContent":["import { create } from \"zustand\";\nimport { persist, createJSONStorage } from \"zustand/middleware\";\n\nexport interface AuthState<TUser> {\n    user: TUser | null;\n    token: string | null;\n    isAuthenticated: boolean;\n    setSession: (session: { user: TUser; token: string }) => void;\n    setUser: (user: TUser | null) => void;\n    setToken: (token: string | null) => void;\n    logout: () => void;\n}\n\nexport interface CreateAuthStoreOptions<TUser> {\n    /** Persist key used in storage (default: \"tempest-auth\"). */\n    name?: string;\n    /** Which storage to persist into (default: localStorage). */\n    storage?: \"local\" | \"session\";\n    /** Initial user (useful for SSR hydration). */\n    initialUser?: TUser | null;\n    /** Initial token. */\n    initialToken?: string | null;\n}\n\n/**\n * Build a typed Zustand auth store with `persist` middleware. Each app passes\n * its own `TUser` shape so the SDK does not own the user model.\n *\n * @example\n * const useAuthStore = createAuthStore<UserResponse>();\n * const { user, token, logout } = useAuthStore();\n */\nexport function createAuthStore<TUser>(options: CreateAuthStoreOptions<TUser> = {}) {\n    const name = options.name ?? \"tempest-auth\";\n    const storageImpl = options.storage === \"session\" ? () => sessionStorage : () => localStorage;\n\n    return create<AuthState<TUser>>()(\n        persist(\n            (set) => ({\n                user: options.initialUser ?? null,\n                token: options.initialToken ?? null,\n                isAuthenticated: !!options.initialToken,\n                setSession: ({ user, token }) => set({ user, token, isAuthenticated: true }),\n                setUser: (user) => set({ user }),\n                setToken: (token) => set({ token, isAuthenticated: !!token }),\n                logout: () => set({ user: null, token: null, isAuthenticated: false }),\n            }),\n            {\n                name,\n                storage: createJSONStorage(storageImpl),\n                partialize: (state) => ({ user: state.user, token: state.token }),\n                onRehydrateStorage: () => (state) => {\n                    if (state) state.isAuthenticated = !!state.token;\n                },\n            },\n        ),\n    );\n}\n"],"mappings":"yDAgCA,SAAgB,EAAuB,EAAyC,CAAC,EAAG,CAChF,IAAM,EAAO,EAAQ,MAAQ,eACvB,EAAc,EAAQ,UAAY,cAAkB,mBAAuB,aAEjF,OAAA,EAAA,EAAA,OAAA,CAAgC,CAAC,EAAA,EAAA,EAAA,QAAA,CAExB,IAAS,CACN,KAAM,EAAQ,aAAe,KAC7B,MAAO,EAAQ,cAAgB,KAC/B,gBAAiB,CAAC,CAAC,EAAQ,aAC3B,YAAa,CAAE,OAAM,WAAY,EAAI,CAAE,OAAM,QAAO,gBAAiB,EAAK,CAAC,EAC3E,QAAU,GAAS,EAAI,CAAE,MAAK,CAAC,EAC/B,SAAW,GAAU,EAAI,CAAE,QAAO,gBAAiB,CAAC,CAAC,CAAM,CAAC,EAC5D,WAAc,EAAI,CAAE,KAAM,KAAM,MAAO,KAAM,gBAAiB,EAAM,CAAC,CACzE,GACA,CACI,OACA,SAAA,EAAA,EAAA,kBAAA,CAA2B,CAAW,EACtC,WAAa,IAAW,CAAE,KAAM,EAAM,KAAM,MAAO,EAAM,KAAM,GAC/D,uBAA2B,GAAU,CAC7B,IAAO,EAAM,gBAAkB,CAAC,CAAC,EAAM,MAC/C,CACJ,CACJ,CACJ,CACJ"}

package/dist/auth/create-auth-store.js

@@ -0,0 +1,40 @@
+import { create as e } from "zustand";
+import { createJSONStorage as t, persist as n } from "zustand/middleware";
+//#region src/auth/create-auth-store.ts
+function r(r = {}) {
+	let i = r.name ?? "tempest-auth", a = r.storage === "session" ? () => sessionStorage : () => localStorage;
+	return e()(n((e) => ({
+		user: r.initialUser ?? null,
+		token: r.initialToken ?? null,
+		isAuthenticated: !!r.initialToken,
+		setSession: ({ user: t, token: n }) => e({
+			user: t,
+			token: n,
+			isAuthenticated: !0
+		}),
+		setUser: (t) => e({ user: t }),
+		setToken: (t) => e({
+			token: t,
+			isAuthenticated: !!t
+		}),
+		logout: () => e({
+			user: null,
+			token: null,
+			isAuthenticated: !1
+		})
+	}), {
+		name: i,
+		storage: t(a),
+		partialize: (e) => ({
+			user: e.user,
+			token: e.token
+		}),
+		onRehydrateStorage: () => (e) => {
+			e && (e.isAuthenticated = !!e.token);
+		}
+	}));
+}
+//#endregion
+export { r as createAuthStore };
+
