tempest-react-sdk 0.77.0 → 0.79.0

package/dist/logger/logger.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"logger.cjs","names":[],"sources":["../../src/logger/logger.ts"],"sourcesContent":["export type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\nexport interface LogEntry {\n    level: LogLevel;\n    message: string;\n    context?: Record<string, unknown>;\n    timestamp: number;\n}\n\nexport interface LoggerSink {\n    (entry: LogEntry): void;\n}\n\nexport interface Logger {\n    debug: (message: string, context?: Record<string, unknown>) => void;\n    info: (message: string, context?: Record<string, unknown>) => void;\n    warn: (message: string, context?: Record<string, unknown>) => void;\n    error: (message: string, context?: Record<string, unknown>) => void;\n    /** Build a child logger that prefixes the namespace to each message. */\n    child: (namespace: string) => Logger;\n}\n\nexport interface CreateLoggerOptions {\n    /** Lowest level recorded. Default: `\"info\"`. */\n    level?: LogLevel;\n    /** Output adapters. Default: a `console.*` sink. */\n    sinks?: LoggerSink[];\n    /** Initial namespace (prepended to every message). */\n    namespace?: string;\n}\n\nconst LEVELS: LogLevel[] = [\"debug\", \"info\", \"warn\", \"error\"];\n\nfunction shouldLog(threshold: LogLevel, level: LogLevel): boolean {\n    return LEVELS.indexOf(level) >= LEVELS.indexOf(threshold);\n}\n\n/** Default sink that writes to the browser console. */\nexport const consoleSink: LoggerSink = ({ level, message, context }) => {\n    const method = level === \"debug\" ? \"log\" : level;\n    if (context) {\n        console[method](message, context);\n    } else {\n        console[method](message);\n    }\n};\n\n/**\n * Create a structured leveled logger. Plug arbitrary sinks (Sentry, Datadog,\n * remote ingestion) by implementing the `LoggerSink` interface.\n *\n * @tempest-limits empty-catch — a sink that throws must not take the app with it,\n * and it must not stop the sinks after it in the list either. Logging is the thing\n * you reach for when something is already going wrong; a transport failure that\n * propagates would turn a diagnostic into the outage. Nothing here can report the\n * failure without recursing into the logger that just failed.\n */\nexport function createLogger(options: CreateLoggerOptions = {}): Logger {\n    const threshold = options.level ?? \"info\";\n    const sinks = options.sinks ?? [consoleSink];\n    const namespace = options.namespace ?? \"\";\n\n    function emit(level: LogLevel, message: string, context?: Record<string, unknown>): void {\n        if (!shouldLog(threshold, level)) return;\n        const entry: LogEntry = {\n            level,\n            message: namespace ? `[${namespace}] ${message}` : message,\n            context,\n            timestamp: Date.now(),\n        };\n        for (const sink of sinks) {\n            try {\n                sink(entry);\n            } catch {\n                /* empty */\n            }\n        }\n    }\n\n    return {\n        debug: (message, context) => emit(\"debug\", message, context),\n        info: (message, context) => emit(\"info\", message, context),\n        warn: (message, context) => emit(\"warn\", message, context),\n        error: (message, context) => emit(\"error\", message, context),\n        child: (childNamespace: string) =>\n            createLogger({\n                level: threshold,\n                sinks,\n                namespace: namespace ? `${namespace}:${childNamespace}` : childNamespace,\n            }),\n    };\n}\n"],"mappings":"AA+BA,IAAM,EAAqB,CAAC,QAAS,OAAQ,OAAQ,OAAO,EAE5D,SAAS,EAAU,EAAqB,EAA0B,CAC9D,OAAO,EAAO,QAAQ,CAAK,GAAK,EAAO,QAAQ,CAAS,CAC5D,CAGA,IAAa,GAA2B,CAAE,QAAO,UAAS,aAAc,CACpE,IAAM,EAAS,IAAU,QAAU,MAAQ,EACvC,EACA,QAAQ,EAAO,CAAC,EAAS,CAAO,EAEhC,QAAQ,EAAO,CAAC,CAAO,CAE/B,EAYA,SAAgB,EAAa,EAA+B,CAAC,EAAW,CACpE,IAAM,EAAY,EAAQ,OAAS,OAC7B,EAAQ,EAAQ,OAAS,CAAC,CAAW,EACrC,EAAY,EAAQ,WAAa,GAEvC,SAAS,EAAK,EAAiB,EAAiB,EAAyC,CACrF,GAAI,CAAC,EAAU,EAAW,CAAK,EAAG,OAClC,IAAM,EAAkB,CACpB,QACA,QAAS,EAAY,IAAI,EAAU,IAAI,IAAY,EACnD,UACA,UAAW,KAAK,IAAI,CACxB,EACA,IAAK,IAAM,KAAQ,EACf,GAAI,CACA,EAAK,CAAK,CACd,MAAQ,CAER,CAER,CAEA,MAAO,CACH,OAAQ,EAAS,IAAY,EAAK,QAAS,EAAS,CAAO,EAC3D,MAAO,EAAS,IAAY,EAAK,OAAQ,EAAS,CAAO,EACzD,MAAO,EAAS,IAAY,EAAK,OAAQ,EAAS,CAAO,EACzD,OAAQ,EAAS,IAAY,EAAK,QAAS,EAAS,CAAO,EAC3D,MAAQ,GACJ,EAAa,CACT,MAAO,EACP,QACA,UAAW,EAAY,GAAG,EAAU,GAAG,IAAmB,CAC9D,CAAC,CACT,CACJ"}
