tempest-react-sdk 0.76.0 → 0.77.0

package/bin/lib/openapi/generate.mjs

@@ -1,6 +1,7 @@
 // OpenAPI 3.x → per-tag { schemas.ts (Zod), types.ts, service.ts (class) }.
 // Pure: takes the parsed spec object, returns a { path: contents } map. No I/O.
-import { refName, zodName, schemaToZod } from "./schema-to-zod.mjs";
+import { assertNoCollision, commentText, toIdentifier, urlTemplate } from "./escape.mjs";
+import { refName, schemaToZod, typeName, zodName } from "./schema-to-zod.mjs";
 
 const HTTP_METHODS = ["get", "post", "put", "patch", "delete"];
 
@@ -20,19 +21,68 @@ function pascal(s) {
     return s.replace(/(^|[^a-zA-Z0-9])([a-zA-Z0-9])/g, (_, _b, ch) => ch.toUpperCase());
 }
 
-/** camelCase method name from operationId or method+path. */
+/**
+ * camelCase method name from operationId or method+path.
+ *
+ * The result only ever holds `[a-zA-Z0-9]`, so it cannot carry code; an
+ * operationId that sanitizes to nothing, or to a leading digit, falls back to
+ * the method+path name and is otherwise prefixed with `_` to stay an identifier.
+ */
 function methodName(op, method, path) {
-    if (op.operationId) {
+    if (typeof op.operationId === "string") {
         const id = op.operationId.replace(/[^a-zA-Z0-9]+(.)?/g, (_, ch) =>
             ch ? ch.toUpperCase() : "",
         );
-        return id.charAt(0).toLowerCase() + id.slice(1);
+        if (/^[a-zA-Z]/.test(id)) return id.charAt(0).toLowerCase() + id.slice(1);
     }
     const parts = path
         .split("/")
         .filter(Boolean)
-        .map((p) => p.replace(/[{}]/g, ""));
-    return method + parts.map((p) => pascal(p)).join("");
+        .map((p) => pascal(p).replace(/[^a-zA-Z0-9]/g, ""));
+    return method + parts.join("");
+}
+
+/**
+ * Member names every generated service class already has: the constructor and the
+ * injected `api` property. An operation whose method name lands on one of them is
+ * deduplicated like any other collision (`constructor2`, `api2`).
+ */
+const CLASS_MEMBERS = ["constructor", "api"];
+
+/**
+ * Names a generated method body uses besides its path parameters: the `body` and
+ * `params` arguments and the `S` schemas import. A path parameter that maps to one
+ * of them becomes `<name>Param` (`{body}` → `bodyParam`), so it neither duplicates
+ * an argument nor shadows the import.
+ */
+const METHOD_LOCALS = new Set(["body", "params", "S"]);
+
+/**
+ * Check every `pattern` in a schema compiles as a JavaScript regex.
+ *
+ * The generated Zod schema builds it with `new RegExp(...)` when the module is
+ * imported, so an invalid one would only surface in the app at runtime — a blank
+ * screen. Failing here names the schema and where in it the pattern sits.
+ *
+ * @param {unknown} node - The schema (sub)node.
+ * @param {string} schema - The component schema name, for the error.
+ * @param {string[]} [at] - Keys from the schema root to `node`.
+ * @throws {Error} When a pattern does not compile.
+ */
+function assertPatterns(node, schema, at = []) {
+    if (!node || typeof node !== "object") return;
+    if (typeof node.pattern === "string") {
+        try {
+            new RegExp(node.pattern);
+        } catch (err) {
+            throw new Error(
+                `OpenAPI schema ${JSON.stringify(schema)} at ${at.join(".") || "(root)"}: pattern ${JSON.stringify(node.pattern)} is not a valid JavaScript regular expression (${err.message}).`,
+            );
+        }
+    }
+    for (const [key, value] of Object.entries(node)) {
+        if (key !== "pattern") assertPatterns(value, schema, [...at, key]);
+    }
 }
 
 /** Collect component-schema names referenced (transitively) by a schema node. */
@@ -58,7 +108,7 @@ function collectRefs(node, schemas, acc = new Set(), seen = new Set()) {
 /** TS type expression for a schema node (uses generated type names for $refs). */
 function tsType(schema) {
     if (!schema || typeof schema !== "object") return "unknown";
-    if (schema.$ref) return refName(schema.$ref);
+    if (schema.$ref) return typeName(refName(schema.$ref));
     if (schema.allOf) return schema.allOf.map(tsType).join(" & ");
     if (schema.anyOf || schema.oneOf) {
         const parts = (schema.anyOf ?? schema.oneOf).map(tsType);
@@ -189,6 +239,10 @@ function bodySchema(op) {
  */
 export function generate(doc) {
     const schemas = doc.components?.schemas ?? {};
+    assertNoCollision(
+        Object.keys(schemas).map((n) => [n, typeName(n)]),
+        "schema names",
+    );
     const groups = new Map(); // slug → { tag, ops: [...] }
 
     for (const [path, item] of Object.entries(doc.paths ?? {})) {
@@ -202,12 +256,17 @@ export function generate(doc) {
         }
     }
 
+    assertNoCollision(
+        [...groups.keys()].map((slug) => [slug, slugIdent(slug)]),
+        "tags (as barrel names)",
+    );
+
     const files = {};
     const tags = [];
 
     for (const { tag, slug, ops } of groups.values()) {
         tags.push(tag);
-        const Class = `${pascal(slug)}Service`;
+        const Class = `${slugIdent(pascal(slug))}Service`;
 
         // 1. Which component schemas does this group touch (transitively)?
         const used = new Set();
@@ -218,6 +277,7 @@ export function generate(doc) {
             if (r) collectRefs(r, schemas, used);
         }
         const { sorted, cyclic } = topoSort(used, schemas);
+        for (const name of sorted) assertPatterns(schemas[name], name);
 
         // 2. schemas.ts
         const schemaLines = sorted.map((name) => {
@@ -231,17 +291,17 @@ export function generate(doc) {
 
         // 3. types.ts
         const typeLines = sorted.map(
-            (name) => `export type ${name} = z.infer<typeof S.${zodName(name)}>;`,
+            (name) => `export type ${typeName(name)} = z.infer<typeof S.${zodName(name)}>;`,
         );
         files[`${slug}/types.ts`] =
             `import type { z } from "zod";\n\nimport * as S from "./schemas";\n\n${typeLines.join("\n")}\n`;
 
         // 4. service.ts
-        const usedNames = new Set();
+        const usedNames = new Set(CLASS_MEMBERS);
         const methods = ops.map(({ method, path, op }) =>
             emitMethod(method, path, op, schemas, usedNames),
         );
-        const usedTypeNames = [...used].sort();
+        const usedTypeNames = [...used].map(typeName).sort();
         const typeImport = usedTypeNames.length
             ? `import type { ${usedTypeNames.join(", ")} } from "./types";\n`
             : "";
@@ -255,7 +315,7 @@ export function generate(doc) {
             `import type { ${sdkTypes.join(", ")} } from "tempest-react-sdk";\n\n` +
             schemaImport +
             typeImport +
-            `\n/** Generated service for the "${tag}" routes. Inject an ApiClient (createApiClient). */\n` +
+            `\n/** Generated service for the "${commentText(tag)}" routes. Inject an ApiClient (createApiClient). */\n` +
             `export class ${Class} {\n` +
             `    constructor(private readonly api: ApiClient) {}\n\n` +
             body +
@@ -287,6 +347,22 @@ function emitMethod(method, path, op, schemas, usedNames = new Set()) {
     }
     usedNames.add(name);
     const pathParams = (op.parameters ?? []).filter((p) => p.in === "path");
+    const where = `${method.toUpperCase()} ${path}`;
+    const paramId = (name) => {
+        const id = toIdentifier(name, "camel", `path parameter in ${where}`);
+        return METHOD_LOCALS.has(id) ? `${id}Param` : id;
+    };
+    const paramIds = new Map(pathParams.map((p) => [p.name, paramId(p.name)]));
+    assertNoCollision(
+        [
+            ...[...paramIds],
+            ...(bodySchema(op) ? [["the request body argument", "body"]] : []),
+            ...((op.parameters ?? []).some((p) => p.in === "query")
+                ? [["the query argument", "params"]]
+                : []),
+        ],
+        `method arguments of ${where}`,
+    );
     const queryParams = (op.parameters ?? []).filter((p) => p.in === "query");
     const body = bodySchema(op);
     const resp = successSchema(op);
@@ -299,7 +375,9 @@ function emitMethod(method, path, op, schemas, usedNames = new Set()) {
           : "void";
 
     const args = [];
-    for (const p of pathParams) args.push(`${p.name}: ${tsType(p.schema ?? { type: "string" })}`);
+    for (const p of pathParams) {
+        args.push(`${paramIds.get(p.name)}: ${tsType(p.schema ?? { type: "string" })}`);
+    }
     if (body) args.push(`body: ${tsType(body)}`);
     if (queryParams.length) {
         const q = queryParams
@@ -311,9 +389,7 @@ function emitMethod(method, path, op, schemas, usedNames = new Set()) {
         args.push(`params: { ${q} }`);
     }
 