+//# sourceMappingURL=create-auth-store.js.map

package/dist/auth/create-auth-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-auth-store.js","names":[],"sources":["../../src/auth/create-auth-store.ts"],"sourcesContent":["import { create } from \"zustand\";\nimport { persist, createJSONStorage } from \"zustand/middleware\";\n\nexport interface AuthState<TUser> {\n    user: TUser | null;\n    token: string | null;\n    isAuthenticated: boolean;\n    setSession: (session: { user: TUser; token: string }) => void;\n    setUser: (user: TUser | null) => void;\n    setToken: (token: string | null) => void;\n    logout: () => void;\n}\n\nexport interface CreateAuthStoreOptions<TUser> {\n    /** Persist key used in storage (default: \"tempest-auth\"). */\n    name?: string;\n    /** Which storage to persist into (default: localStorage). */\n    storage?: \"local\" | \"session\";\n    /** Initial user (useful for SSR hydration). */\n    initialUser?: TUser | null;\n    /** Initial token. */\n    initialToken?: string | null;\n}\n\n/**\n * Build a typed Zustand auth store with `persist` middleware. Each app passes\n * its own `TUser` shape so the SDK does not own the user model.\n *\n * @example\n * const useAuthStore = createAuthStore<UserResponse>();\n * const { user, token, logout } = useAuthStore();\n */\nexport function createAuthStore<TUser>(options: CreateAuthStoreOptions<TUser> = {}) {\n    const name = options.name ?? \"tempest-auth\";\n    const storageImpl = options.storage === \"session\" ? () => sessionStorage : () => localStorage;\n\n    return create<AuthState<TUser>>()(\n        persist(\n            (set) => ({\n                user: options.initialUser ?? null,\n                token: options.initialToken ?? null,\n                isAuthenticated: !!options.initialToken,\n                setSession: ({ user, token }) => set({ user, token, isAuthenticated: true }),\n                setUser: (user) => set({ user }),\n                setToken: (token) => set({ token, isAuthenticated: !!token }),\n                logout: () => set({ user: null, token: null, isAuthenticated: false }),\n            }),\n            {\n                name,\n                storage: createJSONStorage(storageImpl),\n                partialize: (state) => ({ user: state.user, token: state.token }),\n                onRehydrateStorage: () => (state) => {\n                    if (state) state.isAuthenticated = !!state.token;\n                },\n            },\n        ),\n    );\n}\n"],"mappings":";;;AAgCA,SAAgB,EAAuB,IAAyC,CAAC,GAAG;CAChF,IAAM,IAAO,EAAQ,QAAQ,gBACvB,IAAc,EAAQ,YAAY,kBAAkB,uBAAuB;CAEjF,OAAO,EAAyB,CAAC,CAC7B,GACK,OAAS;EACN,MAAM,EAAQ,eAAe;EAC7B,OAAO,EAAQ,gBAAgB;EAC/B,iBAAiB,CAAC,CAAC,EAAQ;EAC3B,aAAa,EAAE,SAAM,eAAY,EAAI;GAAE;GAAM;GAAO,iBAAiB;EAAK,CAAC;EAC3E,UAAU,MAAS,EAAI,EAAE,QAAK,CAAC;EAC/B,WAAW,MAAU,EAAI;GAAE;GAAO,iBAAiB,CAAC,CAAC;EAAM,CAAC;EAC5D,cAAc,EAAI;GAAE,MAAM;GAAM,OAAO;GAAM,iBAAiB;EAAM,CAAC;CACzE,IACA;EACI;EACA,SAAS,EAAkB,CAAW;EACtC,aAAa,OAAW;GAAE,MAAM,EAAM;GAAM,OAAO,EAAM;EAAM;EAC/D,2BAA2B,MAAU;GACjC,AAAI,MAAO,EAAM,kBAAkB,CAAC,CAAC,EAAM;EAC/C;CACJ,CACJ,CACJ;AACJ"}

package/dist/auth/create-tempest-auth.cjs

@@ -0,0 +1,2 @@
+const e=require("../http/api-client.cjs"),t=require("./create-auth-store.cjs"),n=require("./refresh-queue.cjs");function r(e){let t=e??{};return{token:t.access_token,refreshToken:t.refresh_token}}function i(i){let{baseURL:a,loginPath:o=`/api/auth/login`,refreshPath:s=`/api/auth/refresh`,mePath:c,storeName:l=`tempest-auth`,storage:u=`local`,withCredentials:d=!1,fetcher:f,parseTokens:p=r,parseUser:m,refreshBody:h=e=>e?{refresh_token:e}:void 0}=i,g=t.createAuthStore({name:l,storage:u}),_=`${l}-refresh`;function v(){return typeof window>`u`?null:u===`session`?window.sessionStorage:window.localStorage}function y(){return v()?.getItem(_)??null}function b(e){let t=v();t&&(e?t.setItem(_,e):t.removeItem(_))}let x=()=>g.getState(),S=()=>x().token,C=e.createApiClient({baseURL:a,withCredentials:d,fetcher:f});async function w(){if(!c)return x().user;let t=S(),n=await e.createApiClient({baseURL:a,withCredentials:d,fetcher:f,getToken:()=>t}).get(c);return x().setUser(n),n}async function T(e){let t=await C.post(o,{body:e}),{token:n,refreshToken:r}=p(t);x().setToken(n),b(r??null);let i=m?.