+{"version":3,"file":"logger.cjs","names":["LEVELS","shouldLog","level","threshold","consoleSink","method","context","message","createLogger","options","sinks","namespace","emit","entry","sink","childNamespace"],"sources":["../../src/logger/logger.ts"],"sourcesContent":["export type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\nexport interface LogEntry {\n    level: LogLevel;\n    message: string;\n    context?: Record<string, unknown>;\n    timestamp: number;\n}\n\nexport interface LoggerSink {\n    (entry: LogEntry): void;\n}\n\nexport interface Logger {\n    debug: (message: string, context?: Record<string, unknown>) => void;\n    info: (message: string, context?: Record<string, unknown>) => void;\n    warn: (message: string, context?: Record<string, unknown>) => void;\n    error: (message: string, context?: Record<string, unknown>) => void;\n    /** Build a child logger that prefixes the namespace to each message. */\n    child: (namespace: string) => Logger;\n}\n\nexport interface CreateLoggerOptions {\n    /** Lowest level recorded. Default: `\"info\"`. */\n    level?: LogLevel;\n    /** Output adapters. Default: a `console.*` sink. */\n    sinks?: LoggerSink[];\n    /** Initial namespace (prepended to every message). */\n    namespace?: string;\n}\n\nconst LEVELS: LogLevel[] = [\"debug\", \"info\", \"warn\", \"error\"];\n\nfunction shouldLog(threshold: LogLevel, level: LogLevel): boolean {\n    return LEVELS.indexOf(level) >= LEVELS.indexOf(threshold);\n}\n\n/** Default sink that writes to the browser console. */\nexport const consoleSink: LoggerSink = ({ level, message, context }) => {\n    const method = level === \"debug\" ? \"log\" : level;\n    if (context) {\n        console[method](message, context);\n    } else {\n        console[method](message);\n    }\n};\n\n/**\n * Create a structured leveled logger. Plug arbitrary sinks (Sentry, Datadog,\n * remote ingestion) by implementing the `LoggerSink` interface.\n *\n * @tempest-limits empty-catch — a sink that throws must not take the app with it,\n * and it must not stop the sinks after it in the list either. Logging is the thing\n * you reach for when something is already going wrong; a transport failure that\n * propagates would turn a diagnostic into the outage. Nothing here can report the\n * failure without recursing into the logger that just failed.\n */\nexport function createLogger(options: CreateLoggerOptions = {}): Logger {\n    const threshold = options.level ?? \"info\";\n    const sinks = options.sinks ?? [consoleSink];\n    const namespace = options.namespace ?? \"\";\n\n    function emit(level: LogLevel, message: string, context?: Record<string, unknown>): void {\n        if (!shouldLog(threshold, level)) return;\n        const entry: LogEntry = {\n            level,\n            message: namespace ? `[${namespace}] ${message}` : message,\n            context,\n            timestamp: Date.now(),\n        };\n        for (const sink of sinks) {\n            try {\n                sink(entry);\n            } catch {\n                /* empty */\n            }\n        }\n    }\n\n    return {\n        debug: (message, context) => emit(\"debug\", message, context),\n        info: (message, context) => emit(\"info\", message, context),\n        warn: (message, context) => emit(\"warn\", message, context),\n        error: (message, context) => emit(\"error\", message, context),\n        child: (childNamespace: string) =>\n            createLogger({\n                level: threshold,\n                sinks,\n                namespace: namespace ? `${namespace}:${childNamespace}` : childNamespace,\n            }),\n    };\n}\n"],"mappings":"AA+BA,IAAMA,EAAqB,CAAC,QAAS,OAAQ,OAAQ,OAAO,EAE5D,SAASC,EAAU,EAAqB,EAA0B,CAC9D,OAAOD,EAAO,QAAQE,CAAK,GAAKF,EAAO,QAAQG,CAAS,CAC5D,CAGA,IAAaC,GAA2B,CAAE,QAAO,UAAS,aAAc,CACpE,IAAMC,EAASH,IAAU,QAAU,MAAQA,EACvCI,EACA,QAAQD,EAAO,CAACE,EAASD,CAAO,EAEhC,QAAQD,EAAO,CAACE,CAAO,CAE/B,EAYA,SAAgBC,EAAa,EAA+B,CAAC,EAAW,CACpE,IAAML,EAAYM,EAAQ,OAAS,OAC7BC,EAAQD,EAAQ,OAAS,CAACL,CAAW,EACrCO,EAAYF,EAAQ,WAAa,GAEvC,SAASG,EAAK,EAAiB,EAAiB,EAAyC,CACrF,GAAI,CAACX,EAAUE,EAAWD,CAAK,EAAG,OAClC,IAAMW,EAAkB,CACpB,QACA,QAASF,EAAY,IAAIA,EAAU,IAAIJ,IAAYA,EACnD,UACA,UAAW,KAAK,IAAI,CACxB,EACA,IAAK,IAAMO,KAAQJ,EACf,GAAI,CACAI,EAAKD,CAAK,CACd,MAAQ,CAER,CAER,CAEA,MAAO,CACH,OAAQ,EAAS,IAAYD,EAAK,QAASL,EAASD,CAAO,EAC3D,MAAO,EAAS,IAAYM,EAAK,OAAQL,EAASD,CAAO,EACzD,MAAO,EAAS,IAAYM,EAAK,OAAQL,EAASD,CAAO,EACzD,OAAQ,EAAS,IAAYM,EAAK,QAASL,EAASD,CAAO,EAC3D,MAAQ,GACJE,EAAa,CACT,MAAOL,EACP,QACA,UAAWQ,EAAY,GAAGA,EAAU,GAAGI,IAAmBA,CAC9D,CAAC,CACT,CACJ,C"}

