tempest-react-sdk 0.76.0 → 0.78.0

package/dist/sw/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","names":[],"sources":["../../src/sw/cache.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines — precache, runtime strategies (cache-first, network-\n * first, stale-while-revalidate), expiry and the inspect/clear helpers all address\n * the same Cache Storage namespace, and the naming scheme that keeps them from\n * evicting each other is the file's whole contract.\n */\n/**\n * Service-worker caching helpers — a small, dependency-free subset of what\n * Workbox provides: precaching of the build's app shell (so the app launches\n * offline) plus runtime caching strategies for fonts, APIs and images.\n *\n * Import these inside your own `sw.ts`. They run in the service-worker global\n * scope, not the main thread. Pair `installPrecache` with the\n * `tempestPwaManifest()` Vite plugin (from `tempest-react-sdk/vite`), which\n * emits the `precache-manifest.json` this reads at install time.\n *\n * @example\n *   /// <reference lib=\"webworker\" />\n *   import { installRuntimeCache, installPrecache } from \"tempest-react-sdk/sw\";\n *\n *   // Register specific routes FIRST so they win over the precache catch-all.\n *   installRuntimeCache([\n *     { match: /\\/api\\//, strategy: \"network-first\", cacheName: \"api\", maxAgeSeconds: 300 },\n *   ]);\n *   installPrecache();\n */\n\n/** Minimal shape of the events we touch, to avoid pulling in `lib.webworker`. */\ninterface ExtendableEventLike {\n    waitUntil(promise: Promise<unknown>): void;\n}\n\ninterface FetchEventLike extends ExtendableEventLike {\n    request: Request;\n    respondWith(response: Response | Promise<Response>): void;\n    /** Resolves to the navigation-preload response when it is enabled, else `undefined`. */\n    preloadResponse?: Promise<Response | undefined>;\n}\n\n/** Minimal shape of `registration.navigationPreload` (Navigation Preload API). */\ninterface NavigationPreloadManagerLike {\n    enable(): Promise<void>;\n    disable(): Promise<void>;\n}\n\ninterface CacheSwGlobal {\n    addEventListener(type: \"install\", listener: (event: ExtendableEventLike) => void): void;\n    addEventListener(type: \"activate\", listener: (event: ExtendableEventLike) => void): void;\n    addEventListener(type: \"fetch\", listener: (event: FetchEventLike) => void): void;\n    clients: { claim(): Promise<void> };\n    skipWaiting(): Promise<void>;\n    location: { origin: string };\n    registration?: { navigationPreload?: NavigationPreloadManagerLike };\n}\n\nfunction getSwScope(): CacheSwGlobal {\n    return globalThis as unknown as CacheSwGlobal;\n}\n\n/** Caching strategy for a runtime route. Mirrors the common Workbox trio. */\nexport type RuntimeStrategy = \"cache-first\" | \"network-first\" | \"stale-while-revalidate\";\n\n/** A single runtime-caching rule, matched against each `GET` request. */\nexport interface RuntimeRoute {\n    /** A `RegExp` tested against the full URL, or a predicate over the parsed URL. */\n    match: RegExp | ((url: URL, request: Request) => boolean);\n    /** How to resolve a match. */\n    strategy: RuntimeStrategy;\n    /** Cache bucket name for this route. */\n    cacheName: string;\n    /** Trim the cache to at most this many entries (FIFO) after each write. */\n    maxEntries?: number;\n    /** Treat a cached response older than this (seconds) as a miss. */\n    maxAgeSeconds?: number;\n    /** For `network-first`: fall back to cache after this timeout (seconds). */\n    networkTimeoutSeconds?: number;\n    /**\n     * Serve HTTP `Range` requests (206 Partial Content) by slicing the cached\n     * full response. Enable for audio/video so seeking works offline. The full\n     * resource is cached once (the `Range` header is stripped before caching).\n     */\n    rangeRequests?: boolean;\n}\n\n/** Options for {@link installPrecache}. */\nexport interface InstallPrecacheOptions {\n    /** URL of the manifest emitted by `tempestPwaManifest()`. Default `/precache-manifest.json`. */\n    manifestUrl?: string;\n    /** Cache name prefix; the manifest `version` is appended. Default `tempest-precache`. */\n    cacheName?: string;\n    /** App-shell document served for navigation requests offline. Default `/index.html`. */\n    navigateFallback?: string;\n    /** Navigation paths that should NOT use the fallback (e.g. `[/^\\/api\\//]`). */\n    navigateFallbackDenylist?: RegExp[];\n    /** Activate the new worker immediately after precaching. Default `true`. */\n    skipWaiting?: boolean;\n    /**\n     * Enable the Navigation Preload API on `activate`, so the browser fetches\n     * the navigation request in parallel with the worker boot and the handler\n     * serves `event.preloadResponse` — cutting first-navigation latency after\n     * the worker starts. Silently ignored where unsupported. Default `true`.\n     */\n    navigationPreload?: boolean;\n}\n\ninterface PrecacheManifest {\n    version: string;\n    urls: string[];\n}\n\nlet precacheName = \"\";\nconst precachedPaths = new Set<string>();\n\n/** Whether a cached response has aged past `maxAgeSeconds` (best-effort, via `Date`). */\nfunction isExpired(response: Response, maxAgeSeconds?: number): boolean {\n    if (!maxAgeSeconds) return false;\n    const dateHeader = response.headers.get(\"date\");\n    if (!dateHeader) return false;\n    const age = (Date.now() - new Date(dateHeader).getTime()) / 1000;\n    return age > maxAgeSeconds;\n}\n\n/** Drop oldest entries until the cache holds at most `maxEntries`. */\nasync function trimCache(cacheName: string, maxEntries?: number): Promise<void> {\n    if (!maxEntries) return;\n    const cache = await caches.open(cacheName);\n    const keys = await cache.keys();\n    if (keys.length <= maxEntries) return;\n    for (const key of keys.slice(0, keys.length - maxEntries)) {\n        await cache.delete(key);\n    }\n}\n\nasync function cacheFirst(request: Request, route: RuntimeRoute): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n    const cached = await cache.match(request);\n    if (cached && !isExpired(cached, route.maxAgeSeconds)) return cached;\n\n    const response = await fetch(request);\n    if (response.ok) {\n        await cache.put(request, response.clone());\n        await trimCache(route.cacheName, route.maxEntries);\n    }\n    return response;\n}\n\nasync function networkFirst(request: Request, route: RuntimeRoute): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n\n    const network = (async (): Promise<Response> => {\n        const response = await fetch(request);\n        if (response.ok) {\n            await cache.put(request, response.clone());\n            await trimCache(route.cacheName, route.maxEntries);\n        }\n        return response;\n    })();\n\n    const timeoutMs = (route.networkTimeoutSeconds ?? 0) * 1000;\n    try {\n        if (timeoutMs > 0) {\n            const timeout = new Promise<never>((_, reject) =>\n                setTimeout(() => reject(new Error(\"network-timeout\")), timeoutMs),\n            );\n            return await Promise.race([network, timeout]);\n        }\n        return await network;\n    } catch {\n        const cached = await cache.match(request);\n        if (cached) return cached;\n        throw new Error(\"network-first: no network and no cache\");\n    }\n}\n\nasync function staleWhileRevalidate(request: Request, route: RuntimeRoute): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n    const cached = await cache.match(request);\n\n    const network = fetch(request)\n        .then(async (response) => {\n            if (response.ok) {\n                await cache.put(request, response.clone());\n                await trimCache(route.cacheName, route.maxEntries);\n            }\n            return response;\n        })\n        .catch(() => undefined);\n\n    if (cached && !isExpired(cached, route.maxAgeSeconds)) return cached;\n    const response = await network;\n    if (response) return response;\n    if (cached) return cached;\n    throw new Error(\"stale-while-revalidate: no network and no cache\");\n}\n\nfunction runRoute(request: Request, route: RuntimeRoute): Promise<Response> {\n    switch (route.strategy) {\n        case \"cache-first\":\n            return cacheFirst(request, route);\n        case \"network-first\":\n            return networkFirst(request, route);\n        case \"stale-while-revalidate\":\n            return staleWhileRevalidate(request, route);\n    }\n}\n\nfunction routeMatches(route: RuntimeRoute, url: URL, request: Request): boolean {\n    return typeof route.match === \"function\"\n        ? route.match(url, request)\n        : route.match.test(url.href);\n}\n\n/**\n * Build a `206 Partial Content` response from a full one for an HTTP `Range`\n * request. Supports `bytes=start-end`, open-ended `bytes=start-` and suffix\n * `bytes=-suffixLength`. Returns the original response when there is no usable\n * `Range` header, or a `416` when the range is unsatisfiable.\n *\n * @param request The incoming request (its `Range` header drives the slice).\n * @param response The full (200) response to slice.\n */\nexport async function createPartialResponse(\n    request: Request,\n    response: Response,\n): Promise<Response> {\n    const rangeHeader = request.headers.get(\"range\");\n    if (!rangeHeader) return response;\n\n    const match = /^bytes=(\\d*)-(\\d*)$/.exec(rangeHeader.trim());\n    if (!match || (match[1] === \"\" && match[2] === \"\")) {\n        return new Response(null, { status: 416, statusText: \"Range Not Satisfiable\" });\n    }\n\n    const buffer = await response.clone().arrayBuffer();\n    const total = buffer.byteLength;\n\n    let start: number;\n    let end: number;\n    if (match[1] === \"\") {\n        // Suffix range: last N bytes.