(t);return i==null?w():(x().setUser(i),i)}function E(){x().logout(),b(null)}let D=n.createRefreshQueue(async()=>{let e=await C.post(s,{body:h(y())}),{token:t,refreshToken:n}=p(e);x().setToken(t),n&&b(n)});return{useAuthStore:g,api:e.createApiClient({baseURL:a,withCredentials:d,fetcher:f,getToken:S,refresh:D,onUnauthorized:()=>E()}),login:T,logout:E,refresh:D,getToken:S}}exports.createTempestAuth=i;
+//# sourceMappingURL=create-tempest-auth.cjs.map

package/dist/auth/create-tempest-auth.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-tempest-auth.cjs","names":[],"sources":["../../src/auth/create-tempest-auth.ts"],"sourcesContent":["import { createApiClient } from \"../http\";\nimport type { ApiClient } from \"../http\";\nimport { createAuthStore } from \"./create-auth-store\";\nimport type { AuthState } from \"./create-auth-store\";\nimport { createRefreshQueue } from \"./refresh-queue\";\n\n/** The token envelope returned by a Tempest FastAPI SDK login/refresh route. */\nexport interface TempestTokenResponse {\n    /** The bearer access token. */\n    access_token: string;\n    /** Token type — always `\"bearer\"` for the SDK. */\n    token_type?: string;\n    /** Optional refresh token (when the API returns it in the body, not a cookie). */\n    refresh_token?: string;\n}\n\nexport interface CreateTempestAuthOptions<TUser> {\n    /** Base URL of the API. Required. */\n    baseURL: string;\n    /** Login route (`POST`). Default: `\"/api/auth/login\"`. */\n    loginPath?: string;\n    /** Refresh route (`POST`). Default: `\"/api/auth/refresh\"`. */\n    refreshPath?: string;\n    /** Optional current-user route (`GET`) called after login/refresh. */\n    mePath?: string;\n    /** Persist key for the store. Default: `\"tempest-auth\"`. */\n    storeName?: string;\n    /** Storage backend. Default: `\"local\"`. */\n    storage?: \"local\" | \"session\";\n    /** Send cookies (needed when the refresh token lives in an httpOnly cookie). */\n    withCredentials?: boolean;\n    /** Custom fetch implementation (testing / SSR). Defaults to `globalThis.fetch`. */\n    fetcher?: typeof fetch;\n    /**\n     * Extract tokens from a login/refresh response. Default reads\n     * `access_token` + `refresh_token`.\n     */\n    parseTokens?: (data: unknown) => { token: string; refreshToken?: string };\n    /** Pull the user out of the login response, when the API embeds it. */\n    parseUser?: (data: unknown) => TUser | null;\n    /**\n     * Build the refresh request body. Default sends `{ refresh_token }` when a\n     * refresh token is stored, else `undefined` (cookie-based refresh).\n     */\n    refreshBody?: (refreshToken: string | null) => unknown;\n}\n\nexport interface TempestAuth<TUser, TCredentials> {\n    /** The persisted Zustand auth store hook (compatible with `<AuthGuard>`). */\n    useAuthStore: ReturnType<typeof createAuthStore<TUser>>;\n    /** A `createApiClient` wired with bearer auth + 401 → refresh → retry. */\n    api: ApiClient;\n    /** Authenticate, store the session, and resolve the user (or null). */\n    login: (credentials: TCredentials) => Promise<TUser | null>;\n    /** Clear the session (and the stored refresh token). */\n    logout: () => void;\n    /** Refresh the access token (deduplicated across concurrent callers). */\n    refresh: () => Promise<void>;\n    /** The current access token, or null. */\n    getToken: () => string | null;\n}\n\nfunction defaultParseTokens(data: unknown): { token: string; refreshToken?: string } {\n    const d = (data ?? {}) as TempestTokenResponse;\n    return { token: d.access_token, refreshToken: d.refresh_token };\n}\n\n/**\n * Turn-key auth preset wiring `createAuthStore` + `createRefreshQueue` +\n * `createApiClient` to the Tempest FastAPI SDK auth contract: login returns\n * `{ access_token, token_type }`, requests carry `Authorization: Bearer`, and a\n * `401` triggers a single deduplicated refresh + retry. Logout (or a failed\n * refresh) clears the session.