-    // Interpolate path params into a template literal.
-    const tpl = path.replace(/{([^}]+)}/g, (_, n) => "${" + n + "}");
-    const url = pathParams.length ? `\`${tpl}\`` : JSON.stringify(path);
+    const url = urlTemplate(path, paramIds);
 
     const callOpts = [];
     if (body) callOpts.push("body");
@@ -330,7 +406,7 @@ function emitMethod(method, path, op, schemas, usedNames = new Set()) {
     const ret = retType === "void" ? "Promise<void>" : `Promise<${retType}>`;
     const generic = retType === "void" ? "" : `<${retType}>`;
     return (
-        `    /** \`${method.toUpperCase()} ${path}\`${op.summary ? ` — ${op.summary}` : ""} */\n` +
+        `    /** \`${method.toUpperCase()} ${commentText(path)}\`${op.summary ? ` — ${commentText(op.summary)}` : ""} */\n` +
         `    async ${name}(${args.join(", ")}): ${ret} {\n` +
         validation +
         `        return this.api.${method}${generic}(${url}${optsArg});\n` +

package/bin/lib/openapi/schema-to-zod.mjs

@@ -1,14 +1,51 @@
 // JSON Schema (OpenAPI 3.0/3.1 subset) → Zod expression source string.
 // Pure + deterministic so the generated output is stable and testable.
 
-/** Convert a $ref like "#/components/schemas/User" to its schema name ("User"). */
+import { toIdentifier } from "./escape.mjs";
+
+/**
+ * Convert a $ref like "#/components/schemas/User" to its spec schema name
+ * ("User"). This is the lookup key into `components.schemas`, not yet an
+ * identifier: pass it through {@link typeName} before emitting it.
+ */
 export function refName(ref) {
     return ref.slice(ref.lastIndexOf("/") + 1);
 }
 
-/** The generated Zod const name for a schema name (e.g. "User" → "UserSchema"). */
+/**
+ * Names the generated files declare, import or rely on as globals next to the
+ * schema types: the SDK types `service.ts` imports, the `z` and `S` imports, and
+ * the `Promise` / `Record` globals the emitted signatures use. A schema with one
+ * of these names would collide with the import or shadow the global.
+ */
+export const GENERATED_NAMES = new Set([
+    "ApiClient",
+    "CursorPage",
+    "OffsetPage",
+    "Promise",
+    "Record",
+    "S",
+    "z",
+]);
+
+/**
+ * The TypeScript type name for a spec schema name (`user.Response` →
+ * `UserResponse`; a valid identifier is kept as is). A name in
+ * {@link GENERATED_NAMES} gets a `_` prefix (`Promise` → `_Promise`).
+ *
+ * @throws {Error} When the name has nothing to build an identifier from.
+ */
+export function typeName(name) {
+    const id = toIdentifier(name, "pascal", "schema name");
+    return GENERATED_NAMES.has(id) ? `_${id}` : id;
+}
+
+/**
+ * The generated Zod const name for a spec schema name
+ * (`User` → `UserSchema`, `user.Response` → `UserResponseSchema`).
+ */
 export function zodName(name) {
-    return `${name}Schema`;
+    return `${typeName(name)}Schema`;
 }
 
 function isNullable(schema) {
@@ -77,7 +114,7 @@ export function schemaToZod(schema, resolveRef = (ref) => zodName(refName(ref)))
             if (typeof schema.minLength === "number") e += `.min(${schema.minLength})`;
             if (typeof schema.maxLength === "number") e += `.max(${schema.maxLength})`;
             if (typeof schema.pattern === "string")
-                e += `.regex(/${schema.pattern.replace(/\//g, "\\/")}/)`;
+                e += `.regex(new RegExp(${JSON.stringify(schema.pattern)}))`;
             return withModifiers(e, schema);
         }
         case "integer":

package/bin/tempest.mjs

@@ -6,15 +6,17 @@
 //   tempest lint [paths…]    run ESLint (report only)
 //   tempest fix [paths…]     alias imports (../ → @/) + ESLint --fix + Prettier
 //   tempest format [paths…]  Prettier --write
+//   tempest gen <api|icons|component> …   code generators (`new component` = alias)
 //   tempest --help | --version
 import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { aliasImports } from "./lib/alias/index.mjs";
 import { describeTypeScript, loadTypeScript } from "./lib/alias/typescript.mjs";
 import { readTsconfig } from "./lib/alias/tsconfig.mjs";
+import { componentFiles } from "./lib/component/generate.mjs";
 import { analyzeCss, applyCssFixes, applyExtraction, planExtraction } from "./lib/css/index.mjs";
 import { analyzeDesign } from "./lib/design/index.mjs";
 import { checkLucide } from "./lib/doctor/lucide.mjs";
@@ -1375,7 +1377,164 @@ async function genIcons(args) {
     return 0;
 }
 
-const GEN_TARGETS = { api: genApi, icons: genIcons };
+// ------------------------------------------------------- gen component ----
+
+/**
+ * `lstat` that answers `null` for a missing path instead of throwing.
+ *
+ * @param {string} path - Absolute path.
+ * @returns {import("node:fs").Stats | null}
+ */
+function lstatOrNull(path) {
+    try {
+        return lstatSync(path);
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Whether `path` would be created inside the project.
+ *
+ * Resolves the nearest ancestor that exists through `realpath`, so `../x`, an
+ * absolute path and an ancestor that is a symlink to somewhere else
+ * (`src/components -> /elsewhere`) are all seen where they really land.
+ *
+ * @param {string} path - Absolute path about to be created.
+ * @returns {boolean}
+ */
+function landsInsideProject(path) {
+    let existing = path;
+    while (!existsSync(existing) && dirname(existing) !== existing) existing = dirname(existing);
+    const rel = relative(realpathSync(ROOT), realpathSync(existing));
+    return !(rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel));
+}
+
+/**
+ * Parse the `gen component` argv tail.
+ *
+ * Unlike the shared {@link parseOut}, a `--out` with no value, an empty one or
+ * one that is another flag (`--out --force`) is an error rather than a silent
+ * fallback to the default or a folder named `--force`.
+ *
+ * @param {string[]} args - Arguments after `component`.
+ * @returns {{ error: string } | { name: string | undefined, out: string, force: boolean }}
+ */
+function parseComponentArgs(args) {
+    let out = "src/components";
+    let force = false;
+    const positionals = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--force") {
+            force = true;
+        } else if (arg === "--out") {
+            const value = args[i + 1];
+            if (value === undefined || value === "" || value.startsWith("--")) {
+                return { error: "--out needs a folder, e.g. --out src/components" };
+            }
+            out = value;
+            i += 1;
+        } else if (arg.startsWith("--")) {
+            return { error: `Unknown option: ${arg}` };
+        } else {
+            positionals.push(arg);
+        }
+    }
+    if (positionals.length > 1) {
+        return {
+            error: `Expected one component name, got ${positionals.length}. Quote a name with spaces: tempest gen component "User Card"`,
+        };
+    }
+    return { name: positionals[0], out, force };
+}
+
+/**
+ * `tempest gen component <Name> [--out src/components] [--force]` — create
+ * `<out>/<Name>/` with `index.tsx`, `styles.module.css`, `constants.ts`,
+ * `utils.ts` and `hooks.ts`.
+ *
+ * The name is normalized to PascalCase (`"user card"` → `UserCard`). Every check
+ * runs before the first write, so a refusal leaves the disk untouched:
+ *
+ * - the folder must land inside the project once symlinks are resolved;
+ * - an existing folder is refused unless `--force`;
+ * - the folder must not be a symlink, and each of the five files must be a
+ *   regular file or missing — never a symlink or a directory — even with
+ *   `--force`, which then rewrites only those five and leaves the rest alone.
+ *
+ * The closing hint prints an `@/` import when the folder is under `src/`, the
+ * only place the template's alias reaches; elsewhere it prints the path.
+ */
+async function genComponent(args) {
+    const parsed = parseComponentArgs(args);
+    if ("error" in parsed) {
+        console.error(`${c.red}✗ ${parsed.error}${c.reset}`);
+        return 1;
+    }
+    let generated;
+    try {
+        generated = componentFiles(parsed.name);
+    } catch (err) {
+        console.error(`${c.red}✗ ${err.message}${c.reset}`);
+        return 1;
+    }
+    const dir = resolve(ROOT, parsed.out, generated.name);
+    const shown = relative(ROOT, dir).split(sep).join("/") || ".";
+
+    if (!landsInsideProject(dir)) {
+        console.error(
+            `${c.red}✗ ${dir} is outside the project${c.reset} (${ROOT}), once symlinks are resolved. Pick an --out inside it.`,
+        );
+        return 1;
+    }
+    const dirStat = lstatOrNull(dir);
+    if (dirStat?.isSymbolicLink()) {
+        console.error(`${c.red}✗ ${shown} is a symlink; refusing to write through it.${c.reset}`);
+        return 1;
+    }
+    if (dirStat && !parsed.force) {
+        console.error(
+            `${c.red}✗ ${shown} already exists.${c.reset} Pass --force to rewrite its five generated files.`,
+        );
+        return 1;
+    }
+    if (dirStat && !dirStat.isDirectory()) {
+        console.error(`${c.red}✗ ${shown} exists and is not a folder.${c.reset}`);
+        return 1;
+    }
+    const blocked = Object.keys(generated.files).find((file) => {
+        const stat = lstatOrNull(join(dir, file));
+        return stat !== null && !stat.isFile();
+    });
+    if (blocked) {
+        console.error(
+            `${c.red}✗ ${shown}/${blocked} is not a regular file${c.reset} (a folder or a symlink); nothing was written.`,
+        );
+        return 1;
+    }
+
+    await mkdir(dir, { recursive: true });
+    for (const [file, contents] of Object.entries(generated.files)) {
+        await writeFile(join(dir, file), contents);
+    }
+
+    console.log(`${c.green}✓ ${generated.name}${c.reset} → ${c.bold}${shown}/${c.reset}`);
+    for (const file of Object.keys(generated.files)) console.log(`  ${c.dim}· ${file}${c.reset}`);
+    const fromSrc = relative(join(ROOT, "src"), dir);
+    const outsideSrc = fromSrc === ".." || fromSrc.startsWith(`..${sep}`) || isAbsolute(fromSrc);
+    if (outsideSrc) {
+        console.log(
+            `\n${c.yellow}! ${shown} is outside src/${c.reset}, where the template's @/ alias does not reach — import it by a relative path.`,
+        );
+    } else {
+        console.log(`\n${c.dim}Use it:${c.reset}`);
+        console.log(`  import { ${generated.name} } from "@/${fromSrc.split(sep).join("/")}";`);
+    }
+    return 0;
+}
+
+const GEN_TARGETS = { api: genApi, icons: genIcons, component: genComponent };
 