package/dist/logger/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","names":[],"sources":["../../src/logger/logger.ts"],"sourcesContent":["export type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\nexport interface LogEntry {\n    level: LogLevel;\n    message: string;\n    context?: Record<string, unknown>;\n    timestamp: number;\n}\n\nexport interface LoggerSink {\n    (entry: LogEntry): void;\n}\n\nexport interface Logger {\n    debug: (message: string, context?: Record<string, unknown>) => void;\n    info: (message: string, context?: Record<string, unknown>) => void;\n    warn: (message: string, context?: Record<string, unknown>) => void;\n    error: (message: string, context?: Record<string, unknown>) => void;\n    /** Build a child logger that prefixes the namespace to each message. */\n    child: (namespace: string) => Logger;\n}\n\nexport interface CreateLoggerOptions {\n    /** Lowest level recorded. Default: `\"info\"`. */\n    level?: LogLevel;\n    /** Output adapters. Default: a `console.*` sink. */\n    sinks?: LoggerSink[];\n    /** Initial namespace (prepended to every message). */\n    namespace?: string;\n}\n\nconst LEVELS: LogLevel[] = [\"debug\", \"info\", \"warn\", \"error\"];\n\nfunction shouldLog(threshold: LogLevel, level: LogLevel): boolean {\n    return LEVELS.indexOf(level) >= LEVELS.indexOf(threshold);\n}\n\n/** Default sink that writes to the browser console. */\nexport const consoleSink: LoggerSink = ({ level, message, context }) => {\n    const method = level === \"debug\" ? \"log\" : level;\n    if (context) {\n        console[method](message, context);\n    } else {\n        console[method](message);\n    }\n};\n\n/**\n * Create a structured leveled logger. Plug arbitrary sinks (Sentry, Datadog,\n * remote ingestion) by implementing the `LoggerSink` interface.\n *\n * @tempest-limits empty-catch — a sink that throws must not take the app with it,\n * and it must not stop the sinks after it in the list either. Logging is the thing\n * you reach for when something is already going wrong; a transport failure that\n * propagates would turn a diagnostic into the outage. Nothing here can report the\n * failure without recursing into the logger that just failed.\n */\nexport function createLogger(options: CreateLoggerOptions = {}): Logger {\n    const threshold = options.level ?? \"info\";\n    const sinks = options.sinks ?? [consoleSink];\n    const namespace = options.namespace ?? \"\";\n\n    function emit(level: LogLevel, message: string, context?: Record<string, unknown>): void {\n        if (!shouldLog(threshold, level)) return;\n        const entry: LogEntry = {\n            level,\n            message: namespace ? `[${namespace}] ${message}` : message,\n            context,\n            timestamp: Date.now(),\n        };\n        for (const sink of sinks) {\n            try {\n                sink(entry);\n            } catch {\n                /* empty */\n            }\n        }\n    }\n\n    return {\n        debug: (message, context) => emit(\"debug\", message, context),\n        info: (message, context) => emit(\"info\", message, context),\n        warn: (message, context) => emit(\"warn\", message, context),\n        error: (message, context) => emit(\"error\", message, context),\n        child: (childNamespace: string) =>\n            createLogger({\n                level: threshold,\n                sinks,\n                namespace: namespace ? `${namespace}:${childNamespace}` : childNamespace,\n            }),\n    };\n}\n"],"mappings":";AA+BA,IAAM,IAAqB;CAAC;CAAS;CAAQ;CAAQ;AAAO;AAE5D,SAAS,EAAU,GAAqB,GAA0B;CAC9D,OAAO,EAAO,QAAQ,CAAK,KAAK,EAAO,QAAQ,CAAS;AAC5D;AAGA,IAAa,KAA2B,EAAE,UAAO,YAAS,iBAAc;CACpE,IAAM,IAAS,MAAU,UAAU,QAAQ;CAC3C,AAAI,IACA,QAAQ,EAAO,CAAC,GAAS,CAAO,IAEhC,QAAQ,EAAO,CAAC,CAAO;AAE/B;AAYA,SAAgB,EAAa,IAA+B,CAAC,GAAW;CACpE,IAAM,IAAY,EAAQ,SAAS,QAC7B,IAAQ,EAAQ,SAAS,CAAC,CAAW,GACrC,IAAY,EAAQ,aAAa;CAEvC,SAAS,EAAK,GAAiB,GAAiB,GAAyC;EACrF,IAAI,CAAC,EAAU,GAAW,CAAK,GAAG;EAClC,IAAM,IAAkB;GACpB;GACA,SAAS,IAAY,IAAI,EAAU,IAAI,MAAY;GACnD;GACA,WAAW,KAAK,IAAI;EACxB;EACA,KAAK,IAAM,KAAQ,GACf,IAAI;GACA,EAAK,CAAK;EACd,QAAQ,CAER;CAER;CAEA,OAAO;EACH,QAAQ,GAAS,MAAY,EAAK,SAAS,GAAS,CAAO;EAC3D,OAAO,GAAS,MAAY,EAAK,QAAQ,GAAS,CAAO;EACzD,OAAO,GAAS,MAAY,EAAK,QAAQ,GAAS,CAAO;EACzD,QAAQ,GAAS,MAAY,EAAK,SAAS,GAAS,CAAO;EAC3D,QAAQ,MACJ,EAAa;GACT,OAAO;GACP;GACA,WAAW,IAAY,GAAG,EAAU,GAAG,MAAmB;EAC9D,CAAC;CACT;AACJ"}