\n *\n * @example\n * const auth = createTempestAuth<User, { email: string; password: string }>({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     mePath: \"/api/auth/me\",\n * });\n *\n * await auth.login({ email, password });   // stores session, returns the user\n * const orders = await auth.api.get(\"/api/orders\");  // sends the bearer token\n * auth.logout();\n *\n * @param options - The auth configuration.\n * @returns The store hook, a wired API client, and login/logout/refresh helpers.\n */\nexport function createTempestAuth<TUser, TCredentials = { email: string; password: string }>(\n    options: CreateTempestAuthOptions<TUser>,\n): TempestAuth<TUser, TCredentials> {\n    const {\n        baseURL,\n        loginPath = \"/api/auth/login\",\n        refreshPath = \"/api/auth/refresh\",\n        mePath,\n        storeName = \"tempest-auth\",\n        storage = \"local\",\n        withCredentials = false,\n        fetcher,\n        parseTokens = defaultParseTokens,\n        parseUser,\n        refreshBody = (rt) => (rt ? { refresh_token: rt } : undefined),\n    } = options;\n\n    const useAuthStore = createAuthStore<TUser>({ name: storeName, storage });\n    const refreshKey = `${storeName}-refresh`;\n\n    function storageImpl(): Storage | null {\n        if (typeof window === \"undefined\") return null;\n        return storage === \"session\" ? window.sessionStorage : window.localStorage;\n    }\n    function readRefreshToken(): string | null {\n        return storageImpl()?.getItem(refreshKey) ?? null;\n    }\n    function writeRefreshToken(token: string | null): void {\n        const s = storageImpl();\n        if (!s) return;\n        if (token) s.setItem(refreshKey, token);\n        else s.removeItem(refreshKey);\n    }\n\n    const state = (): AuthState<TUser> => useAuthStore.getState();\n    const getToken = (): string | null => state().token;\n\n    // Bare client (no auth/refresh) used for the login + refresh calls themselves.\n    const bareApi = createApiClient({ baseURL, withCredentials, fetcher });\n\n    async function fetchUser(): Promise<TUser | null> {\n        if (!mePath) return state().user;\n        const token = getToken();\n        const user = await createApiClient({\n            baseURL,\n            withCredentials,\n            fetcher,\n            getToken: () => token,\n        }).get<TUser>(mePath);\n        state().setUser(user);\n        return user;\n    }\n\n    async function login(credentials: TCredentials): Promise<TUser | null> {\n        const data = await bareApi.post<unknown>(loginPath, { body: credentials });\n        const { token, refreshToken } = parseTokens(data);\n        state().setToken(token);\n        writeRefreshToken(refreshToken ?? null);\n        const embedded = parseUser?.(data);\n        if (embedded != null) {\n            state().setUser(embedded);\n            return embedded;\n        }\n        return fetchUser();\n    }\n\n    function logout(): void {\n        state().logout();\n        writeRefreshToken(null);\n    }\n\n    const refresh = createRefreshQueue(async () => {\n        const data = await bareApi.post<unknown>(refreshPath, {\n            body: refreshBody(readRefreshToken()),\n        });\n        const { token, refreshToken } = parseTokens(data);\n        state().setToken(token);\n        if (refreshToken) writeRefreshToken(refreshToken);\n    });\n\n    const api = createApiClient({\n        baseURL,\n        withCredentials,\n        fetcher,\n        getToken,\n        refresh,\n        onUnauthorized: () => logout(),\n    });\n\n    return { useAuthStore, api, login, logout, refresh, getToken };\n}\n"],"mappings":"gHA8DA,SAAS,EAAmB,EAAyD,CACjF,IAAM,EAAK,GAAQ,CAAC,EACpB,MAAO,CAAE,MAAO,EAAE,aAAc,aAAc,EAAE,aAAc,CAClE,CAsBA,SAAgB,EACZ,EACgC,CAChC,GAAM,CACF,UACA,YAAY,kBACZ,cAAc,oBACd,SACA,YAAY,eACZ,UAAU,QACV,kBAAkB,GAClB,UACA,cAAc,EACd,YACA,cAAe,GAAQ,EAAK,CAAE,cAAe,CAAG,EAAI,IAAA,IACpD,EAEE,EAAe,EAAA,gBAAuB,CAAE,KAAM,EAAW,SAAQ,CAAC,EAClE,EAAa,GAAG,EAAU,UAEhC,SAAS,GAA8B,CAEnC,OADI,OAAO,OAAW,IAAoB,KACnC,IAAY,UAAY,OAAO,eAAiB,OAAO,YAClE,CACA,SAAS,GAAkC,CACvC,OAAO,EAAY,CAAC,EAAE,QAAQ,CAAU,GAAK,IACjD,CACA,SAAS,EAAkB,EAA4B,CACnD,IAAM,EAAI,EAAY,EACjB,IACD,EAAO,EAAE,QAAQ,EAAY,CAAK,EACjC,EAAE,WAAW,CAAU,EAChC,CAEA,IAAM,MAAgC,EAAa,SAAS,EACtD,MAAgC,EAAM,CAAC,CAAC,MAGxC,EAAU,EAAA,gBAAgB,CAAE,UAAS,kBAAiB,SAAQ,CAAC,EAErE,eAAe,GAAmC,CAC9C,GAAI,CAAC,EAAQ,OAAO,EAAM,CAAC,CAAC,KAC5B,IAAM,EAAQ,EAAS,EACjB,EAAO,MAAM,EAAA,gBAAgB,CAC/B,UACA,kBACA,UACA,aAAgB,CACpB,CAAC,CAAC,CAAC,IAAW,CAAM,EAEpB,OADA,EAAM,CAAC,CAAC,QAAQ,CAAI,EACb,CACX,CAEA,eAAe,EAAM,EAAkD,CACnE,IAAM,EAAO,MAAM,EAAQ,KAAc,EAAW,CAAE,KAAM,CAAY,CAAC,EACnE,CAAE,QAAO,gBAAiB,EAAY,CAAI,EAChD,EAAM,CAAC,CAAC,SAAS,CAAK,EACtB,EAAkB,GAAgB,IAAI,EACtC,IAAM,EAAW,IAAY,CAAI,EAKjC,OAJI,GAAY,KAIT,EAAU,GAHb,EAAM,CAAC,CAAC,QAAQ,CAAQ,EACjB,EAGf,CAEA,SAAS,GAAe,CACpB,EAAM,CAAC,CAAC,OAAO,EACf,EAAkB,IAAI,CAC1B,CAEA,IAAM,EAAU,EAAA,mBAAmB,SAAY,CAC3C,IAAM,EAAO,MAAM,EAAQ,KAAc,EAAa,CAClD,KAAM,EAAY,EAAiB,CAAC,CACxC,CAAC,EACK,CAAE,QAAO,gBAAiB,EAAY,CAAI,EAChD,EAAM,CAAC,CAAC,SAAS,CAAK,EAClB,GAAc,EAAkB,CAAY,CACpD,CAAC,EAWD,MAAO,CAAE,eAAc,IATX,EAAA,gBAAgB,CACxB,UACA,kBACA,UACA,WACA,UACA,mBAAsB,EAAO,CACjC,CAEuB,EAAK,QAAO,SAAQ,UAAS,UAAS,CACjE"}

package/dist/auth/create-tempest-auth.js

@@ -0,0 +1,74 @@
+import { createApiClient as e } from "../http/api-client.js";
+import { createAuthStore as t } from "./create-auth-store.js";
+import { createRefreshQueue as n } from "./refresh-queue.js";
+//#region src/auth/create-tempest-auth.ts
+function r(e) {
+	let t = e ?? {};
+	return {
+		token: t.access_token,
+		refreshToken: t.refresh_token
+	};
+}
+function i(i) {
+	let { baseURL: a, loginPath: o = "/api/auth/login", refreshPath: s = "/api/auth/refresh", mePath: c, storeName: l = "tempest-auth", storage: u = "local", withCredentials: d = !1, fetcher: f, parseTokens: p = r, parseUser: m, refreshBody: h = (e) => e ? { refresh_token: e } : void 0 } = i, g = t({
+		name: l,
+		storage: u
+	}), _ = `${l}-refresh`;
+	function v() {
+		return typeof window > "u" ? null : u === "session" ? window.sessionStorage : window.localStorage;
+	}
+	function y() {
+		return v()?.getItem(_) ?? null;
+	}
+	function b(e) {
+		let t = v();
+		t && (e ? t.setItem(_, e) : t.removeItem(_));
+	}
+	let x = () => g.getState(), S = () => x().token, C = e({
+		baseURL: a,
+		withCredentials: d,
+		fetcher: f
+	});
+	async function w() {
+		if (!c) return x().user;
+		let t = S(), n = await e({
+			baseURL: a,
+			withCredentials: d,
+			fetcher: f,
+			getToken: () => t
+		}).get(c);
+		return x().setUser(n), n;
+	}
+	async function T(e) {
+		let t = await C.post(o, { body: e }), { token: n, refreshToken: r } = p(t);
+		x().setToken(n), b(r ?? null);
+		let i = m?.(t);
+		return i == null ? w() : (x().setUser(i), i);
+	}
+	function E() {
+		x().logout(), b(null);
+	}
+	let D = n(async () => {
+		let e = await C.post(s, { body: h(y()) }), { token: t, refreshToken: n } = p(e);
+		x().setToken(t), n && b(n);
+	});
+	return {
+		useAuthStore: g,
+		api: e({
+			baseURL: a,
+			withCredentials: d,
+			fetcher: f,
+			getToken: S,
+			refresh: D,
+			onUnauthorized: () => E()
+		}),
+		login: T,
+		logout: E,
+		refresh: D,
+		getToken: S
+	};
+}
+//#endregion
+export { i as createTempestAuth };
+
+//# sourceMappingURL=create-tempest-auth.js.map