 function gen(args) {
     const what = args[0];
@@ -1389,6 +1548,21 @@ function gen(args) {
     return target(args.slice(1));
 }
 
+/**
+ * `tempest new component <Name>` — the spelling from issue #454, kept as an
+ * alias of `tempest gen component`. Only `component` is accepted, so `new` does
+ * not become a second name for every generator.
+ */
+function newCommand(args) {
+    if (args[0] !== "component") {
+        console.error(
+            `${c.red}✗ Unknown new target: ${args[0] ?? "(none)"}${c.reset} — supported: component (alias of tempest gen component).`,
+        );
+        return 1;
+    }
+    return genComponent(args.slice(1));
+}
+
 // ------------------------------------------------------------------ main ----
 
 function usage() {
@@ -1408,6 +1582,12 @@ ${c.bold}Commands${c.reset}
                     (e.g. tempest gen api http://127.0.0.1:8000/openapi.json --out src/api)
   ${c.bold}gen icons${c.reset}         Write a static icon registry from the slugs your source uses
                     (e.g. tempest gen icons --out src/icons.generated.ts --dir src)
+  ${c.bold}gen component${c.reset} <Name>
+                    Create <out>/<Name>/ with index.tsx, styles.module.css,
+                    constants.ts, utils.ts and hooks.ts (name → PascalCase)
+                    (e.g. tempest gen component "user card" --out src/components)
+                    --force rewrites the five files of an existing folder.
+                    Alias: tempest new component <Name>
 
 ${c.bold}doctor options${c.reset}
   --no-css          Skip the CSS analysis
@@ -1450,6 +1630,7 @@ const commands = {
     fix: () => fix(rest),
     format: () => format(rest),
     gen: () => gen(rest),
+    new: () => newCommand(rest),
 };
 
 if (!commands[cmd]) {

package/dist/auth/create-tempest-auth.cjs

@@ -1,2 +1,2 @@
-const e=require("../http/api-client.cjs"),t=require("./create-auth-store.cjs"),n=require("./refresh-queue.cjs");function r(e){let t=e??{};return{token:t.access_token,refreshToken:t.refresh_token}}function i(i){let{baseURL:a,prefix:o,loginPath:s=`/api/auth/login`,refreshPath:c=`/api/auth/refresh`,mePath:l,storeName:u=`tempest-auth`,storage:d=`local`,withCredentials:f=!1,csrf:p,fetcher:m,parseTokens:h=r,parseUser:g,refreshBody:_=e=>e?{refresh_token:e}:void 0,retry:v,redirectTo:y}=i,b=t.createAuthStore({name:u,storage:d}),x=`${u}-refresh`;function S(){return typeof window>`u`?null:d===`session`?window.sessionStorage:window.localStorage}function C(){return S()?.getItem(x)??null}function w(e){let t=S();t&&(e?t.setItem(x,e):t.removeItem(x))}let T=()=>b.getState(),E=()=>T().token;async function D(){if(!l)return T().user;let e=await M.get(l,{skipAuthRetry:!0});return T().setUser(e),e}async function O(e){let t=await M.post(s,{body:e,skipAuth:!0}),{token:n,refreshToken:r}=h(t);T().setToken(n),w(r??null);let i=g?.(t);return i==null?D():(T().setUser(i),i)}function k(){T().logout(),w(null)}function A(){k(),y&&typeof window<`u`&&window.location.assign(y)}let j=n.createRefreshQueue(async()=>{let e=await M.post(c,{body:_(C()),skipAuth:!0}),{token:t,refreshToken:n}=h(e);T().setToken(t),n&&w(n)}),M=e.createApiClient({baseURL:a,prefix:o,withCredentials:f,csrf:p,fetcher:m,getToken:E,refresh:j,retry:v,onUnauthorized:()=>A()});return{useAuthStore:b,api:M,login:O,logout:k,refresh:j,getToken:E}}exports.createTempestAuth=i;
+const e=require("../http/errors.cjs"),t=require("../http/api-client.cjs"),n=require("./create-auth-store.cjs"),r=require("./refresh-queue.cjs");function i(e){let t=e??{};return{token:t.access_token,refreshToken:t.refresh_token}}function a(a){let{baseURL:o,prefix:s,loginPath:c=`/api/auth/login`,refreshPath:l=`/api/auth/refresh`,mePath:u,storeName:d=`tempest-auth`,storage:f=`local`,withCredentials:p=!1,csrf:m,fetcher:h,parseTokens:g=i,parseUser:_,refreshBody:v=e=>e?{refresh_token:e}:void 0,retry:y,redirectTo:b,onSessionEnd:x}=a,S=n.createAuthStore({name:d,storage:f}),C=`${d}-refresh`;function w(){return typeof window>`u`?null:f===`session`?window.sessionStorage:window.localStorage}function T(){return w()?.getItem(C)??null}function E(e){let t=w();t&&(e?t.setItem(C,e):t.removeItem(C))}let D=()=>S.getState(),O=()=>D().token;async function k(){if(!u)return D().user;let e=await U.get(u,{skipAuthRetry:!0});return D().setUser(e),e}let A=0,j=Promise.resolve(),M=0;function N(){A+=1,F=r.createRefreshQueue(P)}async function P(){let t=A,n;try{n=await U.post(l,{body:v(T()),skipAuth:!0})}catch(n){throw A===t?n:new e.SessionSupersededError}if(A!==t)throw new e.SessionSupersededError;let{token:r,refreshToken:i}=g(n);D().setToken(r),i&&E(i)}let F=r.createRefreshQueue(P);function I(e){let t=O();return t===null?!1:e.token===null||e.token!==t}async function L(t){if(t.epoch!==null&&t.epoch!==A)throw new e.SessionSupersededError;if(I(t)){if(t.token===null)throw Error(`anonymous 401 under a live session`);return}return F()}async function R(t,n){if(n.epoch!==null&&n.epoch!==A)throw new e.SessionSupersededError;I(n)||await H()}async function z(t){let n=A,r=await U.post(c,{body:t,skipAuth:!0});if(A!==n)throw new e.SessionSupersededError;let{token:i,refreshToken:a}=g(r),{done:o}=B(`switch`),s=A;if(await o.catch(()=>void 0),A!==s)throw new e.SessionSupersededError;D().setToken(i),E(a??null);let l=_?.(r);return l==null?k():(D().setUser(l),l)}function B(e){N();let{user:n,token:r}=D(),i=r!==null||n!==null||T()!==null;if(D().logout(),E(null),!i)return{live:i,done:e===`switch`||M===0?j:Promise.resolve()};if(!x)return{live:i,done:Promise.resolve()};let a=t.createApiClient({baseURL:o,prefix:s,withCredentials:p,csrf:m,fetcher:h,getToken:()=>r});M+=1;let c=(async()=>{try{await x({reason:e,user:n,token:r,api:a})}finally{--M}})();return j=c.then(()=>void 0,()=>void 0),{live:i,done:c.then(()=>void 0)}}function V(){return B(`logout`).done}async function H(){let{live:e,done:t}=B(`expired`);await t.catch(()=>void 0),e&&b&&typeof window<`u`&&window.location.assign(b)}let U=t.createApiClient({baseURL:o,prefix:s,withCredentials:p,csrf:m,fetcher:h,getToken:O,getSessionEpoch:()=>A,refresh:L,retry:y,onUnauthorized:R});return{useAuthStore:S,api:U,login:z,logout:V,refresh:()=>F(),getToken:O}}exports.createTempestAuth=a;
 //# sourceMappingURL=create-tempest-auth.cjs.map

