tempest-react-sdk 0.23.0 → 0.25.0

package/README.md

@@ -79,7 +79,7 @@ The goal is to start every new React frontend with the same opinionated foundati
 
 ## Recommended stack
 
-**Vite + React + TypeScript** is the supported consumer stack. The SDK is built and tested against [Vite 7](https://vite.dev) in library mode and assumes a Vite-style host app:
+**Vite + React + TypeScript** is the supported consumer stack. The SDK is built and tested against [Vite 8](https://vite.dev) in library mode and assumes a Vite-style host app:
 
 - ESM-first module resolution (the package's `exports` field declares `import` / `require` conditions).
 - `import.meta.env` for env vars (the recipes use `import.meta.env.VITE_API_URL`, `import.meta.env.VITE_VAPID_PUBLIC_KEY`, etc.).
@@ -90,16 +90,25 @@ The goal is to start every new React frontend with the same opinionated foundati
 **Fastest path — scaffold a fully wired app** with the `create-tempest-app` CLI that ships **inside the SDK** (Vite `@` alias, declarative routing, Zustand store, TanStack Query, providers — all pre-fiados):
 
 ```bash
-# brand-new project (no install needed)
-npx -p tempest-react-sdk create-tempest-app my-app
+# brand-new project (no install needed) — create the folder, scaffold into it with "."
+mkdir my-app
 cd my-app
+npx -p tempest-react-sdk create-tempest-app .
 npm install
+cp .env.example .env
 npm run dev
 
 # want it installable + web-push + offline ready? add --pwa
-npx -p tempest-react-sdk create-tempest-app my-app --pwa
+npx -p tempest-react-sdk create-tempest-app . --pwa
 ```
 
+`.` means "the current directory" — it preserves files you already have (`git
+init`, `README.md`, `LICENSE`) and takes the project name from the folder, so it
+is the recommended mode. Passing a name (`create-tempest-app my-app`) creates the
+folder instead, and aborts when it is not empty. Note there is no
+`create-tempest-app` package on npm — `npm create tempest-app` 404s, because the
+CLI is this package's `bin`; that is what `-p tempest-react-sdk` is for.
+
 The `--pwa` flag overlays a manifest, install prompt (`useBeforeInstallPrompt`), push wiring (`usePushSubscription`), **offline caching** (app-shell precache + runtime caching), **generated icons** (`tempestPwaIcons`, via `sharp`) and a **dev-mode service worker** (`tempestPwaDevSw`) on top of the base app — full `vite-plugin-pwa` parity for the common case, built from `tempest-react-sdk/sw` + `tempest-react-sdk/vite`, with no `vite-plugin-pwa`. See [Scaffold › PWA mode](https://mauriciobenjamin700.github.io/tempest-react-sdk/scaffold/#modo-pwa-pwa).
 
 Already have a project? Install the SDK, then scaffold `src/` + configs into it:
@@ -121,7 +130,9 @@ npm install tempest-react-sdk
 
 The demo gallery in [`examples/gallery`](./examples/gallery) is itself a Vite app — use it as the reference project layout.
 
-Other bundlers (Next.js app router, Webpack, Rspack, Parcel) **may** work — the package ships standard ESM + CJS + rolled-up `.d.ts` — but they are **not** exercised in CI, and Vite-specific features used in the recipes (`import.meta.env`, `vite-plugin-pwa`) will need their own equivalents. When in doubt, start with Vite.
+**Scope: client-side only.** This SDK targets client-rendered, offline-capable PWAs — service worker, IndexedDB outbox, install prompt, background sync. It does **not** support server-side rendering or React Server Components: no module ships a `"use client"` directive, and components assume they mount in a browser. Next.js App Router is not a target.
+
+Other client bundlers (Webpack, Rspack, Parcel) **may** work — the package ships standard ESM + CJS + rolled-up `.d.ts` — but they are **not** exercised in CI, and the Vite-specific pieces used in the recipes (`import.meta.env`, the `/vite` plugins) need their own equivalents. When in doubt, start with Vite.
 
 Vite reference: <https://vite.dev/guide/>. React + TypeScript template: <https://vite.dev/guide/#scaffolding-your-first-vite-project>.
 
@@ -149,7 +160,7 @@ Requires React `>=18` and Node `>=20.19` to build.
 
 Only **react** and **react-dom** are peer dependencies — those must come from the host app so a single React copy lives in the tree.
 
-Everything else (`zod`, `zustand`, `dexie`, `react-hook-form`, `@tanstack/react-query`, `react-router-dom`, `lucide-react`) is a **direct dependency** of the SDK, installed automatically by `npm install tempest-react-sdk`. You never need to install them manually.
+Everything else (`zod`, `zustand`, `dexie`, `react-hook-form`, `@tanstack/react-query`, `react-router`, `lucide-react`) is a **direct dependency** of the SDK, installed automatically by `npm install tempest-react-sdk`. You never need to install them manually.
 