+{"version":3,"file":"logger.js","names":["LEVELS","shouldLog","level","threshold","consoleSink","method","context","message","createLogger","options","sinks","namespace","emit","entry","sink","childNamespace"],"sources":["../../src/logger/logger.ts"],"sourcesContent":["export type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\nexport interface LogEntry {\n    level: LogLevel;\n    message: string;\n    context?: Record<string, unknown>;\n    timestamp: number;\n}\n\nexport interface LoggerSink {\n    (entry: LogEntry): void;\n}\n\nexport interface Logger {\n    debug: (message: string, context?: Record<string, unknown>) => void;\n    info: (message: string, context?: Record<string, unknown>) => void;\n    warn: (message: string, context?: Record<string, unknown>) => void;\n    error: (message: string, context?: Record<string, unknown>) => void;\n    /** Build a child logger that prefixes the namespace to each message. */\n    child: (namespace: string) => Logger;\n}\n\nexport interface CreateLoggerOptions {\n    /** Lowest level recorded. Default: `\"info\"`. */\n    level?: LogLevel;\n    /** Output adapters. Default: a `console.*` sink. */\n    sinks?: LoggerSink[];\n    /** Initial namespace (prepended to every message). */\n    namespace?: string;\n}\n\nconst LEVELS: LogLevel[] = [\"debug\", \"info\", \"warn\", \"error\"];\n\nfunction shouldLog(threshold: LogLevel, level: LogLevel): boolean {\n    return LEVELS.indexOf(level) >= LEVELS.indexOf(threshold);\n}\n\n/** Default sink that writes to the browser console. */\nexport const consoleSink: LoggerSink = ({ level, message, context }) => {\n    const method = level === \"debug\" ? \"log\" : level;\n    if (context) {\n        console[method](message, context);\n    } else {\n        console[method](message);\n    }\n};\n\n/**\n * Create a structured leveled logger. Plug arbitrary sinks (Sentry, Datadog,\n * remote ingestion) by implementing the `LoggerSink` interface.\n *\n * @tempest-limits empty-catch — a sink that throws must not take the app with it,\n * and it must not stop the sinks after it in the list either. Logging is the thing\n * you reach for when something is already going wrong; a transport failure that\n * propagates would turn a diagnostic into the outage. Nothing here can report the\n * failure without recursing into the logger that just failed.\n */\nexport function createLogger(options: CreateLoggerOptions = {}): Logger {\n    const threshold = options.level ?? \"info\";\n    const sinks = options.sinks ?? [consoleSink];\n    const namespace = options.namespace ?? \"\";\n\n    function emit(level: LogLevel, message: string, context?: Record<string, unknown>): void {\n        if (!shouldLog(threshold, level)) return;\n        const entry: LogEntry = {\n            level,\n            message: namespace ? `[${namespace}] ${message}` : message,\n            context,\n            timestamp: Date.now(),\n        };\n        for (const sink of sinks) {\n            try {\n                sink(entry);\n            } catch {\n                /* empty */\n            }\n        }\n    }\n\n    return {\n        debug: (message, context) => emit(\"debug\", message, context),\n        info: (message, context) => emit(\"info\", message, context),\n        warn: (message, context) => emit(\"warn\", message, context),\n        error: (message, context) => emit(\"error\", message, context),\n        child: (childNamespace: string) =>\n            createLogger({\n                level: threshold,\n                sinks,\n                namespace: namespace ? `${namespace}:${childNamespace}` : childNamespace,\n            }),\n    };\n}\n"],"mappings":";AA+BA,IAAMA,IAAqB;CAAC;CAAS;CAAQ;CAAQ;AAAO;AAE5D,SAASC,EAAU,GAAqB,GAA0B;CAC9D,OAAOD,EAAO,QAAQE,CAAK,KAAKF,EAAO,QAAQG,CAAS;AAC5D;AAGA,IAAaC,KAA2B,EAAE,UAAO,YAAS,iBAAc;CACpE,IAAMC,IAASH,MAAU,UAAU,QAAQA;CAC3C,AAAII,IACA,QAAQD,EAAO,CAACE,GAASD,CAAO,IAEhC,QAAQD,EAAO,CAACE,CAAO;AAE/B;AAYA,SAAgBC,EAAa,IAA+B,CAAC,GAAW;CACpE,IAAML,IAAYM,EAAQ,SAAS,QAC7BC,IAAQD,EAAQ,SAAS,CAACL,CAAW,GACrCO,IAAYF,EAAQ,aAAa;CAEvC,SAASG,EAAK,GAAiB,GAAiB,GAAyC;EACrF,IAAI,CAACX,EAAUE,GAAWD,CAAK,GAAG;EAClC,IAAMW,IAAkB;GACpB;GACA,SAASF,IAAY,IAAIA,EAAU,IAAIJ,MAAYA;GACnD;GACA,WAAW,KAAK,IAAI;EACxB;EACA,KAAK,IAAMO,KAAQJ,GACf,IAAI;GACA,EAAKG,CAAK;EACd,QAAQ,CAER;CAER;CAEA,OAAO;EACH,QAAQ,GAAS,MAAYD,EAAK,SAASL,GAASD,CAAO;EAC3D,OAAO,GAAS,MAAYM,EAAK,QAAQL,GAASD,CAAO;EACzD,OAAO,GAAS,MAAYM,EAAK,QAAQL,GAASD,CAAO;EACzD,QAAQ,GAAS,MAAYM,EAAK,SAASL,GAASD,CAAO;EAC3D,QAAQ,MACJE,EAAa;GACT,OAAOL;GACP;GACA,WAAWQ,IAAY,GAAGA,EAAU,GAAGI,MAAmBA;EAC9D,CAAC;CACT;AACJ"}