package/dist/auth/create-tempest-auth.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"create-tempest-auth.cjs","names":[],"sources":["../../src/auth/create-tempest-auth.ts"],"sourcesContent":["import { createApiClient } from \"../http\";\nimport type { ApiClient, CsrfOptions, RetryOptions } from \"../http\";\nimport { createAuthStore } from \"./create-auth-store\";\nimport type { AuthState } from \"./create-auth-store\";\nimport { createRefreshQueue } from \"./refresh-queue\";\n\n/** The token envelope returned by a Tempest FastAPI SDK login/refresh route. */\nexport interface TempestTokenResponse {\n    /** The bearer access token. */\n    access_token: string;\n    /** Token type — always `\"bearer\"` for the SDK. */\n    token_type?: string;\n    /** Optional refresh token (when the API returns it in the body, not a cookie). */\n    refresh_token?: string;\n}\n\nexport interface CreateTempestAuthOptions<TUser> {\n    /** Base URL of the API. Required. */\n    baseURL: string;\n    /**\n     * Path segment the API is mounted under, such as `\"/api\"`, forwarded to\n     * every client this preset builds — see the `prefix` option of\n     * `createApiClient`.\n     *\n     * Safe to combine with the default paths below: the prefix is applied at\n     * most once, so `\"/api/auth/login\"` under a `\"/api\"` prefix stays\n     * `\"/api/auth/login\"`.\n     */\n    prefix?: string;\n    /** Login route (`POST`). Default: `\"/api/auth/login\"`. */\n    loginPath?: string;\n    /** Refresh route (`POST`). Default: `\"/api/auth/refresh\"`. */\n    refreshPath?: string;\n    /** Optional current-user route (`GET`) called after login/refresh. */\n    mePath?: string;\n    /** Persist key for the store. Default: `\"tempest-auth\"`. */\n    storeName?: string;\n    /** Storage backend. Default: `\"local\"`. */\n    storage?: \"local\" | \"session\";\n    /** Send cookies (needed when the refresh token lives in an httpOnly cookie). */\n    withCredentials?: boolean;\n    /**\n     * CSRF token for every write, forwarded to `createApiClient`'s `csrf`. Off\n     * by default; `true` echoes the `csrf_token` cookie as `X-CSRF-Token`.\n     *\n     * The pair to `withCredentials`: once the refresh token lives in a cookie,\n     * the browser attaches it to a `POST /auth/refresh` that another site\n     * triggers. Login and refresh carry the header too — they go out with\n     * `skipAuth`, and the CSRF header does not follow auth.\n     */\n    csrf?: boolean | CsrfOptions;\n    /** Custom fetch implementation (testing / SSR). Defaults to `globalThis.fetch`. */\n    fetcher?: typeof fetch;\n    /**\n     * Extract tokens from a login/refresh response. Default reads\n     * `access_token` + `refresh_token`.\n     */\n    parseTokens?: (data: unknown) => { token: string; refreshToken?: string };\n    /** Pull the user out of the login response, when the API embeds it. */\n    parseUser?: (data: unknown) => TUser | null;\n    /**\n     * Build the refresh request body. Default sends `{ refresh_token }` when a\n     * refresh token is stored, else `undefined` (cookie-based refresh).\n     */\n    refreshBody?: (refreshToken: string | null) => unknown;\n    /**\n     * Retry policy for `api`, forwarded to {@link createApiClient}. Off by\n     * default; `true` enables the conservative built-in policy, which never\n     * replays a write.\n     */\n    retry?: boolean | RetryOptions;\n    /**\n     * Where to send the browser when the session ends — a hard navigation via\n     * `window.location.assign`, after the store is cleared.\n     *\n     * **Prefer leaving this unset.** `logout()` already clears the store, so a\n     * `<RouteGuard when={isAuthenticated} redirectTo=\"/login\">` wrapped around\n     * the protected area navigates on its own, which keeps the SPA alive and the\n     * router history intact. Reach for this only when the expiry can happen\n     * outside any guarded subtree and a full reload is acceptable.\n     */\n    redirectTo?: string;\n}\n\nexport interface TempestAuth<TUser, TCredentials> {\n    /** The persisted Zustand auth store hook (compatible with `<AuthGuard>`). */\n    useAuthStore: ReturnType<typeof createAuthStore<TUser>>;\n    /** A `createApiClient` wired with bearer auth + 401 → refresh → retry. */\n    api: ApiClient;\n    /** Authenticate, store the session, and resolve the user (or null). */\n    login: (credentials: TCredentials) => Promise<TUser | null>;\n    /** Clear the session (and the stored refresh token). */\n    logout: () => void;\n    /** Refresh the access token (deduplicated across concurrent callers). */\n    refresh: () => Promise<void>;\n    /** The current access token, or null. */\n    getToken: () => string | null;\n}\n\nfunction defaultParseTokens(data: unknown): { token: string; refreshToken?: string } {\n    const d = (data ?? {}) as TempestTokenResponse;\n    return { token: d.access_token, refreshToken: d.refresh_token };\n}\n\n/**\n * Turn-key auth preset wiring `createAuthStore` + `createRefreshQueue` +\n * `createApiClient` to the Tempest FastAPI SDK auth contract: login returns\n * `{ access_token, token_type }`, requests carry `Authorization: Bearer`, and a\n * `401` triggers a single deduplicated refresh + replay.\n *\n * The session is cleared whenever that path ends unauthorized anyway — the\n * refresh threw, or the replay came back `401` — so a refresh token that the\n * backend has revoked cannot leave the app holding a dead session. With\n * `redirectTo` set, the browser also leaves the page; without it, clearing the\n * store is enough for a `<RouteGuard>` to navigate on its own.\n *\n * @example\n * const auth = createTempestAuth<User, { email: string; password: string }>({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     mePath: \"/api/auth/me\",\n * });\n *\n * await auth.login({ email, password });   // stores session, returns the user\n * const orders = await auth.api.get(\"/api/orders\");  // sends the bearer token\n * auth.logout();\n *\n * @param options - The auth configuration.\n * @returns The store hook, a wired API client, and login/logout/refresh helpers.\n */\nexport function createTempestAuth<TUser, TCredentials = { email: string; password: string }>(\n    options: CreateTempestAuthOptions<TUser>,\n): TempestAuth<TUser, TCredentials> {\n    const {\n        baseURL,\n        prefix,\n        loginPath = \"/api/auth/login\",\n        refreshPath = \"/api/auth/refresh\",\n        mePath,\n        storeName = \"tempest-auth\",\n        storage = \"local\",\n        withCredentials = false,\n        csrf,\n        fetcher,\n        parseTokens = defaultParseTokens,\n        parseUser,\n        refreshBody = (rt) => (rt ? { refresh_token: rt } : undefined),\n        retry,\n        redirectTo,\n    } = options;\n\n    const useAuthStore = createAuthStore<TUser>({ name: storeName, storage });\n    const refreshKey = `${storeName}-refresh`;\n\n    function storageImpl(): Storage | null {\n        if (typeof window === \"undefined\") return null;\n        return storage === \"session\" ? window.sessionStorage : window.localStorage;\n    }\n    function readRefreshToken(): string | null {\n        return storageImpl()?.getItem(refreshKey) ?? null;\n    }\n    function writeRefreshToken(token: string | null): void {\n        const s = storageImpl();\n        if (!s) return;\n        if (token) s.setItem(refreshKey, token);\n        else s.removeItem(refreshKey);\n    }\n\n    const state = (): AuthState<TUser> => useAuthStore.getState();\n    const getToken = (): string | null => state().token;\n\n    /**\n     * Load the current user, without letting a `401` end the session.