 | Package                               | Status              | Used by                                                                 |
 | ------------------------------------- | ------------------- | ----------------------------------------------------------------------- |
@@ -157,7 +168,7 @@ Everything else (`zod`, `zustand`, `dexie`, `react-hook-form`, `@tanstack/react-
 | `@tanstack/react-query` (`^5`)        | Direct dep (auto)   | `QueryProvider`, `createQueryKeys`, `AppProviders`                      |
 | `zod` (`^3.23 \|\| ^4`)               | Direct dep (auto)   | `parseResponse`, `validateForm`, `zodResolver`, `useZodForm`            |
 | `zustand` (`^4 \|\| ^5`)              | Direct dep (auto)   | `createAuthStore`, `createStore`, `createSelectors`                     |
-| `react-router-dom` (`^7`)             | Direct dep (auto)   | `AppRouter`, `defineRoutes`, `RouteGuard`, routing re-exports           |
+| `react-router` (`^7`)                 | Direct dep (auto)   | `AppRouter`, `defineRoutes`, `RouteGuard`, routing re-exports           |
 | `dexie` (`^4.4`)                      | Direct dep (auto)   | `createOfflineStore`                                                    |
 | `react-hook-form` (`^7.76`)           | Direct dep (auto)   | `zodResolver`, `useZodForm`, masked inputs                              |
 | `lucide-react` (`>=0.400`)            | Direct dep (auto)   | Component icons (`leftIcon`/`rightIcon` on `Input`, `Button`, etc.)     |
@@ -169,7 +180,7 @@ The minimum install is just:
 npm install tempest-react-sdk react react-dom
 ```
 
-**Bundle impact**: every bundled dep is externalised in the SDK's Rollup config, and `dist/` ships with the module graph preserved (one file per source module), so your bundler drops what you don't import instead of inheriting one opaque blob — importing `cn` alone costs **118 B** brotli, a full app shell around **6.8 KB**. Your app's bundler (Vite / webpack / Rspack) resolves the deps from `node_modules` and tree-shakes them the same way — if you never call `createOfflineStore`, Dexie never enters your final bundle.
+**Bundle impact**: every bundled dep is externalised in the SDK's Rollup config, and `dist/` ships with the module graph preserved (one file per source module), so your bundler drops what you don't import instead of inheriting one opaque blob — importing `cn` alone costs **153 B** brotli, a full app shell around **6.8 KB**. Your app's bundler (Vite / webpack / Rspack) resolves the deps from `node_modules` and tree-shakes them the same way — if you never call `createOfflineStore`, Dexie never enters your final bundle.
 
 **Version conflicts**: if your app already pins (say) `zod@3.20`, npm dedupes when the range is compatible. If ranges diverge you get two copies — pin a single version in your own `package.json` to force one, or open an issue if the SDK's range is too tight.
 
@@ -187,6 +198,14 @@ This injects the design tokens (`--tempest-primary`, `--tempest-radius-md`, ...)
 
 The styles ship hashed under the `tempest_` namespace — they do **not** collide with Tailwind, Stitches, Linaria, or app-level CSS Modules.
 
+**Optional layout layer.** CSS Modules cover the inside of each component; the layer _around_ them (page shell, two-column form, action row, card, a region that scrolls sideways instead of the page) is a second, opt-in stylesheet:
+
+```ts
+import "tempest-react-sdk/utilities.css";
+```
+
+~50 token-driven classes, all prefixed `tempest-`, **1.13 KB brotli** — a page shell like `<div className="tempest-container tempest-page">` with `.tempest-grid-auto`, `.tempest-form-grid`, `.tempest-card`, `.tempest-truncate`. It is not imported by `styles.css`, so an app with its own layout system pays nothing. It is deliberately _not_ a utility framework: no `p-4 mt-2 bg-blue-500` per value. See [Styles › opt-in utility layer](https://mauriciobenjamin700.github.io/tempest-react-sdk/styles/).
+
 ---
 
 ## What's inside
@@ -201,7 +220,7 @@ Every module is re-exported from the package root — `import { Button, useDebou
 | `auth` _(peer: `zustand`)_                                                                        | `createAuthStore`, `AuthGuard`, `decodeJWT`, `isJWTExpired`, `lazyWithRetry`, `createRefreshQueue`, types: `AuthState`, `CreateAuthStoreOptions`, `AuthGuardProps`, `DecodedJWT`, `LazyWithRetryOptions`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `oauth` _(caller injects `@react-oauth/google`)_                                                  | `GoogleSignIn` (normalises Google's credential/error payload), `useOAuthCallback` (runs the callback exchange once, StrictMode-proof), types: `GoogleSignInProps`, `OAuthCredential`, `OAuthError`, `UseOAuthCallbackOptions`, `UseOAuthCallbackResult`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `query` _(peer: `@tanstack/react-query`)_                                                         | `QueryProvider`, `createQueryKeys`, `STALE_TIME`, `CACHE_TIME`, `REFETCH_TIME`, `usePaginatedQuery`, `useCursorQuery`, `useOfflineMutation` (optimistic offline mutation + cache rollback), `upsertById`/`removeById` (optimistic list-cache helpers), `persistQueryClientOffline` (IndexedDB cache persistence for offline reads)                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `router` _(dep: `react-router-dom`)_                                                              | `defineRoutes`, `AppRouter`, `RouteGuard`, + re-exports (`Link`, `NavLink`, `Outlet`, `Navigate`, `useNavigate`, `useParams`, `useSearchParams`, `useLocation`, `useMatch`, `useRouteError`, `redirect`, `BrowserRouter`/`HashRouter`/`MemoryRouter`/`Routes`/`Route`), types: `TempestRouteObject`, `RouterKind`, `AppRouterProps`, `RouteGuardProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `router` _(dep: `react-router`)_                                                                  | `defineRoutes`, `AppRouter`, `RouteGuard`, + re-exports (`Link`, `NavLink`, `Outlet`, `Navigate`, `useNavigate`, `useParams`, `useSearchParams`, `useLocation`, `useMatch`, `useRouteError`, `redirect`, `BrowserRouter`/`HashRouter`/`MemoryRouter`/`Routes`/`Route`), types: `TempestRouteObject`, `RouterKind`, `AppRouterProps`, `RouteGuardProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `store` _(dep: `zustand`)_                                                                        | `createStore`, `createSelectors`, types: `CreateStoreOptions`, `CreateStorePersistOptions`, `WithSelectors`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `app`                                                                                             | `AppProviders` (composes `ErrorBoundary` → `QueryProvider` → `ThemeProvider` → `I18nProvider`), type: `AppProvidersProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `vite` _(subpath `tempest-react-sdk/vite`)_                                                       | `createViteConfig`, `tempestPwaManifest` (emits `precache-manifest.json` for offline precache), `tempestPwaIcons` (generates the PNG icon set from one SVG via `sharp`), `tempestPwaDevSw` (serves the SW under `npm run dev`), `tempestPwaIcons({ appleSplash })` (Apple splash screens), types: `CreateViteConfigOptions`, `ProxyEntry`, `TempestViteConfig`, `TempestPwaManifestOptions`, `TempestPwaIconsOptions`, `TempestPwaDevSwOptions`, `AppleSplashSpec`, `TempestVitePlugin`                                                                                                                                                                                                                                                                                                                      |
@@ -232,7 +251,7 @@ Every module is re-exported from the package root — `import { Button, useDebou
 | `auth` _(peer: `zustand`)_                                                                        | `createAuthStore`, `AuthGuard`, `decodeJWT`, `isJWTExpired`, `lazyWithRetry`, `createRefreshQueue`, types: `AuthState`, `CreateAuthStoreOptions`, `AuthGuardProps`, `DecodedJWT`, `LazyWithRetryOptions`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `oauth` _(caller injects `@react-oauth/google`)_                                                  | `GoogleSignIn` (normalises Google's credential/error payload), `useOAuthCallback` (runs the callback exchange once, StrictMode-proof), types: `GoogleSignInProps`, `OAuthCredential`, `OAuthError`, `UseOAuthCallbackOptions`, `UseOAuthCallbackResult`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `query` _(peer: `@tanstack/react-query`)_                                                         | `QueryProvider`, `createQueryKeys`, `STALE_TIME`, `CACHE_TIME`, `REFETCH_TIME`, `usePaginatedQuery`, `useCursorQuery`, `useOfflineMutation` (optimistic offline mutation + cache rollback), `upsertById`/`removeById` (optimistic list-cache helpers), `persistQueryClientOffline` (IndexedDB cache persistence for offline reads)                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `router` _(dep: `react-router-dom`)_                                                              | `defineRoutes`, `AppRouter`, `RouteGuard`, + re-exports (`Link`, `NavLink`, `Outlet`, `Navigate`, `useNavigate`, `useParams`, `useSearchParams`, `useLocation`, `useMatch`, `useRouteError`, `redirect`, `BrowserRouter`/`HashRouter`/`MemoryRouter`/`Routes`/`Route`), types: `TempestRouteObject`, `RouterKind`, `AppRouterProps`, `RouteGuardProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `router` _(dep: `react-router`)_                                                                  | `defineRoutes`, `AppRouter`, `RouteGuard`, + re-exports (`Link`, `NavLink`, `Outlet`, `Navigate`, `useNavigate`, `useParams`, `useSearchParams`, `useLocation`, `useMatch`, `useRouteError`, `redirect`, `BrowserRouter`/`HashRouter`/`MemoryRouter`/`Routes`/`Route`), types: `TempestRouteObject`, `RouterKind`, `AppRouterProps`, `RouteGuardProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `store` _(dep: `zustand`)_                                                                        | `createStore`, `createSelectors`, types: `CreateStoreOptions`, `CreateStorePersistOptions`, `WithSelectors`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `app`                                                                                             | `AppProviders` (composes `ErrorBoundary` → `QueryProvider` → `ThemeProvider` → `I18nProvider`), type: `AppProvidersProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `vite` _(subpath `tempest-react-sdk/vite`)_                                                       | `createViteConfig`, `tempestPwaManifest` (emits `precache-manifest.json` for offline precache), `tempestPwaIcons` (generates the PNG icon set from one SVG via `sharp`), `tempestPwaDevSw` (serves the SW under `npm run dev`), `tempestPwaIcons({ appleSplash })` (Apple splash screens), types: `CreateViteConfigOptions`, `ProxyEntry`, `TempestViteConfig`, `TempestPwaManifestOptions`, `TempestPwaIconsOptions`, `TempestPwaDevSwOptions`, `AppleSplashSpec`, `TempestVitePlugin`                                                                                                                                                                                                                                                                                                                      |
@@ -271,8 +290,9 @@ The **`create-tempest-app`** CLI **ships inside the `tempest-react-sdk` package*
 