\n        const suffix = Number(match[2]);\n        start = Math.max(0, total - suffix);\n        end = total - 1;\n    } else {\n        start = Number(match[1]);\n        end = match[2] === \"\" ? total - 1 : Math.min(Number(match[2]), total - 1);\n    }\n\n    if (start > end || start >= total) {\n        return new Response(null, {\n            status: 416,\n            statusText: \"Range Not Satisfiable\",\n            headers: { \"Content-Range\": `bytes */${total}` },\n        });\n    }\n\n    const slice = buffer.slice(start, end + 1);\n    const headers = new Headers(response.headers);\n    headers.set(\"Content-Range\", `bytes ${start}-${end}/${total}`);\n    headers.set(\"Content-Length\", String(slice.byteLength));\n    headers.set(\"Accept-Ranges\", \"bytes\");\n\n    return new Response(slice, {\n        status: 206,\n        statusText: \"Partial Content\",\n        headers,\n    });\n}\n\n/**\n * Install a `fetch` handler that resolves matching `GET` requests with the\n * given runtime strategies. Non-matching requests are left untouched (no\n * `respondWith`), so a later {@link installPrecache} can handle them.\n *\n * Register this BEFORE `installPrecache` so specific routes win over the\n * precache catch-all.\n *\n * @param routes Ordered rules; the first whose `match` passes handles the request.\n */\nexport function installRuntimeCache(routes: RuntimeRoute[]): void {\n    const sw = getSwScope();\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method !== \"GET\") return;\n\n        const url = new URL(request.url);\n        const route = routes.find((candidate) => routeMatches(candidate, url, request));\n        if (!route) return;\n\n        if (route.rangeRequests && request.headers.has(\"range\")) {\n            // Cache/serve the FULL resource once (no Range), then slice it.\n            const full = new Request(request.url, {\n                headers: stripRange(request.headers),\n                credentials: request.credentials,\n                mode: request.mode === \"navigate\" ? \"same-origin\" : request.mode,\n            });\n            event.respondWith(\n                runRoute(full, route).then((response) => createPartialResponse(request, response)),\n            );\n            return;\n        }\n\n        event.respondWith(runRoute(request, route));\n    });\n}\n\n/** Copy headers without the `Range` header (so the cached entry is the full file). */\nfunction stripRange(headers: Headers): Headers {\n    const out = new Headers(headers);\n    out.delete(\"range\");\n    return out;\n}\n\n/**\n * Precache the app shell at `install` and serve it offline:\n *  - reads `precache-manifest.json` (emitted by `tempestPwaManifest()`),\n *  - caches every listed URL under a versioned cache,\n *  - on `activate`, deletes stale precache versions and claims open clients,\n *  - on `fetch`, serves precached assets cache-first and falls back to the\n *    `navigateFallback` document for offline navigations (SPA routing).\n *\n * Same-origin only. Register this LAST, after any {@link installRuntimeCache}.\n */\nexport function installPrecache(options: InstallPrecacheOptions = {}): void {\n    const sw = getSwScope();\n    const {\n        manifestUrl = \"/precache-manifest.json\",\n        cacheName = \"tempest-precache\",\n        navigateFallback = \"/index.html\",\n        navigateFallbackDenylist = [],\n        skipWaiting = true,\n        navigationPreload = true,\n    } = options;\n\n    sw.addEventListener(\"install\", (event) => {\n        event.waitUntil(\n            (async () => {\n                const response = await fetch(manifestUrl, { cache: \"no-cache\" });\n                const manifest = (await response.json()) as PrecacheManifest;\n                precacheName = `${cacheName}-${manifest.version}`;\n\n                const cache = await caches.open(precacheName);\n                await cache.addAll(manifest.urls);\n                for (const url of manifest.urls) {\n                    precachedPaths.add(new URL(url, sw.location.origin).pathname);\n                }\n                if (skipWaiting) await sw.skipWaiting();\n            })(),\n        );\n    });\n\n    sw.addEventListener(\"activate\", (event) => {\n        event.waitUntil(\n            (async () => {\n                const keys = await caches.keys();\n                await Promise.all(\n                    keys\n                        .filter((key) => key.startsWith(`${cacheName}-`) && key !== precacheName)\n                        .map((key) => caches.delete(key)),\n                );\n                if (navigationPreload && sw.registration?.navigationPreload) {\n                    await sw.registration.navigationPreload.enable();\n                }\n                await sw.clients.claim();\n            })(),\n        );\n    });\n\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method !== \"GET\") return;\n\n        const url = new URL(request.url);\n        if (url.origin !== sw.location.origin) return;\n\n        // SPA navigations: serve the cached app shell when offline.\n        if (request.mode === \"navigate\") {\n            if (navigateFallbackDenylist.some((re) => re.test(url.pathname))) return;\n            event.respondWith(\n                (async () => {\n                    try {\n                        const preloaded = await event.preloadResponse;\n                        if (preloaded) return preloaded;\n                        return await fetch(request);\n                    } catch {\n                        const cache = await caches.open(precacheName);\n                        const shell = await cache.match(navigateFallback);\n                        if (shell) return shell;\n                        throw new Error(\"offline and no cached app shell\");\n                    }\n                })(),\n            );\n            return;\n        }\n\n        // Precached static assets: cache-first.\n        if (precachedPaths.has(url.pathname)) {\n            event.respondWith(\n                (async () => {\n                    const cache = await caches.open(precacheName);\n                    const cached = await cache.match(request);\n                    return cached ?? fetch(request);\n                })(),\n            );\n        }\n    });\n}\n"],"mappings":";AAuDA,SAAS,IAA4B;CACjC,OAAO;AACX;AAqDA,IAAI,IAAe,IACb,oBAAiB,IAAI,IAAY;AAGvC,SAAS,EAAU,GAAoB,GAAiC;CACpE,IAAI,CAAC,GAAe,OAAO;CAC3B,IAAM,IAAa,EAAS,QAAQ,IAAI,MAAM;CAG9C,OAFK,KACQ,KAAK,IAAI,IAAI,IAAI,KAAK,CAAU,CAAC,CAAC,QAAQ,KAAK,MAC/C,IAFW;AAG5B;AAGA,eAAe,EAAU,GAAmB,GAAoC;CAC5E,IAAI,CAAC,GAAY;CACjB,IAAM,IAAQ,MAAM,OAAO,KAAK,CAAS,GACnC,IAAO,MAAM,EAAM,KAAK;CAC1B,QAAK,UAAU,IACnB,KAAK,IAAM,KAAO,EAAK,MAAM,GAAG,EAAK,SAAS,CAAU,GACpD,MAAM,EAAM,OAAO,CAAG;AAE9B;AAEA,eAAe,EAAW,GAAkB,GAAwC;CAChF,IAAM,IAAQ,MAAM,OAAO,KAAK,EAAM,SAAS,GACzC,IAAS,MAAM,EAAM,MAAM,CAAO;CACxC,IAAI,KAAU,CAAC,EAAU,GAAQ,EAAM,aAAa,GAAG,OAAO;CAE9D,IAAM,IAAW,MAAM,MAAM,CAAO;CAKpC,OAJI,EAAS,OACT,MAAM,EAAM,IAAI,GAAS,EAAS,MAAM,CAAC,GACzC,MAAM,EAAU,EAAM,WAAW,EAAM,UAAU,IAE9C;AACX;AAEA,eAAe,EAAa,GAAkB,GAAwC;CAClF,IAAM,IAAQ,MAAM,OAAO,KAAK,EAAM,SAAS,GAEzC,KAAW,YAA+B;EAC5C,IAAM,IAAW,MAAM,MAAM,CAAO;EAKpC,OAJI,EAAS,OACT,MAAM,EAAM,IAAI,GAAS,EAAS,MAAM,CAAC,GACzC,MAAM,EAAU,EAAM,WAAW,EAAM,UAAU,IAE9C;CACX,EAAA,CAAG,GAEG,KAAa,EAAM,yBAAyB,KAAK;CACvD,IAAI;EACA,IAAI,IAAY,GAAG;GACf,IAAM,IAAU,IAAI,SAAgB,GAAG,MACnC,iBAAiB,EAAO,gBAAI,MAAM,iBAAiB,CAAC,GAAG,CAAS,CACpE;GACA,OAAO,MAAM,QAAQ,KAAK,CAAC,GAAS,CAAO,CAAC;EAChD;EACA,OAAO,MAAM;CACjB,QAAQ;EACJ,IAAM,IAAS,MAAM,EAAM,MAAM,CAAO;EACxC,IAAI,GAAQ,OAAO;EACnB,MAAU,MAAM,wCAAwC;CAC5D;AACJ;AAEA,eAAe,EAAqB,GAAkB,GAAwC;CAC1F,IAAM,IAAQ,MAAM,OAAO,KAAK,EAAM,SAAS,GACzC,IAAS,MAAM,EAAM,MAAM,CAAO,GAElC,IAAU,MAAM,CAAO,CAAC,CACzB,KAAK,OAAO,OACL,EAAS,OACT,MAAM,EAAM,IAAI,GAAS,EAAS,MAAM,CAAC,GACzC,MAAM,EAAU,EAAM,WAAW,EAAM,UAAU,IAE9C,EACV,CAAC,CACD,YAAY,KAAA,CAAS;CAE1B,IAAI,KAAU,CAAC,EAAU,GAAQ,EAAM,aAAa,GAAG,OAAO;CAC9D,IAAM,IAAW,MAAM;CACvB,IAAI,GAAU,OAAO;CACrB,IAAI,GAAQ,OAAO;CACnB,MAAU,MAAM,iDAAiD;AACrE;AAEA,SAAS,EAAS,GAAkB,GAAwC;CACxE,QAAQ,EAAM,UAAd;EACI,KAAK,eACD,OAAO,EAAW,GAAS,CAAK;EACpC,KAAK,iBACD,OAAO,EAAa,GAAS,CAAK;EACtC,KAAK,0BACD,OAAO,EAAqB,GAAS,CAAK;CAClD;AACJ;AAEA,SAAS,EAAa,GAAqB,GAAU,GAA2B;CAC5E,OAAO,OAAO,EAAM,SAAU,aACxB,EAAM,MAAM,GAAK,CAAO,IACxB,EAAM,MAAM,KAAK,EAAI,IAAI;AACnC;AAWA,eAAsB,EAClB,GACA,GACiB;CACjB,IAAM,IAAc,EAAQ,QAAQ,IAAI,OAAO;CAC/C,IAAI,CAAC,GAAa,OAAO;CAEzB,IAAM,IAAQ,sBAAsB,KAAK,EAAY,KAAK,CAAC;CAC3D,IAAI,CAAC,KAAU,EAAM,OAAO,MAAM,EAAM,OAAO,IAC3C,OAAO,IAAI,SAAS,MAAM;EAAE,QAAQ;EAAK,YAAY;CAAwB,CAAC;CAGlF,IAAM,IAAS,MAAM,EAAS,MAAM,CAAC,CAAC,YAAY,GAC5C,IAAQ,EAAO,YAEjB,GACA;CACJ,IAAI,EAAM,OAAO,IAAI;EAEjB,IAAM,IAAS,OAAO,EAAM,EAAE;EAE9B,AADA,IAAQ,KAAK,IAAI,GAAG,IAAQ,CAAM,GAClC,IAAM,IAAQ;CAClB,OAEI,AADA,IAAQ,OAAO,EAAM,EAAE,GACvB,IAAM,EAAM,OAAO,KAAK,IAAQ,IAAI,KAAK,IAAI,OAAO,EAAM,EAAE,GAAG,IAAQ,CAAC;CAG5E,IAAI,IAAQ,KAAO,KAAS,GACxB,OAAO,IAAI,SAAS,MAAM;EACtB,QAAQ;EACR,YAAY;EACZ,SAAS,EAAE,iBAAiB,WAAW,IAAQ;CACnD,CAAC;CAGL,IAAM,IAAQ,EAAO,MAAM,GAAO,IAAM,CAAC,GACnC,IAAU,IAAI,QAAQ,EAAS,OAAO;CAK5C,OAJA,EAAQ,IAAI,iBAAiB,SAAS,EAAM,GAAG,EAAI,GAAG,GAAO,GAC7D,EAAQ,IAAI,kBAAkB,OAAO,EAAM,UAAU,CAAC,GACtD,EAAQ,IAAI,iBAAiB,OAAO,GAE7B,IAAI,SAAS,GAAO;EACvB,QAAQ;EACR,YAAY;EACZ;CACJ,CAAC;AACL;AAYA,SAAgB,EAAoB,GAA8B;CAE9D,EAAA,CAAA,CAAG,iBAAiB,UAAU,MAAU;EACpC,IAAM,IAAU,EAAM;EACtB,IAAI,EAAQ,WAAW,OAAO;EAE9B,IAAM,IAAM,IAAI,IAAI,EAAQ,GAAG,GACzB,IAAQ,EAAO,MAAM,MAAc,EAAa,GAAW,GAAK,CAAO,CAAC;EACzE,OAEL;OAAI,EAAM,iBAAiB,EAAQ,QAAQ,IAAI,OAAO,GAAG;IAErD,IAAM,IAAO,IAAI,QAAQ,EAAQ,KAAK;KAClC,SAAS,EAAW,EAAQ,OAAO;KACnC,aAAa,EAAQ;KACrB,MAAM,EAAQ,SAAS,aAAa,gBAAgB,EAAQ;IAChE,CAAC;IACD,EAAM,YACF,EAAS,GAAM,CAAK,CAAC,CAAC,MAAM,MAAa,EAAsB,GAAS,CAAQ,CAAC,CACrF;IACA;GACJ;GAEA,EAAM,YAAY,EAAS,GAAS,CAAK,CAAC;EAF1C;CAGJ,CAAC;AACL;AAGA,SAAS,EAAW,GAA2B;CAC3C,IAAM,IAAM,IAAI,QAAQ,CAAO;CAE/B,OADA,EAAI,OAAO,OAAO,GACX;AACX;AAYA,SAAgB,EAAgB,IAAkC,CAAC,GAAS;CACxE,IAAM,IAAK,EAAW,GAChB,EACF,iBAAc,2BACd,eAAY,oBACZ,sBAAmB,eACnB,8BAA2B,CAAC,GAC5B,iBAAc,IACd,uBAAoB,OACpB;CAoCJ,AAlCA,EAAG,iBAAiB,YAAY,MAAU;EACtC,EAAM,WACD,YAAY;GAET,IAAM,IAAY,OAAM,MADD,MAAM,GAAa,EAAE,OAAO,WAAW,CAAC,EAAA,CAC9B,KAAK;GAItC,AAHA,IAAe,GAAG,EAAU,GAAG,EAAS,WAGxC,OAAM,MADc,OAAO,KAAK,CAAY,EAAA,CAChC,OAAO,EAAS,IAAI;GAChC,KAAK,IAAM,KAAO,EAAS,MACvB,EAAe,IAAI,IAAI,IAAI,GAAK,EAAG,SAAS,MAAM,CAAC,CAAC,QAAQ;GAEhE,AAAI,KAAa,MAAM,EAAG,YAAY;EAC1C,EAAA,CAAG,CACP;CACJ,CAAC,GAED,EAAG,iBAAiB,aAAa,MAAU;EACvC,EAAM,WACD,YAAY;GACT,IAAM,IAAO,MAAM,OAAO,KAAK;GAS/B,AARA,MAAM,QAAQ,IACV,EACK,QAAQ,MAAQ,EAAI,WAAW,GAAG,EAAU,EAAE,KAAK,MAAQ,CAAY,CAAC,CACxE,KAAK,MAAQ,OAAO,OAAO,CAAG,CAAC,CACxC,GACI,KAAqB,EAAG,cAAc,qBACtC,MAAM,EAAG,aAAa,kBAAkB,OAAO,GAEnD,MAAM,EAAG,QAAQ,MAAM;EAC3B,EAAA,CAAG,CACP;CACJ,CAAC,GAED,EAAG,iBAAiB,UAAU,MAAU;EACpC,IAAM,IAAU,EAAM;EACtB,IAAI,EAAQ,WAAW,OAAO;EAE9B,IAAM,IAAM,IAAI,IAAI,EAAQ,GAAG;EAC3B,MAAI,WAAW,EAAG,SAAS,QAG/B;OAAI,EAAQ,SAAS,YAAY;IAC7B,IAAI,EAAyB,MAAM,MAAO,EAAG,KAAK,EAAI,QAAQ,CAAC,GAAG;IAClE,EAAM,aACD,YAAY;KACT,IAAI;MAGA,OADI,MADoB,EAAM,mBAEvB,MAAM,MAAM,CAAO;KAC9B,QAAQ;MAEJ,IAAM,IAAQ,OAAM,MADA,OAAO,KAAK,CAAY,EAAA,CAClB,MAAM,CAAgB;MAChD,IAAI,GAAO,OAAO;MAClB,MAAU,MAAM,iCAAiC;KACrD;IACJ,EAAA,CAAG,CACP;IACA;GACJ;GAGA,AAAI,EAAe,IAAI,EAAI,QAAQ,KAC/B,EAAM,aACD,YAGU,OADc,MADD,OAAO,KAAK,CAAY,EAAA,CACjB,MAAM,CAAO,KACvB,MAAM,CAAO,EAClC,CAAG,CACP;EAVJ;CAYJ,CAAC;AACL"}