package/dist/neural.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"neural.cjs","names":[],"sources":["../src/neural/index.ts"],"sourcesContent":["import { RnnoiseWorkletNode, loadRnnoise } from \"@sapphi-red/web-noise-suppressor\";\n\n/**\n * Where the suppressor's three pieces live, as URLs a bundler hands over.\n *\n * The `@sapphi-red/web-noise-suppressor` package ships the runnable assets next\n * to its code, but it cannot say where they are from inside a library: the\n * `?url` suffix that resolves a module to its served address is a bundler\n * feature, and every bundler answers it differently. So this subpath takes the\n * three resolved addresses as arguments and does the honest part — the graph,\n * the load-once semantics, the per-context registration — here.\n */\nexport interface NeuralSuppressorAssets {\n    /**\n     * The `AudioWorklet` processor module the model runs its DSP in\n     * (`rnnoiseWorklet.js`).\n     */\n    workletUrl: string;\n    /** The SIMD build of the model's wasm (`rnnoise_simd.wasm`). */\n    simdWasmUrl: string;\n    /** The baseline build, used where the engine lacks SIMD (`rnnoise.wasm`). */\n    wasmUrl: string;\n}\n\n/**\n * Whether this browser can run a worklet-based noise suppressor.\n *\n * Answered from the two things the path needs that nothing but the platform can\n * supply: `AudioWorkletNode` runs custom DSP on the audio thread, and a secure\n * context is what the browser requires before letting a module near the\n * microphone graph. Everything else — the models, the wasm — ships with the\n * caller, so it cannot be missing. The context must also run at 48 kHz, which\n * is checked at build time rather than here because the caller owns how its\n * context was opened.\n *\n * Deliberately conservative: anything it cannot establish answers `false`, and\n * a `false` sends the caller back to the browser's own `noiseSuppression`\n * constraint, which is weaker but always there.\n *\n * @returns True when a neural suppressor can be built on top of a capture.\n */\nexport function isNeuralSuppressionSupported(): boolean {\n    return (\n        typeof AudioWorkletNode !== \"undefined\" &&\n        typeof window !== \"undefined\" &&\n        window.isSecureContext\n    );\n}\n\n/**\n * The one wasm binary every suppressor shares, fetched once.\n *\n * `loadRnnoise` compiles the whole model, and the answer is identical for every\n * graph that opens afterwards — a mesh can build a suppressor per published\n * track and a settings dialog may build a second for its monitor within a\n * single frame. Held as the promise rather than the result so the first two\n * callers race into one fetch instead of two. Reset on failure, so the next\n * call retries instead of replaying a dead promise.\n */\nlet loadingBinary: Promise<ArrayBuffer> | null = null;\n\n/**\n * The contexts the worklet module has already been registered on, mapped to the\n * registration's own promise.\n *\n * `addModule` is per-context and throws on a name it already holds, so the\n * module records the moment a context is ready and skips the call next time.\n * The promise is what makes a fast caller that cannot wait — a mesh can open a\n * microphone and a preview within a single frame — race into one `addModule`\n * instead of two: had this been a set, the second caller would see the context\n * absent while the first was still awaiting and register the module twice.\n * Mapped to a promise rather than the module itself the way the wasm is,\n * because the registration belongs to one context while the wasm is shared,\n * and nothing here should keep a dead context alive — the value is dropped\n * with the context. On failure the entry is removed, so the next attempt\n * actually retries instead of replaying the broken registration.\n */\nconst readyContexts = new WeakMap<AudioContext, Promise<void>>();\n\n/**\n * The compiled model for this context, loading what is not ready yet.\n *\n * Idempotent across calls: the wasm fetch and the module registration both\n * happen exactly once. The wasm is shared by every suppressor, while the module\n * registration belongs to one context.\n *\n * @param context - The context the suppression graph will run in.\n * @param assets - The resolved asset addresses from {@link NeuralSuppressorAssets}.\n * @returns The compiled model binary, ready to hand to a worklet node.\n * @throws Whatever the fetch or the compile threw, for the caller to fall back on.