package/dist/auth/create-tempest-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-tempest-auth.js","names":[],"sources":["../../src/auth/create-tempest-auth.ts"],"sourcesContent":["import { createApiClient } from \"../http\";\nimport type { ApiClient } from \"../http\";\nimport { createAuthStore } from \"./create-auth-store\";\nimport type { AuthState } from \"./create-auth-store\";\nimport { createRefreshQueue } from \"./refresh-queue\";\n\n/** The token envelope returned by a Tempest FastAPI SDK login/refresh route. */\nexport interface TempestTokenResponse {\n    /** The bearer access token. */\n    access_token: string;\n    /** Token type — always `\"bearer\"` for the SDK. */\n    token_type?: string;\n    /** Optional refresh token (when the API returns it in the body, not a cookie). */\n    refresh_token?: string;\n}\n\nexport interface CreateTempestAuthOptions<TUser> {\n    /** Base URL of the API. Required. */\n    baseURL: string;\n    /** Login route (`POST`). Default: `\"/api/auth/login\"`. */\n    loginPath?: string;\n    /** Refresh route (`POST`). Default: `\"/api/auth/refresh\"`. */\n    refreshPath?: string;\n    /** Optional current-user route (`GET`) called after login/refresh. */\n    mePath?: string;\n    /** Persist key for the store. Default: `\"tempest-auth\"`. */\n    storeName?: string;\n    /** Storage backend. Default: `\"local\"`. */\n    storage?: \"local\" | \"session\";\n    /** Send cookies (needed when the refresh token lives in an httpOnly cookie). */\n    withCredentials?: boolean;\n    /** Custom fetch implementation (testing / SSR). Defaults to `globalThis.fetch`. */\n    fetcher?: typeof fetch;\n    /**\n     * Extract tokens from a login/refresh response. Default reads\n     * `access_token` + `refresh_token`.\n     */\n    parseTokens?: (data: unknown) => { token: string; refreshToken?: string };\n    /** Pull the user out of the login response, when the API embeds it. */\n    parseUser?: (data: unknown) => TUser | null;\n    /**\n     * Build the refresh request body. Default sends `{ refresh_token }` when a\n     * refresh token is stored, else `undefined` (cookie-based refresh).\n     */\n    refreshBody?: (refreshToken: string | null) => unknown;\n}\n\nexport interface TempestAuth<TUser, TCredentials> {\n    /** The persisted Zustand auth store hook (compatible with `<AuthGuard>`). */\n    useAuthStore: ReturnType<typeof createAuthStore<TUser>>;\n    /** A `createApiClient` wired with bearer auth + 401 → refresh → retry. */\n    api: ApiClient;\n    /** Authenticate, store the session, and resolve the user (or null). */\n    login: (credentials: TCredentials) => Promise<TUser | null>;\n    /** Clear the session (and the stored refresh token). */\n    logout: () => void;\n    /** Refresh the access token (deduplicated across concurrent callers). */\n    refresh: () => Promise<void>;\n    /** The current access token, or null. */\n    getToken: () => string | null;\n}\n\nfunction defaultParseTokens(data: unknown): { token: string; refreshToken?: string } {\n    const d = (data ?? {}) as TempestTokenResponse;\n    return { token: d.access_token, refreshToken: d.refresh_token };\n}\n\n/**\n * Turn-key auth preset wiring `createAuthStore` + `createRefreshQueue` +\n * `createApiClient` to the Tempest FastAPI SDK auth contract: login returns\n * `{ access_token, token_type }`, requests carry `Authorization: Bearer`, and a\n * `401` triggers a single deduplicated refresh + retry. Logout (or a failed\n * refresh) clears the session.\n *\n * @example\n * const auth = createTempestAuth<User, { email: string; password: string }>({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     mePath: \"/api/auth/me\",\n * });\n *\n * await auth.login({ email, password });   // stores session, returns the user\n * const orders = await auth.api.get(\"/api/orders\");  // sends the bearer token\n * auth.logout();\n *\n * @param options - The auth configuration.\n * @returns The store hook, a wired API client, and login/logout/refresh helpers.