+{"version":3,"file":"cache.js","names":[],"sources":["../../src/sw/cache.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines — precache, runtime strategies (cache-first, network-\n * first, stale-while-revalidate), expiry and the inspect/clear helpers all address\n * the same Cache Storage namespace, and the naming scheme that keeps them from\n * evicting each other is the file's whole contract.\n */\n/**\n * Service-worker caching helpers — a small, dependency-free subset of what\n * Workbox provides: precaching of the build's app shell (so the app launches\n * offline) plus runtime caching strategies for fonts, APIs and images.\n *\n * Import these inside your own `sw.ts`. They run in the service-worker global\n * scope, not the main thread. Pair `installPrecache` with the\n * `tempestPwaManifest()` Vite plugin (from `tempest-react-sdk/vite`), which\n * emits the `precache-manifest.json` this reads at install time.\n *\n * @example\n *   /// <reference lib=\"webworker\" />\n *   import { installRuntimeCache, installPrecache } from \"tempest-react-sdk/sw\";\n *\n *   // Register specific routes FIRST so they win over the precache catch-all.\n *   installRuntimeCache([\n *     { match: /\\/api\\//, strategy: \"network-first\", cacheName: \"tempest-api\", maxAgeSeconds: 300 },\n *   ]);\n *   installPrecache();\n */\n\nimport { credentialHeaderSet } from \"./credential-headers\";\n\n/** Minimal shape of the events we touch, to avoid pulling in `lib.webworker`. */\ninterface ExtendableEventLike {\n    waitUntil(promise: Promise<unknown>): void;\n}\n\ninterface FetchEventLike extends ExtendableEventLike {\n    request: Request;\n    respondWith(response: Response | Promise<Response>): void;\n    /** Resolves to the navigation-preload response when it is enabled, else `undefined`. */\n    preloadResponse?: Promise<Response | undefined>;\n}\n\n/** Minimal shape of `registration.navigationPreload` (Navigation Preload API). */\ninterface NavigationPreloadManagerLike {\n    enable(): Promise<void>;\n    disable(): Promise<void>;\n}\n\ninterface CacheSwGlobal {\n    addEventListener(type: \"install\", listener: (event: ExtendableEventLike) => void): void;\n    addEventListener(type: \"activate\", listener: (event: ExtendableEventLike) => void): void;\n    addEventListener(type: \"fetch\", listener: (event: FetchEventLike) => void): void;\n    clients: { claim(): Promise<void> };\n    skipWaiting(): Promise<void>;\n    location: { origin: string };\n    registration?: { navigationPreload?: NavigationPreloadManagerLike };\n}\n\nfunction getSwScope(): CacheSwGlobal {\n    return globalThis as unknown as CacheSwGlobal;\n}\n\n/** Caching strategy for a runtime route. Mirrors the common Workbox trio. */\nexport type RuntimeStrategy = \"cache-first\" | \"network-first\" | \"stale-while-revalidate\";\n\n/** A single runtime-caching rule, matched against each `GET` request. */\nexport interface RuntimeRoute {\n    /** A `RegExp` tested against the full URL, or a predicate over the parsed URL. */\n    match: RegExp | ((url: URL, request: Request) => boolean);\n    /** How to resolve a match. */\n    strategy: RuntimeStrategy;\n    /** Cache bucket name for this route. */\n    cacheName: string;\n    /** Trim the cache to at most this many entries (FIFO) after each write. */\n    maxEntries?: number;\n    /** Treat a cached response older than this (seconds) as a miss. */\n    maxAgeSeconds?: number;\n    /** For `network-first`: fall back to cache after this timeout (seconds). */\n    networkTimeoutSeconds?: number;\n    /**\n     * Serve HTTP `Range` requests (206 Partial Content) by slicing the cached\n     * full response. Enable for audio/video so seeking works offline. The full\n     * resource is cached once (the `Range` header is stripped before caching).\n     */\n    rangeRequests?: boolean;\n    /**\n     * Opt in to caching requests that carry a credential header (see\n     * `credentialHeaders`), and responses marked `Cache-Control: private`.\n     * Default `false`.\n     *\n     * Cache Storage is keyed by URL and outlives the session: without this\n     * gate, a `GET /api/me` stored for one account was served to the next\n     * account on the same browser whenever the network failed or exceeded\n     * `networkTimeoutSeconds` (reproduced in Chromium 153, 11/10/2026). With\n     * the default, credentialed requests bypass the route entirely and reach\n     * the network as if no service worker were installed.\n     *\n     * When enabled, every stored entry gets `Vary` on each credential header the\n     * request carried, so the Cache API only matches it for the same credential —\n     * another account (or no account) misses instead of reading it. A token\n     * rotated while online simply repopulates the entry. Pair it with\n     * `clearSessionData()` on logout, which removes the entries themselves.\n     * `Cache-Control: no-store` is never cached, opt-in or not.\n     *\n     * A cookie session is invisible here: the worker cannot see `Cookie`, and\n     * gating on `request.credentials` would switch off caching for every\n     * same-origin image and font. A cookie-authenticated API stays private only\n     * through `Cache-Control: private`/`no-store` on its responses and\n     * `clearSessionData()` on logout.\n     */\n    cacheAuthenticated?: boolean;\n    /**\n     * Header names that mark a request as credentialed. Default\n     * `DEFAULT_CREDENTIAL_HEADERS` (`authorization`, `x-api-key`,\n     * `x-auth-token`, …) — the same list the background-sync queue strips.\n     */\n    credentialHeaders?: readonly string[];\n}\n\n/** Options for {@link installPrecache}. */\nexport interface InstallPrecacheOptions {\n    /** URL of the manifest emitted by `tempestPwaManifest()`. Default `/precache-manifest.json`. */\n    manifestUrl?: string;\n    /** Cache name prefix; the manifest `version` is appended. Default `tempest-precache`. */\n    cacheName?: string;\n    /** App-shell document served for navigation requests offline. Default `/index.html`. */\n    navigateFallback?: string;\n    /** Navigation paths that should NOT use the fallback (e.g. `[/^\\/api\\//]`). */\n    navigateFallbackDenylist?: RegExp[];\n    /** Activate the new worker immediately after precaching. Default `true`. */\n    skipWaiting?: boolean;\n    /**\n     * Enable the Navigation Preload API on `activate`, so the browser fetches\n     * the navigation request in parallel with the worker boot and the handler\n     * serves `event.preloadResponse` — cutting first-navigation latency after\n     * the worker starts. Silently ignored where unsupported. Default `true`.\n     */\n    navigationPreload?: boolean;\n}\n\ninterface PrecacheManifest {\n    version: string;\n    urls: string[];\n}\n\nlet precacheName = \"\";\nconst precachedPaths = new Set<string>();\n\n/**\n * Header stamped on every runtime-cache entry with the epoch milliseconds of the\n * write. `Date` alone is not enough: it is not a CORS-safelisted response\n * header, so for a cross-origin API the worker reads `null` and `maxAgeSeconds`\n * would never expire anything.\n */\nconst CACHED_AT_HEADER = \"x-tempest-cached-at\";\n\n/**\n * Whether a cached response has aged past `maxAgeSeconds`. Reads the\n * {@link CACHED_AT_HEADER} stamp written by the runtime cache, and falls back to\n * `Date` for entries written before the stamp existed.\n */\nfunction isExpired(response: Response, maxAgeSeconds?: number): boolean {\n    if (!maxAgeSeconds) return false;\n    const stamp = Number(response.headers.get(CACHED_AT_HEADER));\n    const dateHeader = response.headers.get(\"date\");\n    const storedAt = stamp > 0 ? stamp : dateHeader ? new Date(dateHeader).getTime() : NaN;\n    if (Number.isNaN(storedAt)) return false;\n    return (Date.now() - storedAt) / 1000 > maxAgeSeconds;\n}\n\n/** The `Cache-Control` directives of a response, lower-cased. */\nfunction cacheControlDirectives(response: Response): string[] {\n    return (response.headers.get(\"cache-control\") ?? \"\")\n        .toLowerCase()\n        .split(\",\")\n        .map((directive) => directive.trim().split(\"=\")[0]);\n}\n\n/**\n * Whether a network response may be written to the route's cache: it must be\n * `ok`, never `no-store`, and `private` only under `cacheAuthenticated`.