\n */\nexport async function prepareNeuralSuppressor(\n    context: AudioContext,\n    assets: NeuralSuppressorAssets,\n): Promise<ArrayBuffer> {\n    let ready = readyContexts.get(context);\n    if (!ready) {\n        ready = context.audioWorklet.addModule(assets.workletUrl).then(\n            () => undefined,\n            (error: unknown) => {\n                readyContexts.delete(context);\n                throw error;\n            },\n        );\n        readyContexts.set(context, ready);\n    }\n    await ready;\n    if (loadingBinary === null) {\n        loadingBinary = loadRnnoise({ url: assets.wasmUrl, simdUrl: assets.simdWasmUrl }).catch(\n            (error: unknown) => {\n                loadingBinary = null;\n                throw error;\n            },\n        );\n    }\n    return loadingBinary;\n}\n\n/**\n * A denoised track plus the graph that has to come down with it.\n *\n * `track` is not the captured one — it is the output of a `MediaStream`\n * destination the worklet feeds — so stopping the published track is not enough\n * to free the microphone. `release` closes the graph; the captured track behind\n * it belongs to the caller.\n */\nexport interface NeuralSuppressor {\n    /** The track to publish in place of the captured one. */\n    track: MediaStreamTrack;\n    /** Tears the graph down. Does not stop the source track it was built from. */\n    release(): void;\n}\n\n/**\n * Build a suppressor graph on top of a captured microphone track.\n *\n * The model runs on the audio thread through an `AudioWorkletNode` — a\n * recurrent network trained on speech that separates a voice from everything\n * that is not one: keyboards, fans, traffic, a room full of people. The\n * browser's `noiseSuppression` constraint answers the same question with a\n * stationary-noise gate that either lets a transient through or eats the voice\n * with it.\n *\n * Prefer {@link prepareNeuralSuppressor} before the capture opens: the fallback\n * to the browser's own suppression is a `getUserMedia` constraint, and a\n * constraint cannot be added to a capture that already exists. A caller that\n * did not preload still works — the load happens here, idempotently.\n *\n * The model assumes 48 kHz. A context opened at any other rate answers `null`\n * before anything is fetched, because feeding speech samples of the wrong rate\n * into a network trained on 48 kHz produces mush, not a voice.\n *\n * Failure is not fatal and is reported as `null` — whether the wasm would not\n * load or the worklet node could not be built: by the time this runs the caller\n * has already committed to the neural path, so the honest outcome is a call\n * without suppression rather than a microphone that will not open. {@link\n * prepareNeuralSuppressor}, which exists to be called *before* the capture,\n * still throws so the caller can pick a different fallback while one is\n * reachable.\n *\n * @param context - The shared context, prepared at 48 kHz.\n * @param source - The captured microphone track.\n * @param assets - The resolved asset addresses from {@link NeuralSuppressorAssets}.\n * @param options - `maxChannels` is the channel count of the capture; the model\n *   is mono, and a stereo capture asks for two so a second channel is not lost.\n * @returns The denoised track and its teardown, or `null` when this context or\n *   this graph cannot host the suppressor.\n */\nexport async function createNeuralSuppressor(\n    context: AudioContext,\n    source: MediaStreamTrack,\n    assets: NeuralSuppressorAssets,\n    options: { maxChannels: number },\n): Promise<NeuralSuppressor | null> {\n    if (context.sampleRate !== 48_000) return null;\n\n    let binary: ArrayBuffer;\n    try {\n        binary = await prepareNeuralSuppressor(context, assets);\n    } catch {\n        return null;\n    }\n\n    let node: RnnoiseWorkletNode;\n    try {\n        node = new RnnoiseWorkletNode(context, {\n            maxChannels: options.maxChannels,\n            wasmBinary: binary,\n        });\n    } catch {\n        return null;\n    }\n\n    const input = context.createMediaStreamSource(new MediaStream([source]));\n    const output = context.createMediaStreamDestination();\n    input.connect(node);\n    node.connect(output);\n\n    const track = output.stream.getAudioTracks()[0];\n    if (!track) {\n        input.disconnect();\n        node.disconnect();\n        output.disconnect();\n        node.destroy();\n        return null;\n    }\n    track.contentHint = source.contentHint;\n\n    return {\n        track,\n        release: () => {\n            input.disconnect();\n            