\n */\nexport function createTempestAuth<TUser, TCredentials = { email: string; password: string }>(\n    options: CreateTempestAuthOptions<TUser>,\n): TempestAuth<TUser, TCredentials> {\n    const {\n        baseURL,\n        loginPath = \"/api/auth/login\",\n        refreshPath = \"/api/auth/refresh\",\n        mePath,\n        storeName = \"tempest-auth\",\n        storage = \"local\",\n        withCredentials = false,\n        fetcher,\n        parseTokens = defaultParseTokens,\n        parseUser,\n        refreshBody = (rt) => (rt ? { refresh_token: rt } : undefined),\n    } = options;\n\n    const useAuthStore = createAuthStore<TUser>({ name: storeName, storage });\n    const refreshKey = `${storeName}-refresh`;\n\n    function storageImpl(): Storage | null {\n        if (typeof window === \"undefined\") return null;\n        return storage === \"session\" ? window.sessionStorage : window.localStorage;\n    }\n    function readRefreshToken(): string | null {\n        return storageImpl()?.getItem(refreshKey) ?? null;\n    }\n    function writeRefreshToken(token: string | null): void {\n        const s = storageImpl();\n        if (!s) return;\n        if (token) s.setItem(refreshKey, token);\n        else s.removeItem(refreshKey);\n    }\n\n    const state = (): AuthState<TUser> => useAuthStore.getState();\n    const getToken = (): string | null => state().token;\n\n    // Bare client (no auth/refresh) used for the login + refresh calls themselves.\n    const bareApi = createApiClient({ baseURL, withCredentials, fetcher });\n\n    async function fetchUser(): Promise<TUser | null> {\n        if (!mePath) return state().user;\n        const token = getToken();\n        const user = await createApiClient({\n            baseURL,\n            withCredentials,\n            fetcher,\n            getToken: () => token,\n        }).get<TUser>(mePath);\n        state().setUser(user);\n        return user;\n    }\n\n    async function login(credentials: TCredentials): Promise<TUser | null> {\n        const data = await bareApi.post<unknown>(loginPath, { body: credentials });\n        const { token, refreshToken } = parseTokens(data);\n        state().setToken(token);\n        writeRefreshToken(refreshToken ?? null);\n        const embedded = parseUser?.(data);\n        if (embedded != null) {\n            state().setUser(embedded);\n            return embedded;\n        }\n        return fetchUser();\n    }\n\n    function logout(): void {\n        state().logout();\n        writeRefreshToken(null);\n    }\n\n    const refresh = createRefreshQueue(async () => {\n        const data = await bareApi.post<unknown>(refreshPath, {\n            body: refreshBody(readRefreshToken()),\n        });\n        const { token, refreshToken } = parseTokens(data);\n        state().setToken(token);\n        if (refreshToken) writeRefreshToken(refreshToken);\n    });\n\n    const api = createApiClient({\n        baseURL,\n        withCredentials,\n        fetcher,\n        getToken,\n        refresh,\n        onUnauthorized: () => logout(),\n    });\n\n    return { useAuthStore, api, login, logout, refresh, getToken };\n}\n"],"mappings":";;;;AA8DA,SAAS,EAAmB,GAAyD;CACjF,IAAM,IAAK,KAAQ,CAAC;CACpB,OAAO;EAAE,OAAO,EAAE;EAAc,cAAc,EAAE;CAAc;AAClE;AAsBA,SAAgB,EACZ,GACgC;CAChC,IAAM,EACF,YACA,eAAY,mBACZ,iBAAc,qBACd,WACA,eAAY,gBACZ,aAAU,SACV,qBAAkB,IAClB,YACA,iBAAc,GACd,cACA,kBAAe,MAAQ,IAAK,EAAE,eAAe,EAAG,IAAI,KAAA,MACpD,GAEE,IAAe,EAAuB;EAAE,MAAM;EAAW;CAAQ,CAAC,GAClE,IAAa,GAAG,EAAU;CAEhC,SAAS,IAA8B;EAEnC,OADI,OAAO,SAAW,MAAoB,OACnC,MAAY,YAAY,OAAO,iBAAiB,OAAO;CAClE;CACA,SAAS,IAAkC;EACvC,OAAO,EAAY,CAAC,EAAE,QAAQ,CAAU,KAAK;CACjD;CACA,SAAS,EAAkB,GAA4B;EACnD,IAAM,IAAI,EAAY;EACjB,MACD,IAAO,EAAE,QAAQ,GAAY,CAAK,IACjC,EAAE,WAAW,CAAU;CAChC;CAEA,IAAM,UAAgC,EAAa,SAAS,GACtD,UAAgC,EAAM,CAAC,CAAC,OAGxC,IAAU,EAAgB;EAAE;EAAS;EAAiB;CAAQ,CAAC;CAErE,eAAe,IAAmC;EAC9C,IAAI,CAAC,GAAQ,OAAO,EAAM,CAAC,CAAC;EAC5B,IAAM,IAAQ,EAAS,GACjB,IAAO,MAAM,EAAgB;GAC/B;GACA;GACA;GACA,gBAAgB;EACpB,CAAC,CAAC,CAAC,IAAW,CAAM;EAEpB,OADA,EAAM,CAAC,CAAC,QAAQ,CAAI,GACb;CACX;CAEA,eAAe,EAAM,GAAkD;EACnE,IAAM,IAAO,MAAM,EAAQ,KAAc,GAAW,EAAE,MAAM,EAAY,CAAC,GACnE,EAAE,UAAO,oBAAiB,EAAY,CAAI;EAEhD,AADA,EAAM,CAAC,CAAC,SAAS,CAAK,GACtB,EAAkB,KAAgB,IAAI;EACtC,IAAM,IAAW,IAAY,CAAI;EAKjC,OAJI,KAAY,OAIT,EAAU,KAHb,EAAM,CAAC,CAAC,QAAQ,CAAQ,GACjB;CAGf;CAEA,SAAS,IAAe;EAEpB,AADA,EAAM,CAAC,CAAC,OAAO,GACf,EAAkB,IAAI;CAC1B;CAEA,IAAM,IAAU,EAAmB,YAAY;EAC3C,IAAM,IAAO,MAAM,EAAQ,KAAc,GAAa,EAClD,MAAM,EAAY,EAAiB,CAAC,EACxC,CAAC,GACK,EAAE,UAAO,oBAAiB,EAAY,CAAI;EAEhD,AADA,EAAM,CAAC,CAAC,SAAS,CAAK,GAClB,KAAc,EAAkB,CAAY;CACpD,CAAC;CAWD,OAAO;EAAE;EAAc,KATX,EAAgB;GACxB;GACA;GACA;GACA;GACA;GACA,sBAAsB,EAAO;EACjC,CAEuB;EAAK;EAAO;EAAQ;EAAS;CAAS;AACjE"}