\n */\nfunction isStorable(response: Response, route: RuntimeRoute): boolean {\n    if (!response.ok) return false;\n    const directives = cacheControlDirectives(response);\n    if (directives.includes(\"no-store\")) return false;\n    return route.cacheAuthenticated === true || !directives.includes(\"private\");\n}\n\n/** The credential headers, lower-cased, that a request carries for its route. */\nfunction credentialsOn(request: Request, route: RuntimeRoute): string[] {\n    return [...credentialHeaderSet(route.credentialHeaders)].filter((name) =>\n        request.headers.has(name),\n    );\n}\n\n/**\n * Write a response to the route's cache with the {@link CACHED_AT_HEADER} stamp\n * and, under `cacheAuthenticated`, `Vary` on each credential header the request\n * carried, so the entry only matches the credential that produced it. Skips\n * responses that {@link isStorable} rejects, then trims the cache to\n * `maxEntries`.\n */\nasync function store(\n    cache: Cache,\n    request: Request,\n    response: Response,\n    route: RuntimeRoute,\n): Promise<void> {\n    if (!isStorable(response, route)) return;\n    const headers = new Headers(response.headers);\n    headers.set(CACHED_AT_HEADER, String(Date.now()));\n    if (route.cacheAuthenticated) {\n        const vary = headers.get(\"vary\");\n        const varies = (vary ?? \"\")\n            .toLowerCase()\n            .split(\",\")\n            .map((name) => name.trim());\n        const missing = credentialsOn(request, route).filter((name) => !varies.includes(name));\n        if (missing.length > 0 && !varies.includes(\"*\")) {\n            headers.set(\"vary\", [vary, ...missing].filter(Boolean).join(\", \"));\n        }\n    }\n    const copy = response.clone();\n    await cache.put(\n        request,\n        new Response(copy.body, { status: copy.status, statusText: copy.statusText, headers }),\n    );\n    await trimCache(route.cacheName, route.maxEntries);\n}\n\n/** Drop oldest entries until the cache holds at most `maxEntries`. */\nasync function trimCache(cacheName: string, maxEntries?: number): Promise<void> {\n    if (!maxEntries) return;\n    const cache = await caches.open(cacheName);\n    const keys = await cache.keys();\n    if (keys.length <= maxEntries) return;\n    for (const key of keys.slice(0, keys.length - maxEntries)) {\n        await cache.delete(key);\n    }\n}\n\nasync function cacheFirst(request: Request, route: RuntimeRoute): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n    const cached = await cache.match(request);\n    if (cached && !isExpired(cached, route.maxAgeSeconds)) return cached;\n\n    const response = await fetch(request);\n    await store(cache, request, response, route);\n    return response;\n}\n\n/**\n * Network-first. When the timeout wins, the network request keeps running to\n * refresh the cache, and is handed to `extend` (`event.waitUntil`) so the\n * worker is not stopped mid-write.\n */\nasync function networkFirst(\n    request: Request,\n    route: RuntimeRoute,\n    extend: (promise: Promise<unknown>) => void,\n): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n\n    const network = (async (): Promise<Response> => {\n        const response = await fetch(request);\n        await store(cache, request, response, route);\n        return response;\n    })();\n\n    const timeoutMs = (route.networkTimeoutSeconds ?? 0) * 1000;\n    try {\n        if (timeoutMs > 0) {\n            const timeout = new Promise<never>((_, reject) =>\n                setTimeout(() => {\n                    extend(network.catch(() => undefined));\n                    reject(new Error(\"network-timeout\"));\n                }, timeoutMs),\n            );\n            return await Promise.race([network, timeout]);\n        }\n        return await network;\n    } catch {\n        const cached = await cache.match(request);\n        if (cached && !isExpired(cached, route.maxAgeSeconds)) return cached;\n        throw new Error(\"network-first: no network and no cache\");\n    }\n}\n\n/**\n * Stale-while-revalidate. A fresh cached response is served at once, and the\n * revalidation is handed to `extend` (`event.waitUntil`): without it the\n * browser may stop the worker before the refreshed response is written.\n */\nasync function staleWhileRevalidate(\n    request: Request,\n    route: RuntimeRoute,\n    extend: (promise: Promise<unknown>) => void,\n): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n    const cached = await cache.match(request);\n\n    const network = fetch(request)\n        .then(async (response) => {\n            await store(cache, request, response, route);\n            return response;\n        })\n        .catch(() => undefined);\n\n    const fresh = cached && !isExpired(cached, route.maxAgeSeconds) ? cached : undefined;\n    if (fresh) {\n        extend(network);\n        return fresh;\n    }\n    const response = await network;\n    if (response) return response;\n    throw new Error(\"stale-while-revalidate: no network and no cache\");\n}\n\nfunction runRoute(\n    request: Request,\n    route: RuntimeRoute,\n    extend: (promise: Promise<unknown>) => void,\n): Promise<Response> {\n    switch (route.strategy) {\n        case \"cache-first\":\n            return cacheFirst(request, route);\n        case \"network-first\":\n            return networkFirst(request, route, extend);\n        case \"stale-while-revalidate\":\n            return staleWhileRevalidate(request, route, extend);\n    }\n}\n\nfunction routeMatches(route: RuntimeRoute, url: URL, request: Request): boolean {\n    return typeof route.match === \"function\"\n        ? route.match(url, request)\n        : route.match.test(url.href);\n}\n\n/**\n * Build a `206 Partial Content` response from a full one for an HTTP `Range`\n * request. Supports `bytes=start-end`, open-ended `bytes=start-` and suffix\n * `bytes=-suffixLength` (the last N bytes). Returns the original response when there is no usable\n * `Range` header, or a `416` when the range is unsatisfiable.\n *\n * @param request The incoming request (its `Range` header drives the slice).\n * @param response The full (200) response to slice.\n */\nexport async function createPartialResponse(\n    request: Request,\n    response: Response,\n): Promise<Response> {\n    const rangeHeader = request.headers.get(\"range\");\n    if (!rangeHeader) return response;\n\n    const match = /^bytes=(\\d*)-(\\d*)$/.exec(rangeHeader.trim());\n    if (!match || (match[1] === \"\" && match[2] === \"\")) {\n        return new Response(null, { status: 416, statusText: \"Range Not Satisfiable\" });\n    }\n\n    const buffer = await response.clone().arrayBuffer();\n    const total = buffer.byteLength;\n\n    let start: number;\n    let end: number;\n    if (match[1] === \"\") {\n        const suffix = Number(match[2]);\n        start = Math.max(0, total - suffix);\n        end = total - 1;\n    } else {\n        start = Number(match[1]);\n        end = match[2] === \"\" ? total - 1 : Math.min(Number(match[2]), total - 1);\n    }\n\n    if (start > end || start >= total) {\n        return new Response(null, {\n            status: 416,\n            statusText: \"Range Not Satisfiable\",\n            headers: { \"Content-Range\": `bytes */${total}` },\n        });\n    }\n\n    const slice = buffer.slice(start, end + 1);\n    const headers = new Headers(response.headers);\n    headers.set(\"Content-Range\", `bytes ${start}-${end}/${total}`);\n    headers.set(\"Content-Length\", String(slice.byteLength));\n    headers.set(\"Accept-Ranges\", \"bytes\");\n\n    return new Response(slice, {\n        status: 206,\n        statusText: \"Partial Content\",\n        headers,\n    });\n}\n\n/**\n * Install a `fetch` handler that resolves matching `GET` requests with the\n * given runtime strategies. Non-matching requests are left untouched (no\n * `respondWith`), so a later {@link installPrecache} can handle them.\n *\n * A request carrying a credential header (`Authorization`, `X-Api-Key`, … — the\n * route's `credentialHeaders`) is also left untouched unless its route sets\n * `cacheAuthenticated`, and a response with `Cache-Control: no-store`\n * (or `private`, without that opt-in) is served but never stored. `maxAgeSeconds`\n * applies to every read, including the offline fallback: an expired entry is a\n * miss, never a last resort. Under `rangeRequests`, the full resource is cached\n * once (the `Range` header stripped) and each range is sliced from it.\n *\n * Register this BEFORE `installPrecache` so specific routes win over the\n * precache catch-all.\n *\n * @param routes Ordered rules; the first whose `match` passes handles the request.\n */\nexport function installRuntimeCache(routes: RuntimeRoute[]): void {\n    const sw = getSwScope();\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method !== \"GET\") return;\n\n        const url = new URL(request.url);\n        const route = routes.find((candidate) => routeMatches(candidate, url, request));\n        if (!route) return;\n        if (!route.cacheAuthenticated && credentialsOn(request, route).length > 0) return;\n        const extend = (promise: Promise<unknown>): void => event.waitUntil(promise);\n\n        if (route.rangeRequests && request.headers.has(\"range\")) {\n            const full = new Request(request.url, {\n                headers: stripRange(request.headers),\n                credentials: request.credentials,\n                mode: request.mode === \"navigate\" ? \"same-origin\" : request.mode,\n            });\n            event.respondWith(\n                runRoute(full, route, extend).then((response) =>\n                    createPartialResponse(request, response),\n                ),\n            );\n            return;\n        }\n\n        event.respondWith(runRoute(request, route, extend));\n    });\n}\n\n/** Copy headers without the `Range` header (so the cached entry is the full file). */\nfunction stripRange(headers: Headers): Headers {\n    const out = new Headers(headers);\n    out.delete(\"range\");\n    return out;\n}\n\n/**\n * Precache the app shell at `install` and serve it offline:\n *  - reads `precache-manifest.json` (emitted by `tempestPwaManifest()`),\n *  - caches every listed URL under a versioned cache,\n *  - on `activate`, deletes stale precache versions and claims open clients,\n *  - on `fetch`, serves precached assets cache-first and falls back to the\n *    `navigateFallback` document for offline navigations (SPA routing).