node.disconnect();\n            output.disconnect();\n            node.destroy();\n            track.stop();\n        },\n    };\n}\n"],"mappings":"qHAyCA,SAAgB,GAAwC,CACpD,OACI,OAAO,iBAAqB,KAC5B,OAAO,OAAW,KAClB,OAAO,eAEf,CAYA,IAAI,EAA6C,KAkB3C,EAAgB,IAAI,QAc1B,eAAsB,EAClB,EACA,EACoB,CACpB,IAAI,EAAQ,EAAc,IAAI,CAAO,EAoBrC,OAnBK,IACD,EAAQ,EAAQ,aAAa,UAAU,EAAO,UAAU,CAAC,CAAC,SAChD,IAAA,GACL,GAAmB,CAEhB,MADA,EAAc,OAAO,CAAO,EACtB,CACV,CACJ,EACA,EAAc,IAAI,EAAS,CAAK,GAEpC,MAAM,EACF,IAAkB,OAClB,GAAA,EAAgB,EAAA,YAAA,CAAY,CAAE,IAAK,EAAO,QAAS,QAAS,EAAO,WAAY,CAAC,CAAC,CAAC,MAC7E,GAAmB,CAEhB,KADA,GAAgB,KACV,CACV,CACJ,GAEG,CACX,CAoDA,eAAsB,EAClB,EACA,EACA,EACA,EACgC,CAChC,GAAI,EAAQ,aAAe,KAAQ,OAAO,KAE1C,IAAI,EACJ,GAAI,CACA,EAAS,MAAM,EAAwB,EAAS,CAAM,CAC1D,MAAQ,CACJ,OAAO,IACX,CAEA,IAAI,EACJ,GAAI,CACA,EAAO,IAAI,EAAA,mBAAmB,EAAS,CACnC,YAAa,EAAQ,YACrB,WAAY,CAChB,CAAC,CACL,MAAQ,CACJ,OAAO,IACX,CAEA,IAAM,EAAQ,EAAQ,wBAAwB,IAAI,YAAY,CAAC,CAAM,CAAC,CAAC,EACjE,EAAS,EAAQ,6BAA6B,EACpD,EAAM,QAAQ,CAAI,EAClB,EAAK,QAAQ,CAAM,EAEnB,IAAM,EAAQ,EAAO,OAAO,eAAe,CAAC,CAAC,GAU7C,OATK,GAOL,EAAM,YAAc,EAAO,YAEpB,CACH,QACA,YAAe,CACX,EAAM,WAAW,EACjB,EAAK,WAAW,EAChB,EAAO,WAAW,EAClB,EAAK,QAAQ,EACb,EAAM,KAAK,CACf,CACJ,IAjBI,EAAM,WAAW,EACjB,EAAK,WAAW,EAChB,EAAO,WAAW,EAClB,EAAK,QAAQ,EACN,KAcf"}
+{"version":3,"file":"neural.cjs","names":["loadRnnoise","RnnoiseWorkletNode","_sapphi_red_web_noise_suppressor","isNeuralSuppressionSupported","loadingBinary","readyContexts","prepareNeuralSuppressor","ready","context","assets","error","createNeuralSuppressor","binary","node","options","input","source","output","track"],"sources":["../src/neural/index.ts"],"sourcesContent":["import { RnnoiseWorkletNode, loadRnnoise } from \"@sapphi-red/web-noise-suppressor\";\n\n/**\n * Where the suppressor's three pieces live, as URLs a bundler hands over.\n *\n * The `@sapphi-red/web-noise-suppressor` package ships the runnable assets next\n * to its code, but it cannot say where they are from inside a library: the\n * `?url` suffix that resolves a module to its served address is a bundler\n * feature, and every bundler answers it differently. So this subpath takes the\n * three resolved addresses as arguments and does the honest part — the graph,\n * the load-once semantics, the per-context registration — here.\n */\nexport interface NeuralSuppressorAssets {\n    /**\n     * The `AudioWorklet` processor module the model runs its DSP in\n     * (`rnnoiseWorklet.js`).\n     */\n    workletUrl: string;\n    /** The SIMD build of the model's wasm (`rnnoise_simd.wasm`). */\n    simdWasmUrl: string;\n    /** The baseline build, used where the engine lacks SIMD (`rnnoise.wasm`). */\n    wasmUrl: string;\n}\n\n/**\n * Whether this browser can run a worklet-based noise suppressor.\n *\n * Answered from the two things the path needs that nothing but the platform can\n * supply: `AudioWorkletNode` runs custom DSP on the audio thread, and a secure\n * context is what the browser requires before letting a module near the\n * microphone graph. Everything else — the models, the wasm — ships with the\n * caller, so it cannot be missing. The context must also run at 48 kHz, which\n * is checked at build time rather than here because the caller owns how its\n * context was opened.\n *\n * Deliberately conservative: anything it cannot establish answers `false`, and\n * a `false` sends the caller back to the browser's own `noiseSuppression`\n * constraint, which is weaker but always there.\n *\n * @returns True when a neural suppressor can be built on top of a capture.\n */\nexport function isNeuralSuppressionSupported(): boolean {\n    return (\n        typeof AudioWorkletNode !== \"undefined\" &&\n        typeof window !== \"undefined\" &&\n        window.isSecureContext\n    );\n}\n\n/**\n * The one wasm binary every suppressor shares, fetched once.\n *\n * `loadRnnoise` compiles the whole model, and the answer is identical for every\n * graph that opens afterwards — a mesh can build a suppressor per published\n * track and a settings dialog may build a second for its monitor within a\n * single frame. Held as the promise rather than the result so the first two\n * callers race into one fetch instead of two. Reset on failure, so the next\n * call retries instead of replaying a dead promise.\n */\nlet loadingBinary: Promise<ArrayBuffer> | null = null;\n\n/**\n * The contexts the worklet module has already been registered on, mapped to the\n * registration's own promise.\n *\n * `addModule` is per-context and throws on a name it already holds, so the\n * module records the moment a context is ready and skips the call next time.