 ```bash
 # brand-new project folder (npx pulls the SDK and runs its bin)
-npx -p tempest-react-sdk create-tempest-app my-app
+mkdir my-app
 cd my-app
+npx -p tempest-react-sdk create-tempest-app .
 npm install
 cp .env.example .env
 npm run dev            # http://127.0.0.1:5173
@@ -325,7 +345,7 @@ export default createViteConfig({
 
 > Declare the same alias in `tsconfig.json` so the type-checker resolves it: `"paths": { "@/*": ["./src/*"] }`.
 
-**Declarative routing** (React Router v7) — describe the tree as data, with `lazy` code-splitting and per-route `guard` redirects:
+**Declarative routing** (React Router v8) — describe the tree as data, with `lazy` code-splitting and per-route `guard` redirects:
 
 ```tsx
 import { defineRoutes, AppRouter } from "tempest-react-sdk";
@@ -448,7 +468,7 @@ A minimal `main.tsx` for an app using HTTP + Query + Auth + Toast + Theme + i18n
 ```tsx
 import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
-import { BrowserRouter } from "react-router-dom";
+import { BrowserRouter } from "react-router";
 import {
   ThemeProvider,
   I18nProvider,
@@ -655,7 +675,7 @@ The store exposes `user`, `token`, `isAuthenticated`, `setSession`, `setUser`, `
 ### Route guard recipe
 
 ```tsx
-import { Navigate, Outlet } from "react-router-dom";
+import { Navigate, Outlet } from "react-router";
 import { AuthGuard } from "tempest-react-sdk";
 import { useAuthStore } from "@/store/auth";
 
@@ -1177,12 +1197,7 @@ export const notificationsStore = createOfflineStore<Notification, string>({
   ownerField: "owner_id",
 });
 
-await notificationsStore.put(
-  {
-    /* … */
-  } as Notification,
-  "u1",
-);
+await notificationsStore.put({/* … */} as Notification, "u1");
 const items = await notificationsStore.list("u1", {
   orderBy: "created_at",
   reverse: true,
@@ -1200,7 +1215,7 @@ Renders a fallback (static element or render-prop), auto-resets via `resetKeys`,
 
 ```tsx
 import { ErrorBoundary, ErrorState } from "tempest-react-sdk";
-import { useLocation } from "react-router-dom";
+import { useLocation } from "react-router";
 
 export function AppShell({ children }: { children: React.ReactNode }) {
   const location = useLocation();
@@ -1781,9 +1796,9 @@ npm run clean          # rm -rf dist coverage
 
 Snapshot of current health:
 
-- 1490 tests / 358 files.
-- What your app actually pays (brotli, tree-shaken slices measured by `npm run size`): `cn` alone 118 B · one `Button` 820 B · a typical app shell (5 components + router + providers + HTTP + auth + a hook) 6.83 KB · offline/PWA surface 4.45 KB · `styles.css` 20.6 KB.
-- Full-barrel ceiling — nobody imports this, it is the no-tree-shaking worst case: 64.5 KB ESM / 79.9 KB CJS.
+- 2488 tests / 377 files — 98.5% lines, 97.1% statements, 96.6% functions, 95.0% branches (CI floors: 98/97/96/94).
+- What your app actually pays (brotli, tree-shaken slices measured by `npm run size`): `cn` alone 153 B · one `Button` 794 B · a typical app shell (5 components + router + providers + HTTP + auth + a hook) 6.83 KB · offline/PWA surface 4.44 KB · `styles.css` 21.68 KB · the opt-in `utilities.css` 1.13 KB.
+- Full-barrel ceiling — nobody imports this, it is the no-tree-shaking worst case: 70.21 KB ESM / 85.52 KB CJS.
 - Husky pre-commit runs `lint-staged` (eslint --fix + prettier --write) on staged files.
 