\n *\n * Same-origin only. Register this LAST, after any {@link installRuntimeCache}.\n */\nexport function installPrecache(options: InstallPrecacheOptions = {}): void {\n    const sw = getSwScope();\n    const {\n        manifestUrl = \"/precache-manifest.json\",\n        cacheName = \"tempest-precache\",\n        navigateFallback = \"/index.html\",\n        navigateFallbackDenylist = [],\n        skipWaiting = true,\n        navigationPreload = true,\n    } = options;\n\n    sw.addEventListener(\"install\", (event) => {\n        event.waitUntil(\n            (async () => {\n                const response = await fetch(manifestUrl, { cache: \"no-cache\" });\n                const manifest = (await response.json()) as PrecacheManifest;\n                precacheName = `${cacheName}-${manifest.version}`;\n\n                const cache = await caches.open(precacheName);\n                await cache.addAll(manifest.urls);\n                for (const url of manifest.urls) {\n                    precachedPaths.add(new URL(url, sw.location.origin).pathname);\n                }\n                if (skipWaiting) await sw.skipWaiting();\n            })(),\n        );\n    });\n\n    sw.addEventListener(\"activate\", (event) => {\n        event.waitUntil(\n            (async () => {\n                const keys = await caches.keys();\n                await Promise.all(\n                    keys\n                        .filter((key) => key.startsWith(`${cacheName}-`) && key !== precacheName)\n                        .map((key) => caches.delete(key)),\n                );\n                if (navigationPreload && sw.registration?.navigationPreload) {\n                    await sw.registration.navigationPreload.enable();\n                }\n                await sw.clients.claim();\n            })(),\n        );\n    });\n\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method !== \"GET\") return;\n\n        const url = new URL(request.url);\n        if (url.origin !== sw.location.origin) return;\n\n        // SPA navigations: serve the cached app shell when offline.\n        if (request.mode === \"navigate\") {\n            if (navigateFallbackDenylist.some((re) => re.test(url.pathname))) return;\n            event.respondWith(\n                (async () => {\n                    try {\n                        const preloaded = await event.preloadResponse;\n                        if (preloaded) return preloaded;\n                        return await fetch(request);\n                    } catch {\n                        const cache = await caches.open(precacheName);\n                        const shell = await cache.match(navigateFallback);\n                        if (shell) return shell;\n                        throw new Error(\"offline and no cached app shell\");\n                    }\n                })(),\n            );\n            return;\n        }\n\n        // Precached static assets: cache-first.\n        if (precachedPaths.has(url.pathname)) {\n            event.respondWith(\n                (async () => {\n                    const cache = await caches.open(precacheName);\n                    const cached = await cache.match(request);\n                    return cached ?? fetch(request);\n                })(),\n            );\n        }\n    });\n}\n"],"mappings":";;AAyDA,SAAS,IAA4B;CACjC,OAAO;AACX;AAqFA,IAAI,IAAe,IACb,oBAAiB,IAAI,IAAY,GAQjC,IAAmB;AAOzB,SAAS,EAAU,GAAoB,GAAiC;CACpE,IAAI,CAAC,GAAe,OAAO;CAC3B,IAAM,IAAQ,OAAO,EAAS,QAAQ,IAAI,CAAgB,CAAC,GACrD,IAAa,EAAS,QAAQ,IAAI,MAAM,GACxC,IAAW,IAAQ,IAAI,IAAQ,IAAa,IAAI,KAAK,CAAU,CAAC,CAAC,QAAQ,IAAI;CAEnF,OADA,CAAI,OAAO,MAAM,CAAQ,MACjB,KAAK,IAAI,IAAI,KAAY,MAAO;AAC5C;AAGA,SAAS,EAAuB,GAA8B;CAC1D,QAAQ,EAAS,QAAQ,IAAI,eAAe,KAAK,GAAA,CAC5C,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,KAAK,MAAc,EAAU,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;AAC1D;AAMA,SAAS,EAAW,GAAoB,GAA8B;CAClE,IAAI,CAAC,EAAS,IAAI,OAAO;CACzB,IAAM,IAAa,EAAuB,CAAQ;CAElD,OADI,EAAW,SAAS,UAAU,IAAU,KACrC,EAAM,uBAAuB,MAAQ,CAAC,EAAW,SAAS,SAAS;AAC9E;AAGA,SAAS,EAAc,GAAkB,GAA+B;CACpE,OAAO,CAAC,GAAG,EAAoB,EAAM,iBAAiB,CAAC,CAAC,CAAC,QAAQ,MAC7D,EAAQ,QAAQ,IAAI,CAAI,CAC5B;AACJ;AASA,eAAe,EACX,GACA,GACA,GACA,GACa;CACb,IAAI,CAAC,EAAW,GAAU,CAAK,GAAG;CAClC,IAAM,IAAU,IAAI,QAAQ,EAAS,OAAO;CAE5C,IADA,EAAQ,IAAI,GAAkB,OAAO,KAAK,IAAI,CAAC,CAAC,GAC5C,EAAM,oBAAoB;EAC1B,IAAM,IAAO,EAAQ,IAAI,MAAM,GACzB,KAAU,KAAQ,GAAA,CACnB,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,KAAK,MAAS,EAAK,KAAK,CAAC,GACxB,IAAU,EAAc,GAAS,CAAK,CAAC,CAAC,QAAQ,MAAS,CAAC,EAAO,SAAS,CAAI,CAAC;EACrF,AAAI,EAAQ,SAAS,KAAK,CAAC,EAAO,SAAS,GAAG,KAC1C,EAAQ,IAAI,QAAQ,CAAC,GAAM,GAAG,CAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;CAEzE;CACA,IAAM,IAAO,EAAS,MAAM;CAK5B,AAJA,MAAM,EAAM,IACR,GACA,IAAI,SAAS,EAAK,MAAM;EAAE,QAAQ,EAAK;EAAQ,YAAY,EAAK;EAAY;CAAQ,CAAC,CACzF,GACA,MAAM,EAAU,EAAM,WAAW,EAAM,UAAU;AACrD;AAGA,eAAe,EAAU,GAAmB,GAAoC;CAC5E,IAAI,CAAC,GAAY;CACjB,IAAM,IAAQ,MAAM,OAAO,KAAK,CAAS,GACnC,IAAO,MAAM,EAAM,KAAK;CAC1B,QAAK,UAAU,IACnB,KAAK,IAAM,KAAO,EAAK,MAAM,GAAG,EAAK,SAAS,CAAU,GACpD,MAAM,EAAM,OAAO,CAAG;AAE9B;AAEA,eAAe,EAAW,GAAkB,GAAwC;CAChF,IAAM,IAAQ,MAAM,OAAO,KAAK,EAAM,SAAS,GACzC,IAAS,MAAM,EAAM,MAAM,CAAO;CACxC,IAAI,KAAU,CAAC,EAAU,GAAQ,EAAM,aAAa,GAAG,OAAO;CAE9D,IAAM,IAAW,MAAM,MAAM,CAAO;CAEpC,OADA,MAAM,EAAM,GAAO,GAAS,GAAU,CAAK,GACpC;AACX;AAOA,eAAe,EACX,GACA,GACA,GACiB;CACjB,IAAM,IAAQ,MAAM,OAAO,KAAK,EAAM,SAAS,GAEzC,KAAW,YAA+B;EAC5C,IAAM,IAAW,MAAM,MAAM,CAAO;EAEpC,OADA,MAAM,EAAM,GAAO,GAAS,GAAU,CAAK,GACpC;CACX,EAAA,CAAG,GAEG,KAAa,EAAM,yBAAyB,KAAK;CACvD,IAAI;EACA,IAAI,IAAY,GAAG;GACf,IAAM,IAAU,IAAI,SAAgB,GAAG,MACnC,iBAAiB;IAEb,AADA,EAAO,EAAQ,YAAY,KAAA,CAAS,CAAC,GACrC,EAAO,gBAAI,MAAM,iBAAiB,CAAC;GACvC,GAAG,CAAS,CAChB;GACA,OAAO,MAAM,QAAQ,KAAK,CAAC,GAAS,CAAO,CAAC;EAChD;EACA,OAAO,MAAM;CACjB,QAAQ;EACJ,IAAM,IAAS,MAAM,EAAM,MAAM,CAAO;EACxC,IAAI,KAAU,CAAC,EAAU,GAAQ,EAAM,aAAa,GAAG,OAAO;EAC9D,MAAU,MAAM,wCAAwC;CAC5D;AACJ;AAOA,eAAe,EACX,GACA,GACA,GACiB;CACjB,IAAM,IAAQ,MAAM,OAAO,KAAK,EAAM,SAAS,GACzC,IAAS,MAAM,EAAM,MAAM,CAAO,GAElC,IAAU,MAAM,CAAO,CAAC,CACzB,KAAK,OAAO,OACT,MAAM,EAAM,GAAO,GAAS,GAAU,CAAK,GACpC,EACV,CAAC,CACD,YAAY,KAAA,CAAS,GAEpB,IAAQ,KAAU,CAAC,EAAU,GAAQ,EAAM,aAAa,IAAI,IAAS,KAAA;CAC3E,IAAI,GAEA,OADA,EAAO,CAAO,GACP;CAEX,IAAM,IAAW,MAAM;CACvB,IAAI,GAAU,OAAO;CACrB,MAAU,MAAM,iDAAiD;AACrE;AAEA,SAAS,EACL,GACA,GACA,GACiB;CACjB,QAAQ,EAAM,UAAd;EACI,KAAK,eACD,OAAO,EAAW,GAAS,CAAK;EACpC,KAAK,iBACD,OAAO,EAAa,GAAS,GAAO,CAAM;EAC9C,KAAK,0BACD,OAAO,EAAqB,GAAS,GAAO,CAAM;CAC1D;AACJ;AAEA,SAAS,EAAa,GAAqB,GAAU,GAA2B;CAC5E,OAAO,OAAO,EAAM,SAAU,aACxB,EAAM,MAAM,GAAK,CAAO,IACxB,EAAM,MAAM,KAAK,EAAI,IAAI;AACnC;AAWA,eAAsB,EAClB,GACA,GACiB;CACjB,IAAM,IAAc,EAAQ,QAAQ,IAAI,OAAO;CAC/C,IAAI,CAAC,GAAa,OAAO;CAEzB,IAAM,IAAQ,sBAAsB,KAAK,EAAY,KAAK,CAAC;CAC3D,IAAI,CAAC,KAAU,EAAM,OAAO,MAAM,EAAM,OAAO,IAC3C,OAAO,IAAI,SAAS,MAAM;EAAE,QAAQ;EAAK,YAAY;CAAwB,CAAC;CAGlF,IAAM,IAAS,MAAM,EAAS,MAAM,CAAC,CAAC,YAAY,GAC5C,IAAQ,EAAO,YAEjB,GACA;CACJ,IAAI,EAAM,OAAO,IAAI;EACjB,IAAM,IAAS,OAAO,EAAM,EAAE;EAE9B,AADA,IAAQ,KAAK,IAAI,GAAG,IAAQ,CAAM,GAClC,IAAM,IAAQ;CAClB,OAEI,AADA,IAAQ,OAAO,EAAM,EAAE,GACvB,IAAM,EAAM,OAAO,KAAK,IAAQ,IAAI,KAAK,IAAI,OAAO,EAAM,EAAE,GAAG,IAAQ,CAAC;CAG5E,IAAI,IAAQ,KAAO,KAAS,GACxB,OAAO,IAAI,SAAS,MAAM;EACtB,QAAQ;EACR,YAAY;EACZ,SAAS,EAAE,iBAAiB,WAAW,IAAQ;CACnD,CAAC;CAGL,IAAM,IAAQ,EAAO,MAAM,GAAO,IAAM,CAAC,GACnC,IAAU,IAAI,QAAQ,EAAS,OAAO;CAK5C,OAJA,EAAQ,IAAI,iBAAiB,SAAS,EAAM,GAAG,EAAI,GAAG,GAAO,GAC7D,EAAQ,IAAI,kBAAkB,OAAO,EAAM,UAAU,CAAC,GACtD,EAAQ,IAAI,iBAAiB,OAAO,GAE7B,IAAI,SAAS,GAAO;EACvB,QAAQ;EACR,YAAY;EACZ;CACJ,CAAC;AACL;AAoBA,SAAgB,EAAoB,GAA8B;CAE9D,EAAA,CAAA,CAAG,iBAAiB,UAAU,MAAU;EACpC,IAAM,IAAU,EAAM;EACtB,IAAI,EAAQ,WAAW,OAAO;EAE9B,IAAM,IAAM,IAAI,IAAI,EAAQ,GAAG,GACzB,IAAQ,EAAO,MAAM,MAAc,EAAa,GAAW,GAAK,CAAO,CAAC;EAE9E,IADI,CAAC,KACD,CAAC,EAAM,sBAAsB,EAAc,GAAS,CAAK,CAAC,CAAC,SAAS,GAAG;EAC3E,IAAM,KAAU,MAAoC,EAAM,UAAU,CAAO;EAE3E,IAAI,EAAM,iBAAiB,EAAQ,QAAQ,IAAI,OAAO,GAAG;GACrD,IAAM,IAAO,IAAI,QAAQ,EAAQ,KAAK;IAClC,SAAS,EAAW,EAAQ,OAAO;IACnC,aAAa,EAAQ;IACrB,MAAM,EAAQ,SAAS,aAAa,gBAAgB,EAAQ;GAChE,CAAC;GACD,EAAM,YACF,EAAS,GAAM,GAAO,CAAM,CAAC,CAAC,MAAM,MAChC,EAAsB,GAAS,CAAQ,CAC3C,CACJ;GACA;EACJ;EAEA,EAAM,YAAY,EAAS,GAAS,GAAO,CAAM,CAAC;CACtD,CAAC;AACL;AAGA,SAAS,EAAW,GAA2B;CAC3C,IAAM,IAAM,IAAI,QAAQ,CAAO;CAE/B,OADA,EAAI,OAAO,OAAO,GACX;AACX;AAYA,SAAgB,EAAgB,IAAkC,CAAC,GAAS;CACxE,IAAM,IAAK,EAAW,GAChB,EACF,iBAAc,2BACd,eAAY,oBACZ,sBAAmB,eACnB,8BAA2B,CAAC,GAC5B,iBAAc,IACd,uBAAoB,OACpB;CAoCJ,AAlCA,EAAG,iBAAiB,YAAY,MAAU;EACtC,EAAM,WACD,YAAY;GAET,IAAM,IAAY,OAAM,MADD,MAAM,GAAa,EAAE,OAAO,WAAW,CAAC,EAAA,CAC9B,KAAK;GAItC,AAHA,IAAe,GAAG,EAAU,GAAG,EAAS,WAGxC,OAAM,MADc,OAAO,KAAK,CAAY,EAAA,CAChC,OAAO,EAAS,IAAI;GAChC,KAAK,IAAM,KAAO,EAAS,MACvB,EAAe,IAAI,IAAI,IAAI,GAAK,EAAG,SAAS,MAAM,CAAC,CAAC,QAAQ;GAEhE,AAAI,KAAa,MAAM,EAAG,YAAY;EAC1C,EAAA,CAAG,CACP;CACJ,CAAC,GAED,EAAG,iBAAiB,aAAa,MAAU;EACvC,EAAM,WACD,YAAY;GACT,IAAM,IAAO,MAAM,OAAO,KAAK;GAS/B,AARA,MAAM,QAAQ,IACV,EACK,QAAQ,MAAQ,EAAI,WAAW,GAAG,EAAU,EAAE,KAAK,MAAQ,CAAY,CAAC,CACxE,KAAK,MAAQ,OAAO,OAAO,CAAG,CAAC,CACxC,GACI,KAAqB,EAAG,cAAc,qBACtC,MAAM,EAAG,aAAa,kBAAkB,OAAO,GAEnD,MAAM,EAAG,QAAQ,MAAM;EAC3B,EAAA,CAAG,CACP;CACJ,CAAC,GAED,EAAG,iBAAiB,UAAU,MAAU;EACpC,IAAM,IAAU,EAAM;EACtB,IAAI,EAAQ,WAAW,OAAO;EAE9B,IAAM,IAAM,IAAI,IAAI,EAAQ,GAAG;EAC3B,MAAI,WAAW,EAAG,SAAS,QAG/B;OAAI,EAAQ,SAAS,YAAY;IAC7B,IAAI,EAAyB,MAAM,MAAO,EAAG,KAAK,EAAI,QAAQ,CAAC,GAAG;IAClE,EAAM,aACD,YAAY;KACT,IAAI;MAGA,OADI,MADoB,EAAM,mBAEvB,MAAM,MAAM,CAAO;KAC9B,QAAQ;MAEJ,IAAM,IAAQ,OAAM,MADA,OAAO,KAAK,CAAY,EAAA,CAClB,MAAM,CAAgB;MAChD,IAAI,GAAO,OAAO;MAClB,MAAU,MAAM,iCAAiC;KACrD;IACJ,EAAA,CAAG,CACP;IACA;GACJ;GAGA,AAAI,EAAe,IAAI,EAAI,QAAQ,KAC/B,EAAM,aACD,YAGU,OADc,MADD,OAAO,KAAK,CAAY,EAAA,CACjB,MAAM,CAAO,KACvB,MAAM,CAAO,EAClC,CAAG,CACP;EAVJ;CAYJ,CAAC;AACL"}