\n     *\n     * `skipAuthRetry` is what keeps this one client honest: the call is\n     * authenticated, but a `401` here surfaces instead of triggering a refresh\n     * and `onUnauthorized`. That was the behaviour of the throwaway client this\n     * used to build per invocation, and it is the reason the preset needed\n     * three clients before 0.66.0.\n     */\n    async function fetchUser(): Promise<TUser | null> {\n        if (!mePath) return state().user;\n        const user = await api.get<TUser>(mePath, { skipAuthRetry: true });\n        state().setUser(user);\n        return user;\n    }\n\n    async function login(credentials: TCredentials): Promise<TUser | null> {\n        const data = await api.post<unknown>(loginPath, {\n            body: credentials,\n            skipAuth: true,\n        });\n        const { token, refreshToken } = parseTokens(data);\n        state().setToken(token);\n        writeRefreshToken(refreshToken ?? null);\n        const embedded = parseUser?.(data);\n        if (embedded != null) {\n            state().setUser(embedded);\n            return embedded;\n        }\n        return fetchUser();\n    }\n\n    function logout(): void {\n        state().logout();\n        writeRefreshToken(null);\n    }\n\n    /**\n     * Clear the session and, when `redirectTo` is set, leave the page.\n     *\n     * Separate from `logout` so an explicit sign-out stays a pure state change:\n     * a caller that already navigates itself would otherwise get a second,\n     * competing navigation.\n     */\n    function endSession(): void {\n        logout();\n        if (redirectTo && typeof window !== \"undefined\") {\n            window.location.assign(redirectTo);\n        }\n    }\n\n    const refresh = createRefreshQueue(async () => {\n        const data = await api.post<unknown>(refreshPath, {\n            body: refreshBody(readRefreshToken()),\n            skipAuth: true,\n        });\n        const { token, refreshToken } = parseTokens(data);\n        state().setToken(token);\n        if (refreshToken) writeRefreshToken(refreshToken);\n    });\n\n    const api = createApiClient({\n        baseURL,\n        prefix,\n        withCredentials,\n        csrf,\n        fetcher,\n        getToken,\n        refresh,\n        retry,\n        onUnauthorized: () => endSession(),\n    });\n\n    return { useAuthStore, api, login, logout, refresh, getToken };\n}\n"],"mappings":"gHAmGA,SAAS,EAAmB,EAAyD,CACjF,IAAM,EAAK,GAAQ,CAAC,EACpB,MAAO,CAAE,MAAO,EAAE,aAAc,aAAc,EAAE,aAAc,CAClE,CA2BA,SAAgB,EACZ,EACgC,CAChC,GAAM,CACF,UACA,SACA,YAAY,kBACZ,cAAc,oBACd,SACA,YAAY,eACZ,UAAU,QACV,kBAAkB,GAClB,OACA,UACA,cAAc,EACd,YACA,cAAe,GAAQ,EAAK,CAAE,cAAe,CAAG,EAAI,IAAA,GACpD,QACA,cACA,EAEE,EAAe,EAAA,gBAAuB,CAAE,KAAM,EAAW,SAAQ,CAAC,EAClE,EAAa,GAAG,EAAU,UAEhC,SAAS,GAA8B,CAEnC,OADI,OAAO,OAAW,IAAoB,KACnC,IAAY,UAAY,OAAO,eAAiB,OAAO,YAClE,CACA,SAAS,GAAkC,CACvC,OAAO,EAAY,CAAC,EAAE,QAAQ,CAAU,GAAK,IACjD,CACA,SAAS,EAAkB,EAA4B,CACnD,IAAM,EAAI,EAAY,EACjB,IACD,EAAO,EAAE,QAAQ,EAAY,CAAK,EACjC,EAAE,WAAW,CAAU,EAChC,CAEA,IAAM,MAAgC,EAAa,SAAS,EACtD,MAAgC,EAAM,CAAC,CAAC,MAW9C,eAAe,GAAmC,CAC9C,GAAI,CAAC,EAAQ,OAAO,EAAM,CAAC,CAAC,KAC5B,IAAM,EAAO,MAAM,EAAI,IAAW,EAAQ,CAAE,cAAe,EAAK,CAAC,EAEjE,OADA,EAAM,CAAC,CAAC,QAAQ,CAAI,EACb,CACX,CAEA,eAAe,EAAM,EAAkD,CACnE,IAAM,EAAO,MAAM,EAAI,KAAc,EAAW,CAC5C,KAAM,EACN,SAAU,EACd,CAAC,EACK,CAAE,QAAO,gBAAiB,EAAY,CAAI,EAChD,EAAM,CAAC,CAAC,SAAS,CAAK,EACtB,EAAkB,GAAgB,IAAI,EACtC,IAAM,EAAW,IAAY,CAAI,EAKjC,OAJI,GAAY,KAIT,EAAU,GAHb,EAAM,CAAC,CAAC,QAAQ,CAAQ,EACjB,EAGf,CAEA,SAAS,GAAe,CACpB,EAAM,CAAC,CAAC,OAAO,EACf,EAAkB,IAAI,CAC1B,CASA,SAAS,GAAmB,CACxB,EAAO,EACH,GAAc,OAAO,OAAW,KAChC,OAAO,SAAS,OAAO,CAAU,CAEzC,CAEA,IAAM,EAAU,EAAA,mBAAmB,SAAY,CAC3C,IAAM,EAAO,MAAM,EAAI,KAAc,EAAa,CAC9C,KAAM,EAAY,EAAiB,CAAC,EACpC,SAAU,EACd,CAAC,EACK,CAAE,QAAO,gBAAiB,EAAY,CAAI,EAChD,EAAM,CAAC,CAAC,SAAS,CAAK,EAClB,GAAc,EAAkB,CAAY,CACpD,CAAC,EAEK,EAAM,EAAA,gBAAgB,CACxB,UACA,SACA,kBACA,OACA,UACA,WACA,UACA,QACA,mBAAsB,EAAW,CACrC,CAAC,EAED,MAAO,CAAE,eAAc,MAAK,QAAO,SAAQ,UAAS,UAAS,CACjE"}
+{"version":3,"file":"create-tempest-auth.cjs","names":[],"sources":["../../src/auth/create-tempest-auth.ts"],"sourcesContent":["import { createApiClient, SessionSupersededError } from \"../http\";\nimport type { ApiClient, CsrfOptions, RequestAuthContext, RetryOptions } from \"../http\";\nimport { createAuthStore } from \"./create-auth-store\";\nimport type { AuthState } from \"./create-auth-store\";\nimport { createRefreshQueue } from \"./refresh-queue\";\n\n/** The token envelope returned by a Tempest FastAPI SDK login/refresh route. */\nexport interface TempestTokenResponse {\n    /** The bearer access token. */\n    access_token: string;\n    /** Token type — always `\"bearer\"` for the SDK. */\n    token_type?: string;\n    /** Optional refresh token (when the API returns it in the body, not a cookie). */\n    refresh_token?: string;\n}\n\n/**\n * What {@link CreateTempestAuthOptions.onSessionEnd} receives about the session\n * that just ended.\n */\nexport interface TempestSessionEnd<TUser> {\n    /**\n     * Why it ended: `\"logout\"` for an explicit `logout()`, `\"expired\"` when the\n     * client ended it on its own — the refresh failed, or the request replayed\n     * after a refresh still came back `401` — and `\"switch\"` when `login()`\n     * succeeded for another set of credentials while this session was live.\n     */\n    reason: \"logout\" | \"expired\" | \"switch\";\n    /** The user of the ended session, as the store held it. */\n    user: TUser | null;\n    /** The access token of the ended session, or `null` when it had none. */\n    token: string | null;\n    /**\n     * A client that sends the ended session's access token — the store has\n     * already been cleared, so `auth.api` no longer does.\n     *\n     * Use it for the server-side half of the teardown, such as deleting this\n     * browser's push subscription. It never refreshes and never ends a session:\n     * a `401` here just rejects. On `\"logout\"` the token is usually still\n     * valid; on `\"expired\"` the server has already refused it, so expect the\n     * call to fail and keep the local half of the teardown independent of it.\n     */\n    api: ApiClient;\n}\n\nexport interface CreateTempestAuthOptions<TUser> {\n    /** Base URL of the API. Required. */\n    baseURL: string;\n    /**\n     * Path segment the API is mounted under, such as `\"/api\"`, forwarded to\n     * every client this preset builds — see the `prefix` option of\n     * `createApiClient`.\n     *\n     * Safe to combine with the default paths below: the prefix is applied at\n     * most once, so `\"/api/auth/login\"` under a `\"/api\"` prefix stays\n     * `\"/api/auth/login\"`.\n     */\n    prefix?: string;\n    /** Login route (`POST`). Default: `\"/api/auth/login\"`. */\n    loginPath?: string;\n    /** Refresh route (`POST`). Default: `\"/api/auth/refresh\"`. */\n    refreshPath?: string;\n    /** Optional current-user route (`GET`) called after login/refresh. */\n    mePath?: string;\n    /** Persist key for the store. Default: `\"tempest-auth\"`. */\n    storeName?: string;\n    /** Storage backend. Default: `\"local\"`. */\n    storage?: \"local\" | \"session\";\n    /** Send cookies (needed when the refresh token lives in an httpOnly cookie). */\n    withCredentials?: boolean;\n    /**\n     * CSRF token for every write, forwarded to `createApiClient`'s `csrf`. Off\n     * by default; `true` echoes the `csrf_token` cookie as `X-CSRF-Token`.\n     *\n     * The pair to `withCredentials`: once the refresh token lives in a cookie,\n     * the browser attaches it to a `POST /auth/refresh` that another site\n     * triggers. Login and refresh carry the header too — they go out with\n     * `skipAuth`, and the CSRF header does not follow auth.\n     */\n    csrf?: boolean | CsrfOptions;\n    /** Custom fetch implementation (testing / SSR). Defaults to `globalThis.fetch`. */\n    fetcher?: typeof fetch;\n    /**\n     * Extract tokens from a login/refresh response. Default reads\n     * `access_token` + `refresh_token`.