 The demo gallery lives in `examples/gallery` and consumes the local SDK via `file:../..`:

package/bin/create-tempest-app.mjs

@@ -230,6 +230,7 @@ async function main() {
     console.log(`\n${c.green}✓ Done!${c.reset} Next steps:\n`);
     if (!mergeMode) console.log(`  ${c.bold}cd ${arg}${c.reset}`);
     console.log(`  ${c.bold}npm install${c.reset}`);
+    if (!protect.has(".env")) console.log(`  ${c.bold}cp .env.example .env${c.reset}`);
     console.log(`  ${c.bold}npm run dev${c.reset}`);
     if (pwa) {
         console.log(

package/bin/tempest.mjs

@@ -241,6 +241,7 @@ const STATEFUL_DEPS = [
     "@tanstack/react-query",
     "zustand",
     "react-hook-form",
+    "react-router",
     "react-router-dom",
 ];
 

package/dist/_virtual/_rolldown/runtime.cjs

@@ -0,0 +1 @@
+var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,a)=>(a=n==null?{}:e(i(n)),o(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n));exports.__toESM=s;

package/dist/access/Can.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("react/jsx-runtime"),l=require("./use-can.cjs");function a({action:r,resource:t,params:u,children:i,fallback:n}){const{allowed:s,isLoading:o}=l.useCan({action:r,resource:t,params:u});return o?e.jsx(e.Fragment,{children:n??null}):e.jsx(e.Fragment,{children:s?i:n??null})}exports.Can=a;
-//# sourceMappingURL=Can.cjs.map
+const e=require("./use-can.cjs");let t=require("react/jsx-runtime");function n({action:n,resource:r,params:i,children:a,fallback:o}){let{allowed:s,isLoading:c}=e.useCan({action:n,resource:r,params:i});return c?(0,t.jsx)(t.Fragment,{children:o??null}):(0,t.jsx)(t.Fragment,{children:s?a:o??null})}exports.Can=n;
+//# sourceMappingURL=Can.cjs.map

package/dist/access/Can.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"Can.cjs","sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed, otherwise `fallback` (or nothing). While an async check is\n * pending, nothing is rendered.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{fallback ?? null}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"names":["Can","action","resource","params","children","fallback","allowed","isLoading","useCan","jsx","Fragment"],"mappings":"gJAuBO,SAASA,EAAI,CAAE,OAAAC,EAAQ,SAAAC,EAAU,OAAAC,EAAQ,SAAAC,EAAU,SAAAC,GAAsB,CAC5E,KAAM,CAAE,QAAAC,EAAS,UAAAC,GAAcC,EAAAA,OAAO,CAAE,OAAAP,EAAQ,SAAAC,EAAU,OAAAC,EAAQ,EAClE,OAAII,EAAkBE,MAAAC,EAAAA,SAAA,CAAG,SAAAL,GAAY,KAAK,EACnCI,EAAAA,IAAAC,EAAAA,SAAA,CAAG,SAAAJ,EAAUF,EAAYC,GAAY,KAAM,CACtD"}
+{"version":3,"file":"Can.cjs","names":[],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed, otherwise `fallback` (or nothing). While an async check is\n * pending, nothing is rendered.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{fallback ?? null}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":"oEAuBA,SAAgB,EAAI,CAAE,SAAQ,WAAU,SAAQ,WAAU,YAAsB,CAC5E,GAAM,CAAE,UAAS,aAAc,EAAA,OAAO,CAAE,SAAQ,WAAU,QAAO,CAAC,EAElE,OADI,GAAkB,EAAA,EAAA,IAAA,CAAA,EAAA,SAAA,CAAA,SAAG,GAAY,IAAO,CAAA,GACrC,EAAA,EAAA,IAAA,CAAA,EAAA,SAAA,CAAA,SAAG,EAAU,EAAY,GAAY,IAAQ,CAAA,CACxD"}

package/dist/access/Can.js

@@ -1,10 +1,15 @@
-import { jsx as r, Fragment as o } from "react/jsx-runtime";
-import { useCan as d } from "./use-can.js";
-function c({ action: e, resource: i, params: t, children: l, fallback: n }) {
-  const { allowed: u, isLoading: m } = d({ action: e, resource: i, params: t });
-  return m ? /* @__PURE__ */ r(o, { children: n ?? null }) : /* @__PURE__ */ r(o, { children: u ? l : n ?? null });
+import { useCan as e } from "./use-can.js";
+import { Fragment as t, jsx as n } from "react/jsx-runtime";
+//#region src/access/Can.tsx
+function r({ action: r, resource: i, params: a, children: o, fallback: s }) {
+	let { allowed: c, isLoading: l } = e({
+		action: r,
+		resource: i,
+		params: a
+	});
+	return l ? /* @__PURE__ */ n(t, { children: s ?? null }) : /* @__PURE__ */ n(t, { children: c ? o : s ?? null });
 }
-export {
-  c as Can
-};
-//# sourceMappingURL=Can.js.map
+//#endregion
+export { r as Can };
+
+//# sourceMappingURL=Can.js.map

package/dist/access/Can.js.map

@@ -1 +1 @@
-{"version":3,"file":"Can.js","sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed, otherwise `fallback` (or nothing). While an async check is\n * pending, nothing is rendered.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{fallback ?? null}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"names":["Can","action","resource","params","children","fallback","allowed","isLoading","useCan","jsx","Fragment"],"mappings":";;AAuBO,SAASA,EAAI,EAAE,QAAAC,GAAQ,UAAAC,GAAU,QAAAC,GAAQ,UAAAC,GAAU,UAAAC,KAAsB;AAC5E,QAAM,EAAE,SAAAC,GAAS,WAAAC,MAAcC,EAAO,EAAE,QAAAP,GAAQ,UAAAC,GAAU,QAAAC,GAAQ;AAClE,SAAII,IAAkB,gBAAAE,EAAAC,GAAA,EAAG,UAAAL,KAAY,MAAK,IACnC,gBAAAI,EAAAC,GAAA,EAAG,UAAAJ,IAAUF,IAAYC,KAAY,MAAM;AACtD;"}
+{"version":3,"file":"Can.js","names":[],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed, otherwise `fallback` (or nothing). While an async check is\n * pending, nothing is rendered.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{fallback ?? null}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":";;;AAuBA,SAAgB,EAAI,EAAE,WAAQ,aAAU,WAAQ,aAAU,eAAsB;CAC5E,IAAM,EAAE,YAAS,iBAAc,EAAO;EAAE;EAAQ;EAAU;CAAO,CAAC;CAElE,OADI,IAAkB,kBAAA,GAAA,EAAA,UAAG,KAAY,KAAO,CAAA,IACrC,kBAAA,GAAA,EAAA,UAAG,IAAU,IAAY,KAAY,KAAQ,CAAA;AACxD"}