package/dist/auth/jwt.cjs

@@ -0,0 +1,2 @@
+function e(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t.length%4==0?``:`=`.repeat(4-t.length%4);return typeof atob<`u`?atob(t+n):Buffer.from(t+n,`base64`).toString(`binary`)}function t(t){let n=t.split(`.`);if(n.length!==3)throw Error(`Invalid JWT: must contain three segments.`);let[r,i,a]=n;try{return{header:JSON.parse(e(r)),payload:JSON.parse(e(i)),signature:a}}catch{throw Error(`Invalid JWT: header or payload is not valid JSON.`)}}function n(e,n=0){try{let{payload:r}=t(e);if(typeof r.exp!=`number`)return!0;let i=Math.floor(Date.now()/1e3);return r.exp<=i+n}catch{return!0}}exports.decodeJWT=t,exports.isJWTExpired=n;
+//# sourceMappingURL=jwt.cjs.map

package/dist/auth/jwt.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.cjs","names":[],"sources":["../../src/auth/jwt.ts"],"sourcesContent":["export interface DecodedJWT {\n    header: Record<string, unknown>;\n    payload: Record<string, unknown> & { exp?: number; iat?: number; sub?: string };\n    signature: string;\n}\n\nfunction base64UrlDecode(input: string): string {\n    const padded = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padding = padded.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (padded.length % 4));\n    if (typeof atob !== \"undefined\") {\n        return atob(padded + padding);\n    }\n    return Buffer.from(padded + padding, \"base64\").toString(\"binary\");\n}\n\n/**\n * Decode a JWT into header/payload/signature. Does **not** verify the\n * signature — for that, do it server-side or use a JOSE library on the\n * client.\n *\n * @throws If the token shape is invalid (missing parts, bad JSON).\n */\nexport function decodeJWT(token: string): DecodedJWT {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) throw new Error(\"Invalid JWT: must contain three segments.\");\n    const [headerSeg, payloadSeg, signature] = parts as [string, string, string];\n    try {\n        return {\n            header: JSON.parse(base64UrlDecode(headerSeg)),\n            payload: JSON.parse(base64UrlDecode(payloadSeg)),\n            signature,\n        };\n    } catch {\n        throw new Error(\"Invalid JWT: header or payload is not valid JSON.\");\n    }\n}\n\n/**\n * Return true when the JWT's `exp` claim is in the past (or missing).\n *\n * @param token - JWT to inspect.\n * @param leewaySeconds - Treat tokens expiring within this window as expired.\n */\nexport function isJWTExpired(token: string, leewaySeconds = 0): boolean {\n    try {\n        const { payload } = decodeJWT(token);\n        if (typeof payload.exp !== \"number\") return true;\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return payload.exp <= nowSeconds + leewaySeconds;\n    } catch {\n        return true;\n    }\n}\n"],"mappings":"AAMA,SAAS,EAAgB,EAAuB,CAC5C,IAAM,EAAS,EAAM,QAAQ,KAAM,GAAG,CAAC,CAAC,QAAQ,KAAM,GAAG,EACnD,EAAU,EAAO,OAAS,GAAM,EAAI,GAAK,IAAI,OAAO,EAAK,EAAO,OAAS,CAAE,EAIjF,OAHI,OAAO,KAAS,IACT,KAAK,EAAS,CAAO,EAEzB,OAAO,KAAK,EAAS,EAAS,QAAQ,CAAC,CAAC,SAAS,QAAQ,CACpE,CASA,SAAgB,EAAU,EAA2B,CACjD,IAAM,EAAQ,EAAM,MAAM,GAAG,EAC7B,GAAI,EAAM,SAAW,EAAG,MAAU,MAAM,2CAA2C,EACnF,GAAM,CAAC,EAAW,EAAY,GAAa,EAC3C,GAAI,CACA,MAAO,CACH,OAAQ,KAAK,MAAM,EAAgB,CAAS,CAAC,EAC7C,QAAS,KAAK,MAAM,EAAgB,CAAU,CAAC,EAC/C,WACJ,CACJ,MAAQ,CACJ,MAAU,MAAM,mDAAmD,CACvE,CACJ,CAQA,SAAgB,EAAa,EAAe,EAAgB,EAAY,CACpE,GAAI,CACA,GAAM,CAAE,WAAY,EAAU,CAAK,EACnC,GAAI,OAAO,EAAQ,KAAQ,SAAU,MAAO,GAC5C,IAAM,EAAa,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EAC/C,OAAO,EAAQ,KAAO,EAAa,CACvC,MAAQ,CACJ,MAAO,EACX,CACJ"}