\n     */\n    parseTokens?: (data: unknown) => { token: string; refreshToken?: string };\n    /** Pull the user out of the login response, when the API embeds it. */\n    parseUser?: (data: unknown) => TUser | null;\n    /**\n     * Build the refresh request body. Default sends `{ refresh_token }` when a\n     * refresh token is stored, else `undefined` (cookie-based refresh).\n     */\n    refreshBody?: (refreshToken: string | null) => unknown;\n    /**\n     * Retry policy for `api`, forwarded to {@link createApiClient}. Off by\n     * default; `true` enables the conservative built-in policy, which never\n     * replays a write.\n     */\n    retry?: boolean | RetryOptions;\n    /**\n     * Where to send the browser when the session ends — a hard navigation via\n     * `window.location.assign`, after the store is cleared.\n     *\n     * **Prefer leaving this unset.** `logout()` already clears the store, so a\n     * `<RouteGuard when={isAuthenticated} redirectTo=\"/login\">` wrapped around\n     * the protected area navigates on its own, which keeps the SPA alive and the\n     * router history intact. Reach for this only when the expiry can happen\n     * outside any guarded subtree and a full reload is acceptable.\n     */\n    redirectTo?: string;\n    /**\n     * Tear down per-user state when a session ends — on an explicit `logout()`,\n     * when the client ends the session on its own after a failed refresh, and\n     * when a successful `login()` replaces a live session. Without it, the automatic path had no place to hook into, and\n     * state derived from the user (a push subscription, a persisted query\n     * cache, a background-sync queue) survived into the next account.\n     *\n     * Order, on every path:\n     *\n     * 1. any refresh still in flight is superseded, so it cannot reinstall the\n     *    ending session's tokens;\n     * 2. the store and the stored refresh token are cleared — synchronously, so\n     *    `isAuthenticated` is already `false` when `logout()` returns;\n     * 3. this hook runs with a {@link TempestSessionEnd} whose `api` still sends\n     *    the ended session's access token;\n     * 4. on `\"expired\"` with `redirectTo` set, the browser navigates — after the\n     *    hook settled, even if it threw; on `\"switch\"`, the new session is\n     *    installed — after the hook settled, even if it threw.\n     *\n     * It may be async. `logout()` resolves when it settles and rejects with what\n     * it threw; on the automatic path the error is swallowed, because the\n     * request that ended the session already rejects with its own `401`. It\n     * runs once per session: a second `logout()`, or the other requests of a\n     * burst of `401`s, find nothing left to end and skip it.\n     *\n     * On `\"switch\"` the hook runs only **after** the new credentials were\n     * accepted, so a failed `login()` leaves the live session untouched. It runs\n     * **before** the new session is installed: teardown of the previous\n     * account's state (clearing a persisted cache, a background-sync queue) has\n     * to finish before the new account's requests start filling them, or it\n     * would wipe — or race with — the new account's data. The cost is that\n     * `isAuthenticated` is `false` while the hook runs, which a route guard may\n     * act on; keep the hook short. Its error is swallowed there, since the\n     * login itself succeeded.\n     *\n     * Inside the hook, reach the backend only through `session.api`. `auth.api`\n     * goes out with no token; `auth.login()` waits on the teardown in progress —\n     * this hook — and never settles. Telling the hook apart from an outside\n     * caller would need an async context the browser does not have, so this is\n     * a documented rule, not a runtime check.\n     */\n    onSessionEnd?: (session: TempestSessionEnd<TUser>) => void | Promise<void>;\n}\n\nexport interface TempestAuth<TUser, TCredentials> {\n    /** The persisted Zustand auth store hook (compatible with `<AuthGuard>`). */\n    useAuthStore: ReturnType<typeof createAuthStore<TUser>>;\n    /** A `createApiClient` wired with bearer auth + 401 → refresh → retry. */\n    api: ApiClient;\n    /** Authenticate, store the session, and resolve the user (or null). */\n    login: (credentials: TCredentials) => Promise<TUser | null>;\n    /**\n     * End the session: supersede any refresh in flight, clear the store and the\n     * stored refresh token, then run `onSessionEnd`.\n     *\n     * The store is cleared synchronously, before the first `await`, so callers\n     * that ignore the promise see the signed-out state at once. The promise\n     * resolves when `onSessionEnd` settled and rejects with its error.\n     */\n    logout: () => Promise<void>;\n    /**\n     * Refresh the access token (deduplicated across concurrent callers).\n     *\n     * @throws {SessionSupersededError} When the session ended or changed while\n     *   the refresh was in flight; its tokens were discarded.\n     */\n    refresh: () => Promise<void>;\n    /** The current access token, or null. */\n    getToken: () => string | null;\n}\n\nfunction defaultParseTokens(data: unknown): { token: string; refreshToken?: string } {\n    const d = (data ?? {}) as TempestTokenResponse;\n    return { token: d.access_token, refreshToken: d.refresh_token };\n}\n\n/**\n * Turn-key auth preset wiring `createAuthStore` + `createRefreshQueue` +\n * `createApiClient` to the Tempest FastAPI SDK auth contract: login returns\n * `{ access_token, token_type }`, requests carry `Authorization: Bearer`, and a\n * `401` triggers a single deduplicated refresh + replay.\n *\n * The session is cleared whenever that path ends unauthorized anyway — the\n * refresh threw, or the replay came back `401` — so a refresh token that the\n * backend has revoked cannot leave the app holding a dead session. With\n * `redirectTo` set, the browser also leaves the page; without it, clearing the\n * store is enough for a `<RouteGuard>` to navigate on its own.\n *\n * Every refresh is bound to a **session epoch**, bumped by `logout()` and by a\n * `login()` whose credentials were accepted. A refresh that resolves after its epoch ended discards\n * what it brought back and rejects with {@link SessionSupersededError}, which\n * the client passes through without ending the new session. Before 0.77.0 a\n * refresh that was in flight during `logout()` reinstalled the old tokens —\n * and after `logout()` + `login(B)`, replaced B's token with A's while the UI\n * showed B (#435). A `401` from a request sent under an ended session is\n * refused the same way, instead of being replayed as the account signed in now.\n *\n * Refreshes are collapsed per rotation, not just per overlap: a `401` whose\n * request left with a token that has since been replaced in the same session\n * replays with the new token and refreshes nothing. Three expired requests take\n * one refresh whether their `401`s arrive together or one after another.\n *\n * @example\n * const auth = createTempestAuth<User, { email: string; password: string }>({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     mePath: \"/api/auth/me\",\n * });\n *\n * await auth.login({ email, password });   // stores session, returns the user\n * const orders = await auth.api.get(\"/api/orders\");  // sends the bearer token\n * await auth.logout();                      // clears, then runs onSessionEnd\n *\n * @param options - The auth configuration.\n * @returns The store hook, a wired API client, and login/logout/refresh helpers.