package/dist/access/access-control-context.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const n=require("react/jsx-runtime"),e=require("react"),t=e.createContext(null);function s({control:o,children:r}){return n.jsx(t.Provider,{value:o,children:r})}function c(){return e.useContext(t)}exports.AccessControlProvider=s;exports.useAccessControl=c;
-//# sourceMappingURL=access-control-context.cjs.map
+let e=require("react"),t=require("react/jsx-runtime");var n=(0,e.createContext)(null);function r({control:e,children:r}){return(0,t.jsx)(n.Provider,{value:e,children:r})}function i(){return(0,e.useContext)(n)}exports.AccessControlProvider=r,exports.useAccessControl=i;
+//# sourceMappingURL=access-control-context.cjs.map

package/dist/access/access-control-context.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"access-control-context.cjs","sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"names":["AccessControlContext","createContext","AccessControlProvider","control","children","useAccessControl","useContext"],"mappings":"wIAIMA,EAAuBC,EAAAA,cAAoC,IAAI,EAmB9D,SAASC,EAAsB,CAAE,QAAAC,EAAS,SAAAC,GAAwC,CACrF,aACKJ,EAAqB,SAArB,CAA8B,MAAOG,EAAU,SAAAC,EAAS,CAEjE,CAUO,SAASC,GAAyC,CACrD,OAAOC,EAAAA,WAAWN,CAAoB,CAC1C"}
+{"version":3,"file":"access-control-context.cjs","names":[],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":"sDAIA,IAAM,GAAA,EAAA,EAAA,cAAA,CAA2D,IAAI,EAmBrE,SAAgB,EAAsB,CAAE,UAAS,YAAwC,CACrF,OACI,EAAA,EAAA,IAAA,CAAC,EAAqB,SAAtB,CAA+B,MAAO,EAAU,UAAwC,CAAA,CAEhG,CAUA,SAAgB,GAAyC,CACrD,OAAA,EAAA,EAAA,WAAA,CAAkB,CAAoB,CAC1C"}

package/dist/access/access-control-context.js

@@ -1,14 +1,17 @@
-import { jsx as e } from "react/jsx-runtime";
-import { useContext as n, createContext as c } from "react";
-const o = c(null);
-function i({ control: t, children: r }) {
-  return /* @__PURE__ */ e(o.Provider, { value: t, children: r });
+import { createContext as e, useContext as t } from "react";
+import { jsx as n } from "react/jsx-runtime";
+//#region src/access/access-control-context.tsx
+var r = e(null);
+function i({ control: e, children: t }) {
+	return /* @__PURE__ */ n(r.Provider, {
+		value: e,
+		children: t
+	});
 }
-function l() {
-  return n(o);
+function a() {
+	return t(r);
 }
-export {
-  i as AccessControlProvider,
-  l as useAccessControl
-};
-//# sourceMappingURL=access-control-context.js.map
+//#endregion
+export { i as AccessControlProvider, a as useAccessControl };
+
+//# sourceMappingURL=access-control-context.js.map

package/dist/access/access-control-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-control-context.js","sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"names":["AccessControlContext","createContext","AccessControlProvider","control","children","useAccessControl","useContext"],"mappings":";;AAIA,MAAMA,IAAuBC,EAAoC,IAAI;AAmB9D,SAASC,EAAsB,EAAE,SAAAC,GAAS,UAAAC,KAAwC;AACrF,2BACKJ,EAAqB,UAArB,EAA8B,OAAOG,GAAU,UAAAC,GAAS;AAEjE;AAUO,SAASC,IAAyC;AACrD,SAAOC,EAAWN,CAAoB;AAC1C;"}
+{"version":3,"file":"access-control-context.js","names":[],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":";;;AAIA,IAAM,IAAuB,EAAoC,IAAI;AAmBrE,SAAgB,EAAsB,EAAE,YAAS,eAAwC;CACrF,OACI,kBAAC,EAAqB,UAAtB;EAA+B,OAAO;EAAU;CAAwC,CAAA;AAEhG;AAUA,SAAgB,IAAyC;CACrD,OAAO,EAAW,CAAoB;AAC1C"}

package/dist/access/create-role-access-control.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function n(e){const s=new Set(e.permissions??[]),r=e.role?Array.isArray(e.role)?e.role:[e.role]:[];for(const o of r)for(const t of e.roles?.[o]??[])s.add(t);return s}function l(e){const s=n(e);return{can({action:r,resource:o}){return s.has("*")||o!==void 0&&(s.has(`${o}:*`)||s.has(`${o}:${r}`))||o===void 0&&s.has(r)?{can:!0}:{can:!1,reason:"missing permission"}}}}exports.createRoleAccessControl=l;
-//# sourceMappingURL=create-role-access-control.cjs.map
+function e(e){let t=new Set(e.permissions??[]),n=e.role?Array.isArray(e.role)?e.role:[e.role]:[];for(let r of n)for(let n of e.roles?.[r]??[])t.add(n);return t}function t(t){let n=e(t);return{can({action:e,resource:t}){return n.has(`*`)||t!==void 0&&(n.has(`${t}:*`)||n.has(`${t}:${e}`))||t===void 0&&n.has(e)?{can:!0}:{can:!1,reason:`missing permission`}}}}exports.createRoleAccessControl=t;
+//# sourceMappingURL=create-role-access-control.cjs.map