package/dist/sw/credential-headers.cjs

@@ -0,0 +1,2 @@
+var e=[`authorization`,`proxy-authorization`,`cookie`,`x-api-key`,`x-auth-token`,`x-csrf-token`,`x-xsrf-token`];function t(t=e){return new Set(t.map(e=>e.toLowerCase()))}exports.DEFAULT_CREDENTIAL_HEADERS=e,exports.credentialHeaderSet=t;
+//# sourceMappingURL=credential-headers.cjs.map

package/dist/sw/credential-headers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-headers.cjs","names":[],"sources":["../../src/sw/credential-headers.ts"],"sourcesContent":["/**\n * Header names treated as credentials by the service-worker helpers: never\n * persisted by `installBackgroundSync`, and a request carrying any of them\n * bypasses `installRuntimeCache` unless the route opts in. `Cookie` and\n * `Proxy-Authorization` are listed for completeness although the browser\n * forbids scripts from setting them — a cookie session is invisible to the\n * worker. The runtime cache therefore depends on `Cache-Control` and\n * `clearSessionData()`; the background-sync queue checks the entry's owner\n * through `getPrincipal` whether or not a credential header was stripped, and\n * `clearSessionData()` still backs that check up.\n */\nexport const DEFAULT_CREDENTIAL_HEADERS: readonly string[] = [\n    \"authorization\",\n    \"proxy-authorization\",\n    \"cookie\",\n    \"x-api-key\",\n    \"x-auth-token\",\n    \"x-csrf-token\",\n    \"x-xsrf-token\",\n];\n\n/**\n * Lower-case a list of header names into a set for case-insensitive lookups.\n *\n * @param names - Header names, any case. Default {@link DEFAULT_CREDENTIAL_HEADERS}.\n * @returns The lower-cased set.\n */\nexport function credentialHeaderSet(\n    names: readonly string[] = DEFAULT_CREDENTIAL_HEADERS,\n): ReadonlySet<string> {\n    return new Set(names.map((name) => name.toLowerCase()));\n}\n"],"mappings":"AAWA,IAAa,EAAgD,CACzD,gBACA,sBACA,SACA,YACA,eACA,eACA,cACJ,EAQA,SAAgB,EACZ,EAA2B,EACR,CACnB,OAAO,IAAI,IAAI,EAAM,IAAK,GAAS,EAAK,YAAY,CAAC,CAAC,CAC1D"}

package/dist/sw/credential-headers.js

@@ -0,0 +1,17 @@
+//#region src/sw/credential-headers.ts
+var e = [
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"x-api-key",
+	"x-auth-token",
+	"x-csrf-token",
+	"x-xsrf-token"
+];
+function t(t = e) {
+	return new Set(t.map((e) => e.toLowerCase()));
+}
+//#endregion
+export { e as DEFAULT_CREDENTIAL_HEADERS, t as credentialHeaderSet };
+
+//# sourceMappingURL=credential-headers.js.map

package/dist/sw/credential-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-headers.js","names":[],"sources":["../../src/sw/credential-headers.ts"],"sourcesContent":["/**\n * Header names treated as credentials by the service-worker helpers: never\n * persisted by `installBackgroundSync`, and a request carrying any of them\n * bypasses `installRuntimeCache` unless the route opts in. `Cookie` and\n * `Proxy-Authorization` are listed for completeness although the browser\n * forbids scripts from setting them — a cookie session is invisible to the\n * worker. The runtime cache therefore depends on `Cache-Control` and\n * `clearSessionData()`; the background-sync queue checks the entry's owner\n * through `getPrincipal` whether or not a credential header was stripped, and\n * `clearSessionData()` still backs that check up.\n */\nexport const DEFAULT_CREDENTIAL_HEADERS: readonly string[] = [\n    \"authorization\",\n    \"proxy-authorization\",\n    \"cookie\",\n    \"x-api-key\",\n    \"x-auth-token\",\n    \"x-csrf-token\",\n    \"x-xsrf-token\",\n];\n\n/**\n * Lower-case a list of header names into a set for case-insensitive lookups.\n *\n * @param names - Header names, any case. Default {@link DEFAULT_CREDENTIAL_HEADERS}.\n * @returns The lower-cased set.\n */\nexport function credentialHeaderSet(\n    names: readonly string[] = DEFAULT_CREDENTIAL_HEADERS,\n): ReadonlySet<string> {\n    return new Set(names.map((name) => name.toLowerCase()));\n}\n"],"mappings":";AAWA,IAAa,IAAgD;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;AAQA,SAAgB,EACZ,IAA2B,GACR;CACnB,OAAO,IAAI,IAAI,EAAM,KAAK,MAAS,EAAK,YAAY,CAAC,CAAC;AAC1D"}

package/dist/sw/session-data.cjs

@@ -0,0 +1,2 @@
+const e=require("./background-sync.cjs"),t=require("./cache-inspect.cjs");function n(e){return!e.startsWith(`tempest-precache-`)}async function r(r={}){let[i,a]=await Promise.all([t.clearCaches(r.caches??n),e.clearBackgroundSyncQueue(r.queueName)]);return{caches:i,queueCleared:a}}exports.clearSessionData=r;
+//# sourceMappingURL=session-data.cjs.map

package/dist/sw/session-data.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-data.cjs","names":[],"sources":["../../src/sw/session-data.ts"],"sourcesContent":["import { clearBackgroundSyncQueue } from \"./background-sync\";\nimport { clearCaches } from \"./cache-inspect\";\nimport type { CacheFilter } from \"./cache-inspect\";\n\n/** Options for {@link clearSessionData}. */\nexport interface ClearSessionDataOptions {\n    /**\n     * Which Cache Storage buckets hold session data. Default: every bucket except\n     * the app-shell precache (`tempest-precache-*`), so the app still launches\n     * offline after logout while no runtime entry — whatever its `cacheName` —\n     * survives into the next session.\n     */\n    caches?: CacheFilter;\n    /** The background-sync `queueName` to clear. Default `tempest-bg-sync`. */\n    queueName?: string;\n}\n\n/** What {@link clearSessionData} removed. */\nexport interface ClearSessionDataResult {\n    /** Names of the Cache Storage buckets deleted. */\n    caches: string[];\n    /** Whether the background-sync queue was emptied. */\n    queueCleared: boolean;\n}\n\n/** Default cache filter: everything but the versioned app-shell precache. */\nfunction isSessionCache(name: string): boolean {\n    return !name.startsWith(\"tempest-precache-\");\n}\n\n/**\n * Remove everything the service-worker helpers keep on behalf of the signed-in\n * user: the runtime caches filled by `installRuntimeCache` and the queue of\n * mutations waiting in `installBackgroundSync`. Call it on logout, from the page.\n *\n * Both stores outlive the session and are shared by every account that signs in\n * on the browser. Measured in Chromium 153 (11/10/2026), before this existed:\n * the documented `clearCaches(\"tempest-\")` deleted nothing because the recipe's\n * runtime cache was named `api`, the next account read the previous account's\n * `GET /api/me` offline, and a mutation queued by the previous account was\n * replayed with its stored bearer after logout. A prefix filter cannot know the\n * names a recipe chose, so the default here inverts it: every bucket goes except\n * the precache, which holds only the build's static assets.\n *\n * Cache Storage and IndexedDB are origin storage, readable from the window, so\n * this needs no message to the worker.\n *\n * @param options - Narrow the caches to delete, or name a custom queue.\n * @returns The caches deleted and whether the queue was cleared.\n *\n * @example\n * import { clearSessionData } from \"tempest-react-sdk/sw\";\n *\n * async function logout() {\n *     await clearSessionData();\n * }\n */\nexport async function clearSessionData(\n    options: ClearSessionDataOptions = {},\n): Promise<ClearSessionDataResult> {\n    const [caches, queueCleared] = await Promise.all([\n        clearCaches(options.caches ?? isSessionCache),\n        clearBackgroundSyncQueue(options.queueName),\n    ]);\n    return { caches, queueCleared };\n}\n"],"mappings":"0EA0BA,SAAS,EAAe,EAAuB,CAC3C,MAAO,CAAC,EAAK,WAAW,mBAAmB,CAC/C,CA6BA,eAAsB,EAClB,EAAmC,CAAC,EACL,CAC/B,GAAM,CAAC,EAAQ,GAAgB,MAAM,QAAQ,IAAI,CAC7C,EAAA,YAAY,EAAQ,QAAU,CAAc,EAC5C,EAAA,yBAAyB,EAAQ,SAAS,CAC9C,CAAC,EACD,MAAO,CAAE,SAAQ,cAAa,CAClC"}

package/dist/sw/session-data.js

@@ -0,0 +1,17 @@
+import { clearBackgroundSyncQueue as e } from "./background-sync.js";
+import { clearCaches as t } from "./cache-inspect.js";
+//#region src/sw/session-data.ts
+function n(e) {
+	return !e.startsWith("tempest-precache-");
+}
+async function r(r = {}) {
+	let [i, a] = await Promise.all([t(r.caches ?? n), e(r.queueName)]);
+	return {
+		caches: i,
+		queueCleared: a
+	};
+}
+//#endregion
+export { r as clearSessionData };
+
+//# sourceMappingURL=session-data.js.map

package/dist/sw/session-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-data.js","names":[],"sources":["../../src/sw/session-data.ts"],"sourcesContent":["import { clearBackgroundSyncQueue } from \"./background-sync\";\nimport { clearCaches } from \"./cache-inspect\";\nimport type { CacheFilter } from \"./cache-inspect\";\n\n/** Options for {@link clearSessionData}. */\nexport interface ClearSessionDataOptions {\n    /**\n     * Which Cache Storage buckets hold session data. Default: every bucket except\n     * the app-shell precache (`tempest-precache-*`), so the app still launches\n     * offline after logout while no runtime entry — whatever its `cacheName` —\n     * survives into the next session.\n     */\n    caches?: CacheFilter;\n    /** The background-sync `queueName` to clear. Default `tempest-bg-sync`. */\n    queueName?: string;\n}\n\n/** What {@link clearSessionData} removed. */\nexport interface ClearSessionDataResult {\n    /** Names of the Cache Storage buckets deleted. */\n    caches: string[];\n    /** Whether the background-sync queue was emptied. */\n    queueCleared: boolean;\n}\n\n/** Default cache filter: everything but the versioned app-shell precache. */\nfunction isSessionCache(name: string): boolean {\n    return !name.startsWith(\"tempest-precache-\");\n}\n\n/**\n * Remove everything the service-worker helpers keep on behalf of the signed-in\n * user: the runtime caches filled by `installRuntimeCache` and the queue of\n * mutations waiting in `installBackgroundSync`. Call it on logout, from the page.\n *\n * Both stores outlive the session and are shared by every account that signs in\n * on the browser. Measured in Chromium 153 (11/10/2026), before this existed:\n * the documented `clearCaches(\"tempest-\")` deleted nothing because the recipe's\n * runtime cache was named `api`, the next account read the previous account's\n * `GET /api/me` offline, and a mutation queued by the previous account was\n * replayed with its stored bearer after logout. A prefix filter cannot know the\n * names a recipe chose, so the default here inverts it: every bucket goes except\n * the precache, which holds only the build's static assets.\n *\n * Cache Storage and IndexedDB are origin storage, readable from the window, so\n * this needs no message to the worker.\n *\n * @param options - Narrow the caches to delete, or name a custom queue.\n * @returns The caches deleted and whether the queue was cleared.\n *\n * @example\n * import { clearSessionData } from \"tempest-react-sdk/sw\";\n *\n * async function logout() {\n *     await clearSessionData();\n * }\n */\nexport async function clearSessionData(\n    options: ClearSessionDataOptions = {},\n): Promise<ClearSessionDataResult> {\n    const [caches, queueCleared] = await Promise.all([\n        clearCaches(options.caches ?? isSessionCache),\n        clearBackgroundSyncQueue(options.queueName),\n    ]);\n    return { caches, queueCleared };\n}\n"],"mappings":";;;AA0BA,SAAS,EAAe,GAAuB;CAC3C,OAAO,CAAC,EAAK,WAAW,mBAAmB;AAC/C;AA6BA,eAAsB,EAClB,IAAmC,CAAC,GACL;CAC/B,IAAM,CAAC,GAAQ,KAAgB,MAAM,QAAQ,IAAI,CAC7C,EAAY,EAAQ,UAAU,CAAc,GAC5C,EAAyB,EAAQ,SAAS,CAC9C,CAAC;CACD,OAAO;EAAE;EAAQ;CAAa;AAClC"}