\n */\nexport function createTempestAuth<TUser, TCredentials = { email: string; password: string }>(\n    options: CreateTempestAuthOptions<TUser>,\n): TempestAuth<TUser, TCredentials> {\n    const {\n        baseURL,\n        prefix,\n        loginPath = \"/api/auth/login\",\n        refreshPath = \"/api/auth/refresh\",\n        mePath,\n        storeName = \"tempest-auth\",\n        storage = \"local\",\n        withCredentials = false,\n        csrf,\n        fetcher,\n        parseTokens = defaultParseTokens,\n        parseUser,\n        refreshBody = (rt) => (rt ? { refresh_token: rt } : undefined),\n        retry,\n        redirectTo,\n        onSessionEnd,\n    } = options;\n\n    const useAuthStore = createAuthStore<TUser>({ name: storeName, storage });\n    const refreshKey = `${storeName}-refresh`;\n\n    function storageImpl(): Storage | null {\n        if (typeof window === \"undefined\") return null;\n        return storage === \"session\" ? window.sessionStorage : window.localStorage;\n    }\n    function readRefreshToken(): string | null {\n        return storageImpl()?.getItem(refreshKey) ?? null;\n    }\n    function writeRefreshToken(token: string | null): void {\n        const s = storageImpl();\n        if (!s) return;\n        if (token) s.setItem(refreshKey, token);\n        else s.removeItem(refreshKey);\n    }\n\n    const state = (): AuthState<TUser> => useAuthStore.getState();\n    const getToken = (): string | null => state().token;\n\n    /**\n     * Load the current user, without letting a `401` end the session.\n     *\n     * `skipAuthRetry` is what keeps this one client honest: the call is\n     * authenticated, but a `401` here surfaces instead of triggering a refresh\n     * and `onUnauthorized`. That was the behaviour of the throwaway client this\n     * used to build per invocation, and it is the reason the preset needed\n     * three clients before 0.66.0.\n     */\n    async function fetchUser(): Promise<TUser | null> {\n        if (!mePath) return state().user;\n        const user = await api.get<TUser>(mePath, { skipAuthRetry: true });\n        state().setUser(user);\n        return user;\n    }\n\n    let epoch = 0;\n    let ending: Promise<void> = Promise.resolve();\n    let hooksRunning = 0;\n\n    /**\n     * Start a new session epoch: supersede the refresh in flight and give the\n     * new epoch a refresh queue of its own, so a `401` under the new session\n     * never joins the old session's refresh.\n     *\n     * The client reads the epoch when each attempt leaves (`getSessionEpoch`),\n     * which is what ties a `401` to the session that sent it — no set of\n     * tokens to keep, and nothing that grows with the session's length.\n     */\n    function nextEpoch(): void {\n        epoch += 1;\n        queue = createRefreshQueue(rotate);\n    }\n\n    /**\n     * Perform one refresh for the epoch that is current when it starts.\n     *\n     * Checked again after the round trip, on success and on failure alike: a\n     * refresh that fails after `logout()` + `login(B)` must not reach\n     * `onUnauthorized` either, or it would end B's session.\n     *\n     * @throws {SessionSupersededError} When the epoch changed during the call.\n     */\n    async function rotate(): Promise<void> {\n        const started = epoch;\n        let data: unknown;\n        try {\n            data = await api.post<unknown>(refreshPath, {\n                body: refreshBody(readRefreshToken()),\n                skipAuth: true,\n            });\n        } catch (error) {\n            if (epoch !== started) throw new SessionSupersededError();\n            throw error;\n        }\n        if (epoch !== started) throw new SessionSupersededError();\n        const { token, refreshToken } = parseTokens(data);\n        state().setToken(token);\n        if (refreshToken) writeRefreshToken(refreshToken);\n    }\n\n    let queue = createRefreshQueue(rotate);\n\n    /**\n     * Whether a `401` must be left alone: no refresh, no ending the session.\n     *\n     * Two cases, both of the current epoch: an attempt that carried no token\n     * while a session is now installed (it left before the sign-in, and\n     * refreshing or ending the new session for it would punish the wrong\n     * session); and an attempt whose token the session has since rotated past\n     * (the rotation it would trigger already happened).\n     *\n     * @param context - The attempt's credential.\n     * @returns Whether the attempt is stale within the current session.\n     */\n    function staleWithinSession(context: RequestAuthContext): boolean {\n        const current = getToken();\n        if (current === null) return false;\n        return context.token === null || context.token !== current;\n    }\n\n    /**\n     * The `refresh` the client calls on a `401`.\n     *\n     * - An attempt from an ended epoch is refused rather than replayed as\n     *   whoever is signed in now.\n     * - A token this session already rotated past: the replay just picks up the\n     *   new one — no second refresh.\n     * - No token, while a session is now installed: the `401` surfaces as is.\n     * - Otherwise: join or start this epoch's refresh.\n     *\n     * @param context - The credential and epoch the rejected attempt left with.\n     * @throws {SessionSupersededError} When the attempt belongs to an ended\n     *   session, or the session changed during the refresh.\n     */\n    async function refreshFor(context: RequestAuthContext): Promise<void> {\n        if (context.epoch !== null && context.epoch !== epoch) throw new SessionSupersededError();\n        if (staleWithinSession(context)) {\n            if (context.token === null) throw new Error(\"anonymous 401 under a live session\");\n            return;\n        }\n        return queue();\n    }\n\n    /**\n     * The client's `onUnauthorized`: end the session only when the `401` is the\n     * current session's own.\n     *\n     * The replay after a refresh is checked here too — it can come back `401`\n     * after the user signed out and another account signed in, and ending the\n     * session then would sign the new account out.\n     *\n     * @param context - The credential and epoch of the attempt that failed.\n     * @throws {SessionSupersededError} When that attempt belongs to an ended\n     *   session.\n     */\n    async function onUnauthorized(_response: Response, context: RequestAuthContext): Promise<void> {\n        if (context.epoch !== null && context.epoch !== epoch) throw new SessionSupersededError();\n        if (staleWithinSession(context)) return;\n        await endSession();\n    }\n\n    /**\n     * Authenticate and install the new session.\n     *\n     * The previous session ends only once the new credentials are accepted: a\n     * login that fails leaves it, and the refresh it may have in flight,\n     * untouched. When one was live, `onSessionEnd` runs with `\"switch\"` before\n     * the new tokens are installed — see the option for why that order. A\n     * `logout()` still tearing down is awaited the same way, so the new\n     * account's state never starts before the previous one's teardown ended.\n     * Never call it from inside `onSessionEnd`: it would wait on that hook.\n     *\n     * @param credentials - Sent as the login body.\n     * @returns The user of the new session, or null.\n     * @throws {SessionSupersededError} When a `logout()` or another `login()`\n     *   moved the session while this one was in flight — during its request or\n     *   during the teardown; the new tokens are discarded.\n     */\n    async function login(credentials: TCredentials): Promise<TUser | null> {\n        const started = epoch;\n        const data = await api.post<unknown>(loginPath, {\n            body: credentials,\n            skipAuth: true,\n        });\n        if (epoch !