package/dist/access/create-role-access-control.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"create-role-access-control.cjs","sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"names":["resolvePermissions","config","set","roles","role","perm","createRoleAccessControl","granted","action","resource"],"mappings":"gFAWA,SAASA,EAAmBC,EAA8C,CACtE,MAAMC,EAAM,IAAI,IAAYD,EAAO,aAAe,CAAA,CAAE,EAC9CE,EAAQF,EAAO,KAAQ,MAAM,QAAQA,EAAO,IAAI,EAAIA,EAAO,KAAO,CAACA,EAAO,IAAI,EAAK,CAAA,EACzF,UAAWG,KAAQD,EACf,UAAWE,KAAQJ,EAAO,QAAQG,CAAI,GAAK,CAAA,EACvCF,EAAI,IAAIG,CAAI,EAGpB,OAAOH,CACX,CAwBO,SAASI,EAAwBL,EAAgD,CACpF,MAAMM,EAAUP,EAAmBC,CAAM,EAEzC,MAAO,CACH,IAAI,CAAE,OAAAO,EAAQ,SAAAC,GAAkC,CAO5C,OALIF,EAAQ,IAAI,GAAG,GACdE,IAAa,SACTF,EAAQ,IAAI,GAAGE,CAAQ,IAAI,GAAKF,EAAQ,IAAI,GAAGE,CAAQ,IAAID,CAAM,EAAE,IACvEC,IAAa,QAAaF,EAAQ,IAAIC,CAAM,EAEhC,CAAE,IAAK,EAAA,EAAS,CAAE,IAAK,GAAO,OAAQ,oBAAA,CAC3D,CAAA,CAER"}
+{"version":3,"file":"create-role-access-control.cjs","names":[],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":"AAWA,SAAS,EAAmB,EAA8C,CACtE,IAAM,EAAM,IAAI,IAAY,EAAO,aAAe,CAAC,CAAC,EAC9C,EAAQ,EAAO,KAAQ,MAAM,QAAQ,EAAO,IAAI,EAAI,EAAO,KAAO,CAAC,EAAO,IAAI,EAAK,CAAC,EAC1F,IAAK,IAAM,KAAQ,EACf,IAAK,IAAM,KAAQ,EAAO,QAAQ,IAAS,CAAC,EACxC,EAAI,IAAI,CAAI,EAGpB,OAAO,CACX,CAwBA,SAAgB,EAAwB,EAAgD,CACpF,IAAM,EAAU,EAAmB,CAAM,EAEzC,MAAO,CACH,IAAI,CAAE,SAAQ,YAAkC,CAO5C,OALI,EAAQ,IAAI,GAAG,GACd,IAAa,IAAA,KACT,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAK,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAQ,IACvE,IAAa,IAAA,IAAa,EAAQ,IAAI,CAAM,EAEhC,CAAE,IAAK,EAAK,EAAI,CAAE,IAAK,GAAO,OAAQ,oBAAqB,CAChF,CACJ,CACJ"}

package/dist/access/create-role-access-control.js

@@ -1,19 +1,19 @@
-function t(s) {
-  const e = new Set(s.permissions ?? []), o = s.role ? Array.isArray(s.role) ? s.role : [s.role] : [];
-  for (const r of o)
-    for (const n of s.roles?.[r] ?? [])
-      e.add(n);
-  return e;
+//#region src/access/create-role-access-control.ts
+function e(e) {
+	let t = new Set(e.permissions ?? []), n = e.role ? Array.isArray(e.role) ? e.role : [e.role] : [];
+	for (let r of n) for (let n of e.roles?.[r] ?? []) t.add(n);
+	return t;
 }
-function a(s) {
-  const e = t(s);
-  return {
-    can({ action: o, resource: r }) {
-      return e.has("*") || r !== void 0 && (e.has(`${r}:*`) || e.has(`${r}:${o}`)) || r === void 0 && e.has(o) ? { can: !0 } : { can: !1, reason: "missing permission" };
-    }
-  };
+function t(t) {
+	let n = e(t);
+	return { can({ action: e, resource: t }) {
+		return n.has("*") || t !== void 0 && (n.has(`${t}:*`) || n.has(`${t}:${e}`)) || t === void 0 && n.has(e) ? { can: !0 } : {
+			can: !1,
+			reason: "missing permission"
+		};
+	} };
 }
-export {
-  a as createRoleAccessControl
-};
-//# sourceMappingURL=create-role-access-control.js.map
+//#endregion
+export { t as createRoleAccessControl };
+
+//# sourceMappingURL=create-role-access-control.js.map

package/dist/access/create-role-access-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-role-access-control.js","sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"names":["resolvePermissions","config","set","roles","role","perm","createRoleAccessControl","granted","action","resource"],"mappings":"AAWA,SAASA,EAAmBC,GAA8C;AACtE,QAAMC,IAAM,IAAI,IAAYD,EAAO,eAAe,CAAA,CAAE,GAC9CE,IAAQF,EAAO,OAAQ,MAAM,QAAQA,EAAO,IAAI,IAAIA,EAAO,OAAO,CAACA,EAAO,IAAI,IAAK,CAAA;AACzF,aAAWG,KAAQD;AACf,eAAWE,KAAQJ,EAAO,QAAQG,CAAI,KAAK,CAAA;AACvC,MAAAF,EAAI,IAAIG,CAAI;AAGpB,SAAOH;AACX;AAwBO,SAASI,EAAwBL,GAAgD;AACpF,QAAMM,IAAUP,EAAmBC,CAAM;AAEzC,SAAO;AAAA,IACH,IAAI,EAAE,QAAAO,GAAQ,UAAAC,KAAkC;AAO5C,aALIF,EAAQ,IAAI,GAAG,KACdE,MAAa,WACTF,EAAQ,IAAI,GAAGE,CAAQ,IAAI,KAAKF,EAAQ,IAAI,GAAGE,CAAQ,IAAID,CAAM,EAAE,MACvEC,MAAa,UAAaF,EAAQ,IAAIC,CAAM,IAEhC,EAAE,KAAK,GAAA,IAAS,EAAE,KAAK,IAAO,QAAQ,qBAAA;AAAA,IAC3D;AAAA,EAAA;AAER;"}
+{"version":3,"file":"create-role-access-control.js","names":[],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":";AAWA,SAAS,EAAmB,GAA8C;CACtE,IAAM,IAAM,IAAI,IAAY,EAAO,eAAe,CAAC,CAAC,GAC9C,IAAQ,EAAO,OAAQ,MAAM,QAAQ,EAAO,IAAI,IAAI,EAAO,OAAO,CAAC,EAAO,IAAI,IAAK,CAAC;CAC1F,KAAK,IAAM,KAAQ,GACf,KAAK,IAAM,KAAQ,EAAO,QAAQ,MAAS,CAAC,GACxC,EAAI,IAAI,CAAI;CAGpB,OAAO;AACX;AAwBA,SAAgB,EAAwB,GAAgD;CACpF,IAAM,IAAU,EAAmB,CAAM;CAEzC,OAAO,EACH,IAAI,EAAE,WAAQ,eAAkC;EAO5C,OALI,EAAQ,IAAI,GAAG,KACd,MAAa,KAAA,MACT,EAAQ,IAAI,GAAG,EAAS,GAAG,KAAK,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAQ,MACvE,MAAa,KAAA,KAAa,EAAQ,IAAI,CAAM,IAEhC,EAAE,KAAK,GAAK,IAAI;GAAE,KAAK;GAAO,QAAQ;EAAqB;CAChF,EACJ;AACJ"}