package/dist/sw.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./sw/register-service-worker.cjs"),t=require("./sw/create-push-handler.cjs"),n=require("./sw/cache.cjs"),r=require("./sw/background-sync.cjs"),i=require("./sw/periodic-sync.cjs"),a=require("./sw/cache-inspect.cjs");exports.clearCaches=a.clearCaches,exports.createPartialResponse=n.createPartialResponse,exports.inspectCaches=a.inspectCaches,exports.installBackgroundSync=r.installBackgroundSync,exports.installNotificationClickHandler=t.installNotificationClickHandler,exports.installPrecache=n.installPrecache,exports.installPushHandler=t.installPushHandler,exports.installRuntimeCache=n.installRuntimeCache,exports.installSkipWaitingListener=t.installSkipWaitingListener,exports.registerPeriodicSync=i.registerPeriodicSync,exports.registerServiceWorker=e.registerServiceWorker,exports.skipWaiting=e.skipWaiting,exports.unregisterAllServiceWorkers=e.unregisterAllServiceWorkers;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./sw/register-service-worker.cjs"),t=require("./sw/create-push-handler.cjs"),n=require("./sw/credential-headers.cjs"),r=require("./sw/cache.cjs"),i=require("./sw/background-sync.cjs"),a=require("./sw/periodic-sync.cjs"),o=require("./sw/cache-inspect.cjs"),s=require("./sw/session-data.cjs");exports.BACKGROUND_SYNC_CREDENTIALS_MESSAGE=i.BACKGROUND_SYNC_CREDENTIALS_MESSAGE,exports.DEFAULT_CREDENTIAL_HEADERS=n.DEFAULT_CREDENTIAL_HEADERS,exports.clearBackgroundSyncQueue=i.clearBackgroundSyncQueue,exports.clearCaches=o.clearCaches,exports.clearSessionData=s.clearSessionData,exports.createPartialResponse=r.createPartialResponse,exports.inspectCaches=o.inspectCaches,exports.installBackgroundSync=i.installBackgroundSync,exports.installNotificationClickHandler=t.installNotificationClickHandler,exports.installPrecache=r.installPrecache,exports.installPushHandler=t.installPushHandler,exports.installRuntimeCache=r.installRuntimeCache,exports.installSkipWaitingListener=t.installSkipWaitingListener,exports.provideBackgroundSyncCredentials=i.provideBackgroundSyncCredentials,exports.registerPeriodicSync=a.registerPeriodicSync,exports.registerServiceWorker=e.registerServiceWorker,exports.skipWaiting=e.skipWaiting,exports.unregisterAllServiceWorkers=e.unregisterAllServiceWorkers;

package/dist/sw.d.ts

@@ -1,11 +1,76 @@
+/**
+ * `type` of the message the worker posts to window clients to ask about a queued
+ * request. Answered by {@link provideBackgroundSyncCredentials}.
+ */
+export declare const BACKGROUND_SYNC_CREDENTIALS_MESSAGE = "tempest:bg-sync-credentials";
+
+/**
+ * Resolve the credentials for a queued request: a header record to apply, or
+ * `null` when there is no session (the entry is then dropped).
+ */
+export declare type BackgroundSyncCredentialsProvider = (request: BackgroundSyncCredentialsRequest) => Record<string, string> | null | Promise<Record<string, string> | null>;
+
+/** The request a window client is asked about, as sent by the worker. */
+export declare interface BackgroundSyncCredentialsRequest {
+    /** Absolute URL of the queued request. */
+    url: string;
+    /** HTTP method of the queued request. */
+    method: string;
+    /**
+     * `"enqueue"` when the worker only wants the owner of a request that just
+     * failed; `"replay"` when it is about to send it and needs the credentials.
+     */
+    phase: "enqueue" | "replay";
+}
+
+/**
+ * How the default `beforeReplay` treats an `"unknown"` owner on an entry that
+ * carried no credential header:
+ * - `"strict"` (default): it asks the open pages like any other entry — replayed
+ *   only when every answer lacks a principal, dropped as soon as one answer has
+ *   one, pending while nobody answers.
+ * - `"lenient"`: it is replayed as-is, without asking (the behavior up to 0.77.0).
+ *
+ * An entry with stripped credentials always asks, under either policy.
+ */
+export declare type BackgroundSyncOwnerPolicy = "strict" | "lenient";
+
+/**
+ * How an entry is tied to whoever queued it:
+ * - `"bound"`: the issuing page reported a principal (or `null` for nobody);
+ *   the entry only goes out while the same one is signed in.
+ * - `"unbound"`: the issuing page answered without `getPrincipal`.
+ * - `"unknown"`: nobody could say — no issuing tab, no answer, an error, or an
+ *   entry written before owners existed. Fails closed, with or without stripped
+ *   credentials: a cookie session rides along on the replay, so an entry with no
+ *   credential header is checked like any other.
+ *
+ * While the worker is still asking, the stored state is `"pending"`, which a
+ * replay never sees: it waits, then reads a stamp that never came as `"unknown"`.
+ */
+export declare type BackgroundSyncOwnerState = "bound" | "unbound" | "unknown";
+
+/** What a queued request looked like when it was stored, passed to `beforeReplay`. */
+export declare interface BackgroundSyncReplayContext {
+    /** Epoch milliseconds of the original failed attempt. */
+    queuedAt: number;
+    /** Lower-cased credential header names stripped before the entry was stored. */
+    strippedHeaders: readonly string[];
+    /** How the entry is tied to its owner. */
+    ownerState: BackgroundSyncOwnerState;
+    /** Owner fingerprint under `"bound"` (`null` for nobody); `undefined` otherwise. */
+    owner: string | null | undefined;
+}
+
 /** A cache-name matcher: a prefix string, a `RegExp`, or a predicate. */
 export declare type CacheFilter = string | RegExp | ((name: string) => boolean);
 
 /**
  * Main-thread helpers to inspect and clear the Cache Storage buckets a service
- * worker fills — for a "X MB cacheado" readout and a "limpar cache" action
- * (e.g. on logout). All guard `caches` so they no-op safely under SSR / older
- * browsers.
+ * worker fills — for a "X MB cacheado" readout and a "limpar cache" action.
+ * On logout prefer `clearSessionData`, which also drops the background-sync
+ * queue and spares the app-shell precache. All guard `caches` so they no-op
+ * safely under SSR / older browsers.
  */
 /** Per-cache usage summary returned by {@link inspectCaches}. */
 export declare interface CacheReport {
@@ -17,6 +82,28 @@ export declare interface CacheReport {
     bytes: number | null;
 }
 
+/**
+ * Empty the background-sync queue — every request still waiting to be replayed —
+ * and bump its clear epoch. Call it on logout (or use `clearSessionData()`, which
+ * also clears the runtime caches) so mutations made under one session are never
+ * replayed under the next.
+ *
+ * Works from the page and from the worker, and reaches work already in flight
+ * in the worker: a replay checks each entry right before sending it, and a
+ * request still failing when the queue is cleared is not written afterwards.
+ *
+ * @param queueName - The `queueName` given to {@link installBackgroundSync}.
+ *   Default `tempest-bg-sync`.
+ * @returns `true` once the queue is empty; `false` when IndexedDB is
+ *   unavailable (SSR, old browsers).
+ *
+ * @example
+ * import { clearBackgroundSyncQueue } from "tempest-react-sdk/sw";
+ *
+ * await clearBackgroundSyncQueue();
+ */
+export declare function clearBackgroundSyncQueue(queueName?: string): Promise<boolean>;
+
 /**
  * Delete Cache Storage buckets whose name passes `filter` (all of them when no
  * filter is given).
@@ -25,14 +112,64 @@ export declare interface CacheReport {
  * @returns The names of the caches that were deleted.
  *
  * @example
- * await clearCaches("tempest-"); // drop every SDK-managed cache on logout
+ * await clearCaches("tempest-api"); // drop one runtime bucket
  */
 export declare function clearCaches(filter?: CacheFilter): Promise<string[]>;
 
+/**
+ * Remove everything the service-worker helpers keep on behalf of the signed-in
+ * user: the runtime caches filled by `installRuntimeCache` and the queue of
+ * mutations waiting in `installBackgroundSync`. Call it on logout, from the page.
+ *
+ * Both stores outlive the session and are shared by every account that signs in
+ * on the browser. Measured in Chromium 153 (11/10/2026), before this existed:
+ * the documented `clearCaches("tempest-")` deleted nothing because the recipe's
+ * runtime cache was named `api`, the next account read the previous account's
+ * `GET /api/me` offline, and a mutation queued by the previous account was
+ * replayed with its stored bearer after logout. A prefix filter cannot know the
+ * names a recipe chose, so the default here inverts it: every bucket goes except
+ * the precache, which holds only the build's static assets.
+ *
+ * Cache Storage and IndexedDB are origin storage, readable from the window, so
+ * this needs no message to the worker.
+ *
+ * @param options - Narrow the caches to delete, or name a custom queue.
+ * @returns The caches deleted and whether the queue was cleared.
+ *
+ * @example
+ * import { clearSessionData } from "tempest-react-sdk/sw";
+ *
+ * async function logout() {
+ *     await clearSessionData();
+ * }
+ */
+export declare function clearSessionData(options?: ClearSessionDataOptions): Promise<ClearSessionDataResult>;
+
+/** Options for {@link clearSessionData}. */
+export declare interface ClearSessionDataOptions {
+    /**
+     * Which Cache Storage buckets hold session data. Default: every bucket except
+     * the app-shell precache (`tempest-precache-*`), so the app still launches
+     * offline after logout while no runtime entry — whatever its `cacheName` —
+     * survives into the next session.
+     */
+    caches?: CacheFilter;
+    /** The background-sync `queueName` to clear. Default `tempest-bg-sync`. */
+    queueName?: string;
+}
+
+/** What {@link clearSessionData} removed. */
+export declare interface ClearSessionDataResult {
+    /** Names of the Cache Storage buckets deleted. */
+    caches: string[];
+    /** Whether the background-sync queue was emptied. */
+    queueCleared: boolean;
+}
+
 /**
  * Build a `206 Partial Content` response from a full one for an HTTP `Range`
  * request. Supports `bytes=start-end`, open-ended `bytes=start-` and suffix
- * `bytes=-suffixLength`. Returns the original response when there is no usable
+ * `bytes=-suffixLength` (the last N bytes). Returns the original response when there is no usable
  * `Range` header, or a `416` when the range is unsatisfiable.
  *
  * @param request The incoming request (its `Range` header drives the slice).
@@ -40,6 +177,19 @@ export declare function clearCaches(filter?: CacheFilter): Promise<string[]>;
  */
 export declare function createPartialResponse(request: Request, response: Response): Promise<Response>;
 