== started) throw new SessionSupersededError();\n        const { token, refreshToken } = parseTokens(data);\n        const { done } = finish(\"switch\");\n        const mine = epoch;\n        await done.catch(() => undefined);\n        if (epoch !== mine) throw new SessionSupersededError();\n        state().setToken(token);\n        writeRefreshToken(refreshToken ?? null);\n        const embedded = parseUser?.(data);\n        if (embedded != null) {\n            state().setUser(embedded);\n            return embedded;\n        }\n        return fetchUser();\n    }\n\n    /**\n     * End the current session, synchronously up to the hook.\n     *\n     * The epoch moves first, so a refresh resolving between here and the hook\n     * is already superseded. The hook only runs when there was a session to\n     * end — a token, a stored refresh token or a user — which is what keeps a\n     * burst of `401`s from running it once per request.\n     *\n     * With nothing left to end, the caller waits on the teardown already under\n     * way (`ending`, which never rejects, so a later no-op does not inherit an\n     * old error). Two callers skip that wait while a hook is running, because\n     * they may be the hook itself and would wait on their own teardown forever:\n     * `endSession` — a hook awaiting `auth.api` goes out tokenless, gets a\n     * `401`, and lands here — and a `logout()` with no session left. `login()`\n     * (`\"switch\"`) always waits: the new account's state must not start while\n     * the previous one's teardown is still clearing it. A hook awaiting\n     * `auth.login()` therefore never settles — misuse the option documents.\n     *\n     * The returned `done` is a fresh promise derived from the hook, not the one\n     * `ending` holds: a `logout()` nobody awaits still surfaces the hook's error\n     * as an unhandled rejection instead of losing it.\n     *\n     * @param reason - Whether the caller signed out, the client gave up, or a\n     *   login replaced the session.\n     * @returns Whether a live session ended here, and a promise settling with\n     *   the hook.\n     */\n    function finish(reason: TempestSessionEnd<TUser>[\"reason\"]): {\n        live: boolean;\n        done: Promise<void>;\n    } {\n        nextEpoch();\n        const { user, token } = state();\n        const live = token !== null || user !== null || readRefreshToken() !== null;\n        state().logout();\n        writeRefreshToken(null);\n        if (!live) {\n            const wait = reason === \"switch\" || hooksRunning === 0;\n            return { live, done: wait ? ending : Promise.resolve() };\n        }\n        if (!onSessionEnd) return { live, done: Promise.resolve() };\n        const sessionApi = createApiClient({\n            baseURL,\n            prefix,\n            withCredentials,\n            csrf,\n            fetcher,\n            getToken: () => token,\n        });\n        hooksRunning += 1;\n        const run = (async () => {\n            try {\n                await onSessionEnd({ reason, user, token, api: sessionApi });\n            } finally {\n                hooksRunning -= 1;\n            }\n        })();\n        ending = run.then(\n            () => undefined,\n            () => undefined,\n        );\n        return { live, done: run.then(() => undefined) };\n    }\n\n    function logout(): Promise<void> {\n        return finish(\"logout\").done;\n    }\n\n    /**\n     * End the session after the client gave up on it and, when `redirectTo`\n     * is set, leave the page once `onSessionEnd` settled.\n     *\n     * Separate from `logout` so an explicit sign-out stays a pure state change:\n     * a caller that already navigates itself would otherwise get a second,\n     * competing navigation. The hook is awaited before navigating because a\n     * hard navigation aborts whatever request it still had in flight. Only the\n     * call that ended a live session navigates; the rest of a burst of `401`s\n     * waits on the same teardown, or returns at once inside a hook.\n     */\n    async function endSession(): Promise<void> {\n        const { live, done } = finish(\"expired\");\n        await done.catch(() => undefined);\n        if (live && redirectTo && typeof window !== \"undefined\") {\n            window.location.assign(redirectTo);\n        }\n    }\n\n    const api = createApiClient({\n        baseURL,\n        prefix,\n        withCredentials,\n        csrf,\n        fetcher,\n        getToken,\n        getSessionEpoch: () => epoch,\n        refresh: refreshFor,\n        retry,\n        onUnauthorized,\n    });\n\n    const refresh = (): Promise<void> => queue();\n\n    return { useAuthStore, api, login, logout, refresh, getToken };\n}\n"],"mappings":"gJAsLA,SAAS,EAAmB,EAAyD,CACjF,IAAM,EAAK,GAAQ,CAAC,EACpB,MAAO,CAAE,MAAO,EAAE,aAAc,aAAc,EAAE,aAAc,CAClE,CAyCA,SAAgB,EACZ,EACgC,CAChC,GAAM,CACF,UACA,SACA,YAAY,kBACZ,cAAc,oBACd,SACA,YAAY,eACZ,UAAU,QACV,kBAAkB,GAClB,OACA,UACA,cAAc,EACd,YACA,cAAe,GAAQ,EAAK,CAAE,cAAe,CAAG,EAAI,IAAA,GACpD,QACA,aACA,gBACA,EAEE,EAAe,EAAA,gBAAuB,CAAE,KAAM,EAAW,SAAQ,CAAC,EAClE,EAAa,GAAG,EAAU,UAEhC,SAAS,GAA8B,CAEnC,OADI,OAAO,OAAW,IAAoB,KACnC,IAAY,UAAY,OAAO,eAAiB,OAAO,YAClE,CACA,SAAS,GAAkC,CACvC,OAAO,EAAY,CAAC,EAAE,QAAQ,CAAU,GAAK,IACjD,CACA,SAAS,EAAkB,EAA4B,CACnD,IAAM,EAAI,EAAY,EACjB,IACD,EAAO,EAAE,QAAQ,EAAY,CAAK,EACjC,EAAE,WAAW,CAAU,EAChC,CAEA,IAAM,MAAgC,EAAa,SAAS,EACtD,MAAgC,EAAM,CAAC,CAAC,MAW9C,eAAe,GAAmC,CAC9C,GAAI,CAAC,EAAQ,OAAO,EAAM,CAAC,CAAC,KAC5B,IAAM,EAAO,MAAM,EAAI,IAAW,EAAQ,CAAE,cAAe,EAAK,CAAC,EAEjE,OADA,EAAM,CAAC,CAAC,QAAQ,CAAI,EACb,CACX,CAEA,IAAI,EAAQ,EACR,EAAwB,QAAQ,QAAQ,EACxC,EAAe,EAWnB,SAAS,GAAkB,CACvB,GAAS,EACT,EAAQ,EAAA,mBAAmB,CAAM,CACrC,CAWA,eAAe,GAAwB,CACnC,IAAM,EAAU,EACZ,EACJ,GAAI,CACA,EAAO,MAAM,EAAI,KAAc,EAAa,CACxC,KAAM,EAAY,EAAiB,CAAC,EACpC,SAAU,EACd,CAAC,CACL,OAAS,EAAO,CAEZ,MADI,IAAU,EACR,EADuB,IAAI,EAAA,sBAErC,CACA,GAAI,IAAU,EAAS,MAAM,IAAI,EAAA,uBACjC,GAAM,CAAE,QAAO,gBAAiB,EAAY,CAAI,EAChD,EAAM,CAAC,CAAC,SAAS,CAAK,EAClB,GAAc,EAAkB,CAAY,CACpD,CAEA,IAAI,EAAQ,EAAA,mBAAmB,CAAM,EAcrC,SAAS,EAAmB,EAAsC,CAC9D,IAAM,EAAU,EAAS,EAEzB,OADI,IAAY,KAAa,GACtB,EAAQ,QAAU,MAAQ,EAAQ,QAAU,CACvD,CAgBA,eAAe,EAAW,EAA4C,CAClE,GAAI,EAAQ,QAAU,MAAQ,EAAQ,QAAU,EAAO,MAAM,IAAI,EAAA,uBACjE,GAAI,EAAmB,CAAO,EAAG,CAC7B,GAAI,EAAQ,QAAU,KAAM,MAAU,MAAM,oCAAoC,EAChF,MACJ,CACA,OAAO,EAAM,CACjB,CAcA,eAAe,EAAe,EAAqB,EAA4C,CAC3F,GAAI,EAAQ,QAAU,MAAQ,EAAQ,QAAU,EAAO,MAAM,IAAI,EAAA,uBAC7D,EAAmB,CAAO,GAC9B,MAAM,EAAW,CACrB,CAmBA,eAAe,EAAM,EAAkD,CACnE,IAAM,EAAU,EACV,EAAO,MAAM,EAAI,KAAc,EAAW,CAC5C,KAAM,EACN,SAAU,EACd,CAAC,EACD,GAAI,IAAU,EAAS,MAAM,IAAI,EAAA,uBACjC,GAAM,CAAE,QAAO,gBAAiB,EAAY,CAAI,EAC1C,CAAE,QAAS,EAAO,QAAQ,EAC1B,EAAO,EAEb,GADA,MAAM,EAAK,UAAY,IAAA,EAAS,EAC5B,IAAU,EAAM,MAAM,IAAI,EAAA,uBAC9B,EAAM,CAAC,CAAC,SAAS,CAAK,EACtB,EAAkB,GAAgB,IAAI,EACtC,IAAM,EAAW,IAAY,CAAI,EAKjC,OAJI,GAAY,KAIT,EAAU,GAHb,EAAM,CAAC,CAAC,QAAQ,CAAQ,EACjB,EAGf,CA6BA,SAAS,EAAO,EAGd,CACE,EAAU,EACV,GAAM,CAAE,OAAM,SAAU,EAAM,EACxB,EAAO,IAAU,MAAQ,IAAS,MAAQ,EAAiB,IAAM,KAGvE,GAFA,EAAM,CAAC,CAAC,OAAO,EACf,EAAkB,IAAI,EAClB,CAAC,EAED,MAAO,CAAE,OAAM,KADF,IAAW,UAAY,IAAiB,EACzB,EAAS,QAAQ,QAAQ,CAAE,EAE3D,GAAI,CAAC,EAAc,MAAO,CAAE,OAAM,KAAM,QAAQ,QAAQ,CAAE,EAC1D,IAAM,EAAa,EAAA,gBAAgB,CAC/B,UACA,SACA,kBACA,OACA,UACA,aAAgB,CACpB,CAAC,EACD,GAAgB,EAChB,IAAM,GAAO,SAAY,CACrB,GAAI,CACA,MAAM,EAAa,CAAE,SAAQ,OAAM,QAAO,IAAK,CAAW,CAAC,CAC/D,QAAU,CACN,GACJ,CACJ,EAAA,CAAG,EAKH,MAJA,GAAS,EAAI,SACH,IAAA,OACA,IAAA,EACV,EACO,CAAE,OAAM,KAAM,EAAI,SAAW,IAAA,EAAS,CAAE,CACnD,CAEA,SAAS,GAAwB,CAC7B,OAAO,EAAO,QAAQ,CAAC,CAAC,IAC5B,CAaA,eAAe,GAA4B,CACvC,GAAM,CAAE,OAAM,QAAS,EAAO,SAAS,EACvC,MAAM,EAAK,UAAY,IAAA,EAAS,EAC5B,GAAQ,GAAc,OAAO,OAAW,KACxC,OAAO,SAAS,OAAO,CAAU,CAEzC,CAEA,IAAM,EAAM,EAAA,gBAAgB,CACxB,UACA,SACA,kBACA,OACA,UACA,WACA,oBAAuB,EACvB,QAAS,EACT,QACA,gBACJ,CAAC,EAID,MAAO,CAAE,eAAc,MAAK,QAAO,SAAQ,YAFN,EAAM,EAES,UAAS,CACjE"}