package/dist/access/permissions-from-token.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const c=require("../auth/jwt.cjs");function n(r){return Array.isArray(r)?r.filter(t=>typeof t=="string"):typeof r=="string"?r.split(/\s+/).filter(Boolean):[]}function f(r,t){try{const{payload:e}=c.decodeJWT(r),s=t?.claim??"permissions",i=n(e[s]);if(i.length>0)return i;if(t?.claim===void 0){const o=n(e.scopes);return o.length>0?o:n(e.scope)}return i}catch{return[]}}exports.permissionsFromToken=f;
-//# sourceMappingURL=permissions-from-token.cjs.map
+const e=require("../auth/jwt.cjs");function t(e){return Array.isArray(e)?e.filter(e=>typeof e==`string`):typeof e==`string`?e.split(/\s+/).filter(Boolean):[]}function n(n,r){try{let{payload:i}=e.decodeJWT(n),a=t(i[r?.claim??`permissions`]);if(a.length>0)return a;if(r?.claim===void 0){let e=t(i.scopes);return e.length>0?e:t(i.scope)}return a}catch{return[]}}exports.permissionsFromToken=n;
+//# sourceMappingURL=permissions-from-token.cjs.map

package/dist/access/permissions-from-token.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-from-token.cjs","sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"names":["toPermissionList","value","item","permissionsFromToken","token","options","payload","decodeJWT","claim","primary","scopes"],"mappings":"mHAOA,SAASA,EAAiBC,EAA0B,CAChD,OAAI,MAAM,QAAQA,CAAK,EACZA,EAAM,OAAQC,GAAyB,OAAOA,GAAS,QAAQ,EAEtE,OAAOD,GAAU,SAEVA,EAAM,MAAM,KAAK,EAAE,OAAO,OAAO,EAErC,CAAA,CACX,CAcO,SAASE,EACZC,EACAC,EACQ,CACR,GAAI,CACA,KAAM,CAAE,QAAAC,CAAA,EAAYC,EAAAA,UAAUH,CAAK,EAC7BI,EAAQH,GAAS,OAAS,cAC1BI,EAAUT,EAAiBM,EAAQE,CAAK,CAAC,EAC/C,GAAIC,EAAQ,OAAS,EAAG,OAAOA,EAE/B,GAAIJ,GAAS,QAAU,OAAW,CAC9B,MAAMK,EAASV,EAAiBM,EAAQ,MAAS,EACjD,OAAII,EAAO,OAAS,EAAUA,EACvBV,EAAiBM,EAAQ,KAAQ,CAC5C,CACA,OAAOG,CACX,MAAQ,CACJ,MAAO,CAAA,CACX,CACJ"}
+{"version":3,"file":"permissions-from-token.cjs","names":[],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":"mCAOA,SAAS,EAAiB,EAA0B,CAQhD,OAPI,MAAM,QAAQ,CAAK,EACZ,EAAM,OAAQ,GAAyB,OAAO,GAAS,QAAQ,EAEtE,OAAO,GAAU,SAEV,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,EAErC,CAAC,CACZ,CAcA,SAAgB,EACZ,EACA,EACQ,CACR,GAAI,CACA,GAAM,CAAE,WAAY,EAAA,UAAU,CAAK,EAE7B,EAAU,EAAiB,EADnB,GAAS,OAAS,cACe,EAC/C,GAAI,EAAQ,OAAS,EAAG,OAAO,EAE/B,GAAI,GAAS,QAAU,IAAA,GAAW,CAC9B,IAAM,EAAS,EAAiB,EAAQ,MAAS,EAEjD,OADI,EAAO,OAAS,EAAU,EACvB,EAAiB,EAAQ,KAAQ,CAC5C,CACA,OAAO,CACX,MAAQ,CACJ,MAAO,CAAC,CACZ,CACJ"}

package/dist/access/permissions-from-token.js

@@ -1,21 +1,22 @@
-import { decodeJWT as c } from "../auth/jwt.js";
-function o(r) {
-  return Array.isArray(r) ? r.filter((t) => typeof t == "string") : typeof r == "string" ? r.split(/\s+/).filter(Boolean) : [];
+import { decodeJWT as e } from "../auth/jwt.js";
+//#region src/access/permissions-from-token.ts
+function t(e) {
+	return Array.isArray(e) ? e.filter((e) => typeof e == "string") : typeof e == "string" ? e.split(/\s+/).filter(Boolean) : [];
 }
-function p(r, t) {
-  try {
-    const { payload: i } = c(r), s = t?.claim ?? "permissions", n = o(i[s]);
-    if (n.length > 0) return n;
-    if (t?.claim === void 0) {
-      const e = o(i.scopes);
-      return e.length > 0 ? e : o(i.scope);
-    }
-    return n;
-  } catch {
-    return [];
-  }
+function n(n, r) {
+	try {
+		let { payload: i } = e(n), a = t(i[r?.claim ?? "permissions"]);
+		if (a.length > 0) return a;
+		if (r?.claim === void 0) {
+			let e = t(i.scopes);
+			return e.length > 0 ? e : t(i.scope);
+		}
+		return a;
+	} catch {
+		return [];
+	}
 }
-export {
-  p as permissionsFromToken
-};
-//# sourceMappingURL=permissions-from-token.js.map
+//#endregion
+export { n as permissionsFromToken };
+
+//# sourceMappingURL=permissions-from-token.js.map

package/dist/access/permissions-from-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-from-token.js","sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"names":["toPermissionList","value","item","permissionsFromToken","token","options","payload","decodeJWT","claim","primary","scopes"],"mappings":";AAOA,SAASA,EAAiBC,GAA0B;AAChD,SAAI,MAAM,QAAQA,CAAK,IACZA,EAAM,OAAO,CAACC,MAAyB,OAAOA,KAAS,QAAQ,IAEtE,OAAOD,KAAU,WAEVA,EAAM,MAAM,KAAK,EAAE,OAAO,OAAO,IAErC,CAAA;AACX;AAcO,SAASE,EACZC,GACAC,GACQ;AACR,MAAI;AACA,UAAM,EAAE,SAAAC,EAAA,IAAYC,EAAUH,CAAK,GAC7BI,IAAQH,GAAS,SAAS,eAC1BI,IAAUT,EAAiBM,EAAQE,CAAK,CAAC;AAC/C,QAAIC,EAAQ,SAAS,EAAG,QAAOA;AAE/B,QAAIJ,GAAS,UAAU,QAAW;AAC9B,YAAMK,IAASV,EAAiBM,EAAQ,MAAS;AACjD,aAAII,EAAO,SAAS,IAAUA,IACvBV,EAAiBM,EAAQ,KAAQ;AAAA,IAC5C;AACA,WAAOG;AAAA,EACX,QAAQ;AACJ,WAAO,CAAA;AAAA,EACX;AACJ;"}
+{"version":3,"file":"permissions-from-token.js","names":[],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":";;AAOA,SAAS,EAAiB,GAA0B;CAQhD,OAPI,MAAM,QAAQ,CAAK,IACZ,EAAM,QAAQ,MAAyB,OAAO,KAAS,QAAQ,IAEtE,OAAO,KAAU,WAEV,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,IAErC,CAAC;AACZ;AAcA,SAAgB,EACZ,GACA,GACQ;CACR,IAAI;EACA,IAAM,EAAE,eAAY,EAAU,CAAK,GAE7B,IAAU,EAAiB,EADnB,GAAS,SAAS,cACe;EAC/C,IAAI,EAAQ,SAAS,GAAG,OAAO;EAE/B,IAAI,GAAS,UAAU,KAAA,GAAW;GAC9B,IAAM,IAAS,EAAiB,EAAQ,MAAS;GAEjD,OADI,EAAO,SAAS,IAAU,IACvB,EAAiB,EAAQ,KAAQ;EAC5C;EACA,OAAO;CACX,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ"}