+/**
+ * Header names treated as credentials by the service-worker helpers: never
+ * persisted by `installBackgroundSync`, and a request carrying any of them
+ * bypasses `installRuntimeCache` unless the route opts in. `Cookie` and
+ * `Proxy-Authorization` are listed for completeness although the browser
+ * forbids scripts from setting them — a cookie session is invisible to the
+ * worker. The runtime cache therefore depends on `Cache-Control` and
+ * `clearSessionData()`; the background-sync queue checks the entry's owner
+ * through `getPrincipal` whether or not a credential header was stripped, and
+ * `clearSessionData()` still backs that check up.
+ */
+export declare const DEFAULT_CREDENTIAL_HEADERS: readonly string[];
+
 /**
  * Report entry counts (and optionally byte sizes) for the Cache Storage
  * buckets whose name passes `filter`.
@@ -60,9 +210,17 @@ export declare function inspectCaches(options?: {
 
 /**
  * Install the background-sync queue: on a failed mutating request, the request
- * is serialized to IndexedDB and a sync is registered; the original fetch still
- * rejects (so your app can show an offline state), and the request is replayed
- * later when the network returns.
+ * is serialized to IndexedDB (without its credential headers) and a sync is
+ * registered; the original fetch still rejects (so your app can show an offline
+ * state), and the request is replayed later when the network returns.
+ *
+ * Right after queueing, the worker asks the page that issued the request who is
+ * signed in (`getPrincipal` on {@link provideBackgroundSyncCredentials}) and
+ * stamps the entry with that owner, without delaying the rejection. The work is
+ * handed to `event.waitUntil` synchronously, so the worker stays alive for it
+ * in every engine. Without the Background Sync API (every non-Chromium
+ * browser), the queue is drained opportunistically whenever a `GET` goes
+ * through the worker.
  *
  * @tempest-limits empty-catch — `registration.sync.register` is unavailable on
  * every non-Chromium browser and fails on a revoked background-sync permission.
@@ -72,20 +230,6 @@ export declare function inspectCaches(options?: {
  */
 export declare function installBackgroundSync(options?: InstallBackgroundSyncOptions): void;
 
-/**
- * Background-sync helper: queue failed mutating requests (POST/PUT/PATCH/DELETE)
- * while offline and replay them when connectivity returns. A dependency-free
- * take on Workbox's `BackgroundSyncPlugin`, backed by a tiny IndexedDB queue.
- *
- * Import inside your `sw.ts`. Uses the Background Sync API (`registration.sync`)
- * when available, and also replays opportunistically on the next request as a
- * fallback for browsers without it (e.g. Safari).
- *
- * @example
- *   import { installBackgroundSync } from "tempest-react-sdk/sw";
- *
- *   installBackgroundSync({ match: (url) => url.pathname.startsWith("/api/") });
- */
 /** Options for {@link installBackgroundSync}. */
 export declare interface InstallBackgroundSyncOptions {
     /**
@@ -105,6 +249,57 @@ export declare interface InstallBackgroundSyncOptions {
      * thread with {@link registerPeriodicSync}. Default `${queueName}-periodic`.
      */
     periodicSyncTag?: string;
+    /**
+     * Header names stripped before a request is persisted — and stripped again on
+     * replay, so entries written by an older version never go out with the
+     * credential they stored. Default {@link DEFAULT_CREDENTIAL_HEADERS}; extend it
+     * for a custom credential header (`[...DEFAULT_CREDENTIAL_HEADERS,
+     * "x-tenant-key"]`). Passing `[]` restores the pre-0.77 behavior of
+     * persisting and replaying every header, credentials included.
+     */
+    credentialHeaders?: readonly string[];
+    /**
+     * Prepare each queued request right before it is replayed: return the
+     * request to send (typically with the current credentials applied) or
+     * `null` to drop the entry for good. A thrown error keeps the entry pending.
+     * The context carries the entry's owner, so a custom hook can apply the
+     * same rule as the default.
+     *
+     * Default: only an `"unbound"` entry with no stripped credentials (and, under
+     * `ownerPolicy: "lenient"`, an `"unknown"` one) is replayed as-is, without
+     * asking. Every other entry — credentialed or not —
+     * asks every open window client in parallel (see
+     * {@link provideBackgroundSyncCredentials}) and picks the answer that fits:
+     * - `"bound"`: the answer whose owner matches; none among valid answers →
+     *   dropped, never sent anonymously or as somebody else;
+     * - `"unknown"`: only when every answer lacks a principal (an app that does
+     *   not use `getPrincipal`); a single answer with one → dropped, since a
+     *   stale tab without `getPrincipal` says nothing about who is signed in
+     *   next to it. This holds for an entry
+     *   with no credential header too, since the browser attaches the cookies of
+     *   whoever is signed in at replay time;
+     * - `"unbound"`: any answer, preferring one without a principal.
+     * Then `null` headers drop a credentialed entry, an answer that lacks one of
+     * the stripped headers keeps it pending, and only the stripped names are
+     * re-applied. No valid answer at all keeps it pending until
+     * `maxRetentionMinutes` (and warns once per replay in development builds) —
+     * so a page that never calls {@link provideBackgroundSyncCredentials} leaves
+     * every entry it queued `"unknown"`, and none of them is replayed.
+     */
+    /**
+     * How an `"unknown"` owner is handled on an entry with no stripped
+     * credentials (see {@link BackgroundSyncOwnerPolicy}). Default `"strict"`.
+     *
+     * `"lenient"` restores the replay-as-is of 0.77.0 and earlier for an app without sign-in,
+     * where no page ever reports a principal. Do not use it with a cookie
+     * session: the browser attaches on replay the cookie of whoever is signed in
+     * at that moment, so a mutation queued by A whose owner was never stamped
+     * (issuing tab closed, empty `clientId`, stamp lost, legacy entry) goes out
+     * with B's session. Entries with stripped credentials ask the pages either
+     * way. Ignored when a custom `beforeReplay` is given.
+     */
+    ownerPolicy?: BackgroundSyncOwnerPolicy;
+    beforeReplay?: (request: Request, context: BackgroundSyncReplayContext) => Request | null | Promise<Request | null>;
 }
 
 /**
@@ -190,6 +385,14 @@ export declare interface InstallPushHandlerOptions {
  * given runtime strategies. Non-matching requests are left untouched (no
  * `respondWith`), so a later {@link installPrecache} can handle them.
  *
+ * A request carrying a credential header (`Authorization`, `X-Api-Key`, … — the
+ * route's `credentialHeaders`) is also left untouched unless its route sets
+ * `cacheAuthenticated`, and a response with `Cache-Control: no-store`
+ * (or `private`, without that opt-in) is served but never stored. `maxAgeSeconds`
+ * applies to every read, including the offline fallback: an expired entry is a
+ * miss, never a last resort. Under `rangeRequests`, the full resource is cached
+ * once (the `Range` header stripped) and each range is sliced from it.
+ *
  * Register this BEFORE `installPrecache` so specific routes win over the
  * precache catch-all.
  *
@@ -203,6 +406,57 @@ export declare function installRuntimeCache(routes: RuntimeRoute[]): void;
  */
 export declare function installSkipWaitingListener(): void;
 
+/**
+ * Answer the worker's questions about queued requests (see `beforeReplay` on
+ * {@link installBackgroundSync}). Install it once in every page, next to your
+ * auth setup; it reads the token at replay time, so the queue never has to store
+ * it. Without it, a queued request that carried a credential header is never
+ * replayed.
+ *
+ * `getHeaders` must return **every** credential header the app sends (the worker
+ * keeps an entry pending when one it stripped is missing), or `null` when there
+ * is no session — the worker then drops the entry instead of replaying it
+ * anonymously. A throw from `getHeaders` or `getPrincipal` is answered as an
+ * explicit `{ error: true }`. The worker only applies headers whose names the
+ * original request carried, so returning `Authorization` for every URL never
+ * leaks it to a URL that did not receive it in the first place.
+ *
+ * Pass `getPrincipal` to bind each entry to whoever queued it: the worker asks
+ * the issuing tab right after queueing, asks every tab again before replaying,
+ * and drops the entry when no signed-in tab is its owner.
+ *
+ * @param getHeaders - Resolves the headers for one queued request at replay.
+ * @param options - `getPrincipal` binds entries to their owner.
+ * @returns A function that removes the listener. A no-op outside the browser.
+ *
+ * @example
+ * import { provideBackgroundSyncCredentials } from "tempest-react-sdk/sw";
+ *
+ * const stop = provideBackgroundSyncCredentials(
+ *     () => {
+ *         const token = localStorage.getItem("token");
+ *         return token ? { Authorization: `Bearer ${token}` } : null;
+ *     },
+ *     { getPrincipal: () => localStorage.getItem("userId") },
+ * );
+ */
+export declare function provideBackgroundSyncCredentials(getHeaders: BackgroundSyncCredentialsProvider, options?: ProvideBackgroundSyncCredentialsOptions): () => void;
+
+/** Options for {@link provideBackgroundSyncCredentials}. */
+export declare interface ProvideBackgroundSyncCredentialsOptions {
+    /**
+     * Who is signed in right now — a stable, non-secret id such as the user id;
+     * `null`/`undefined` when nobody is. Read when a request is queued and again
+     * when it is replayed: an entry is only sent while the same principal is
+     * signed in, and dropped otherwise, so a mutation queued by one account is
+     * never sent with another account's credentials even when the app forgets
+     * `clearSessionData()` on logout. Only a SHA-256 fingerprint reaches the
+     * queue, never the value itself. A throw is answered as an explicit error,
+     * which leaves the owner unknown (fail closed).
+     */
+    getPrincipal?: () => string | null | undefined | Promise<string | null | undefined>;
+}
+
 /**
  * Service-worker context helpers for handling `push` and `notificationclick`
  * events. Import these inside your own `sw.ts` — they expect to run in the
@@ -390,6 +644,38 @@ export declare interface RuntimeRoute {
      * resource is cached once (the `Range` header is stripped before caching).
      */
     rangeRequests?: boolean;
+    /**
+     * Opt in to caching requests that carry a credential header (see
+     * `credentialHeaders`), and responses marked `Cache-Control: private`.
+     * Default `false`.
+     *
+     * Cache Storage is keyed by URL and outlives the session: without this
+     * gate, a `GET /api/me` stored for one account was served to the next
+     * account on the same browser whenever the network failed or exceeded
+     * `networkTimeoutSeconds` (reproduced in Chromium 153, 11/10/2026). With
+     * the default, credentialed requests bypass the route entirely and reach
+     * the network as if no service worker were installed.
+     *
+     * When enabled, every stored entry gets `Vary` on each credential header the
+     * request carried, so the Cache API only matches it for the same credential —
+     * another account (or no account) misses instead of reading it. A token
+     * rotated while online simply repopulates the entry. Pair it with
+     * `clearSessionData()` on logout, which removes the entries themselves.
+     * `Cache-Control: no-store` is never cached, opt-in or not.
+     *
+     * A cookie session is invisible here: the worker cannot see `Cookie`, and
+     * gating on `request.credentials` would switch off caching for every
+     * same-origin image and font. A cookie-authenticated API stays private only
+     * through `Cache-Control: private`/`no-store` on its responses and
+     * `clearSessionData()` on logout.
+     */
+    cacheAuthenticated?: boolean;
+    /**
+     * Header names that mark a request as credentialed. Default
+     * `DEFAULT_CREDENTIAL_HEADERS` (`authorization`, `x-api-key`,
+     * `x-auth-token`, …) — the same list the background-sync queue strips.
+     */
+    credentialHeaders?: readonly string[];
 }
 
 /**
@@ -414,7 +700,7 @@ export declare interface RuntimeRoute {
  *
  *   // Register specific routes FIRST so they win over the precache catch-all.
  *   installRuntimeCache([
- *     { match: /\/api\//, strategy: "network-first", cacheName: "api", maxAgeSeconds: 300 },
+ *     { match: /\/api\//, strategy: "network-first", cacheName: "tempest-api", maxAgeSeconds: 300 },
  *   ]);
  *   installPrecache();
  */