package/dist/access/use-can.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const r=require("react"),i=require("./access-control-context.cjs");function u(e){return typeof e=="boolean"?{can:e}:e}function f(e){const n=i.useAccessControl(),c=JSON.stringify(e),[l,s]=r.useState(()=>n?{allowed:!1,isLoading:!0}:{allowed:!0,isLoading:!1});return r.useEffect(()=>{if(!n){s({allowed:!0,isLoading:!1});return}let a=!1;return s(t=>({...t,isLoading:!0})),Promise.resolve(n.can(e)).then(t=>{if(a)return;const o=u(t);s({allowed:o.can,isLoading:!1,reason:o.reason})}).catch(t=>{a||s({allowed:!1,isLoading:!1,reason:t instanceof Error?t.message:"access check failed"})}),()=>{a=!0}},[n,c]),l}exports.useCan=f;
-//# sourceMappingURL=use-can.cjs.map
+const e=require("./access-control-context.cjs");let t=require("react");function n(e){return typeof e==`boolean`?{can:e}:e}function r(r){let i=e.useAccessControl(),a=JSON.stringify(r),[o,s]=(0,t.useState)(()=>i?{allowed:!1,isLoading:!0}:{allowed:!0,isLoading:!1});return(0,t.useEffect)(()=>{if(!i){s({allowed:!0,isLoading:!1});return}let e=!1;return s(e=>({...e,isLoading:!0})),Promise.resolve(i.can(r)).then(t=>{if(e)return;let r=n(t);s({allowed:r.can,isLoading:!1,reason:r.reason})}).catch(t=>{e||s({allowed:!1,isLoading:!1,reason:t instanceof Error?t.message:`access check failed`})}),()=>{e=!0}},[i,a]),o}exports.useCan=r;
+//# sourceMappingURL=use-can.cjs.map

package/dist/access/use-can.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-can.cjs","sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"names":["normalize","result","useCan","params","control","useAccessControl","paramsKey","state","setState","useState","useEffect","cancelled","prev","raw","error"],"mappings":"mJAaA,SAASA,EAAUC,EAAwC,CACvD,OAAO,OAAOA,GAAW,UAAY,CAAE,IAAKA,GAAWA,CAC3D,CAWO,SAASC,EAAOC,EAAiC,CACpD,MAAMC,EAAUC,EAAAA,iBAAA,EACVC,EAAY,KAAK,UAAUH,CAAM,EAEjC,CAACI,EAAOC,CAAQ,EAAIC,EAAAA,SAAuB,IAC7CL,EAAU,CAAE,QAAS,GAAO,UAAW,EAAA,EAAS,CAAE,QAAS,GAAM,UAAW,EAAA,CAAM,EAGtFM,OAAAA,EAAAA,UAAU,IAAM,CACZ,GAAI,CAACN,EAAS,CACVI,EAAS,CAAE,QAAS,GAAM,UAAW,GAAO,EAC5C,MACJ,CAEA,IAAIG,EAAY,GAChB,OAAAH,EAAUI,IAAU,CAAE,GAAGA,EAAM,UAAW,IAAO,EAEjD,QAAQ,QAAQR,EAAQ,IAAID,CAAM,CAAC,EAC9B,KAAMU,GAAQ,CACX,GAAIF,EAAW,OACf,MAAMV,EAASD,EAAUa,CAAG,EAC5BL,EAAS,CAAE,QAASP,EAAO,IAAK,UAAW,GAAO,OAAQA,EAAO,OAAQ,CAC7E,CAAC,EACA,MAAOa,GAAmB,CACnBH,GACJH,EAAS,CACL,QAAS,GACT,UAAW,GACX,OAAQM,aAAiB,MAAQA,EAAM,QAAU,qBAAA,CACpD,CACL,CAAC,EAEE,IAAM,CACTH,EAAY,EAChB,CAGJ,EAAG,CAACP,EAASE,CAAS,CAAC,EAEhBC,CACX"}
+{"version":3,"file":"use-can.cjs","names":[],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":"uEAaA,SAAS,EAAU,EAAwC,CACvD,OAAO,OAAO,GAAW,UAAY,CAAE,IAAK,CAAO,EAAI,CAC3D,CAWA,SAAgB,EAAO,EAAiC,CACpD,IAAM,EAAU,EAAA,iBAAiB,EAC3B,EAAY,KAAK,UAAU,CAAM,EAEjC,CAAC,EAAO,IAAA,EAAA,EAAA,SAAA,KACV,EAAU,CAAE,QAAS,GAAO,UAAW,EAAK,EAAI,CAAE,QAAS,GAAM,UAAW,EAAM,CACtF,EAiCA,OA/BA,EAAA,EAAA,UAAA,KAAgB,CACZ,GAAI,CAAC,EAAS,CACV,EAAS,CAAE,QAAS,GAAM,UAAW,EAAM,CAAC,EAC5C,MACJ,CAEA,IAAI,EAAY,GAkBhB,OAjBA,EAAU,IAAU,CAAE,GAAG,EAAM,UAAW,EAAK,EAAE,EAEjD,QAAQ,QAAQ,EAAQ,IAAI,CAAM,CAAC,CAAC,CAC/B,KAAM,GAAQ,CACX,GAAI,EAAW,OACf,IAAM,EAAS,EAAU,CAAG,EAC5B,EAAS,CAAE,QAAS,EAAO,IAAK,UAAW,GAAO,OAAQ,EAAO,MAAO,CAAC,CAC7E,CAAC,CAAC,CACD,MAAO,GAAmB,CACnB,GACJ,EAAS,CACL,QAAS,GACT,UAAW,GACX,OAAQ,aAAiB,MAAQ,EAAM,QAAU,qBACrD,CAAC,CACL,CAAC,MAEQ,CACT,EAAY,EAChB,CAGJ,EAAG,CAAC,EAAS,CAAS,CAAC,EAEhB,CACX"}