\n * The promise is what makes a fast caller that cannot wait — a mesh can open a\n * microphone and a preview within a single frame — race into one `addModule`\n * instead of two: had this been a set, the second caller would see the context\n * absent while the first was still awaiting and register the module twice.\n * Mapped to a promise rather than the module itself the way the wasm is,\n * because the registration belongs to one context while the wasm is shared,\n * and nothing here should keep a dead context alive — the value is dropped\n * with the context. On failure the entry is removed, so the next attempt\n * actually retries instead of replaying the broken registration.\n */\nconst readyContexts = new WeakMap<AudioContext, Promise<void>>();\n\n/**\n * The compiled model for this context, loading what is not ready yet.\n *\n * Idempotent across calls: the wasm fetch and the module registration both\n * happen exactly once. The wasm is shared by every suppressor, while the module\n * registration belongs to one context.\n *\n * @param context - The context the suppression graph will run in.\n * @param assets - The resolved asset addresses from {@link NeuralSuppressorAssets}.\n * @returns The compiled model binary, ready to hand to a worklet node.\n * @throws Whatever the fetch or the compile threw, for the caller to fall back on.\n */\nexport async function prepareNeuralSuppressor(\n    context: AudioContext,\n    assets: NeuralSuppressorAssets,\n): Promise<ArrayBuffer> {\n    let ready = readyContexts.get(context);\n    if (!ready) {\n        ready = context.audioWorklet.addModule(assets.workletUrl).then(\n            () => undefined,\n            (error: unknown) => {\n                readyContexts.delete(context);\n                throw error;\n            },\n        );\n        readyContexts.set(context, ready);\n    }\n    await ready;\n    if (loadingBinary === null) {\n        loadingBinary = loadRnnoise({ url: assets.wasmUrl, simdUrl: assets.simdWasmUrl }).catch(\n            (error: unknown) => {\n                loadingBinary = null;\n                throw error;\n            },\n        );\n    }\n    return loadingBinary;\n}\n\n/**\n * A denoised track plus the graph that has to come down with it.\n *\n * `track` is not the captured one — it is the output of a `MediaStream`\n * destination the worklet feeds — so stopping the published track is not enough\n * to free the microphone. `release` closes the graph; the captured track behind\n * it belongs to the caller.\n */\nexport interface NeuralSuppressor {\n    /** The track to publish in place of the captured one. */\n    track: MediaStreamTrack;\n    /** Tears the graph down. Does not stop the source track it was built from. */\n    release(): void;\n}\n\n/**\n * Build a suppressor graph on top of a captured microphone track.\n *\n * The model runs on the audio thread through an `AudioWorkletNode` — a\n * recurrent network trained on speech that separates a voice from everything\n * that is not one: keyboards, fans, traffic, a room full of people. The\n * browser's `noiseSuppression` constraint answers the same question with a\n * stationary-noise gate that either lets a transient through or eats the voice\n * with it.\n *\n * Prefer {@link prepareNeuralSuppressor} before the capture opens: the fallback\n * to the browser's own suppression is a `getUserMedia` constraint, and a\n * constraint cannot be added to a capture that already exists. A caller that\n * did not preload still works — the load happens here, idempotently.\n *\n * The model assumes 48 kHz. A context opened at any other rate answers `null`\n * before anything is fetched, because feeding speech samples of the wrong rate\n * into a network trained on 48 kHz produces mush, not a voice.\n *\n * Failure is not fatal and is reported as `null` — whether the wasm would not\n * load or the worklet node could not be built: by the time this runs the caller\n * has already committed to the neural path, so the honest outcome is a call\n * without suppression rather than a microphone that will not open. {@link\n * prepareNeuralSuppressor}, which exists to be called *before* the capture,\n * still throws so the caller can pick a different fallback while one is\n * reachable.\n *\n * @param context - The shared context, prepared at 48 kHz.\n * @param source - The captured microphone track.\n * @param assets - The resolved asset addresses from {@link NeuralSuppressorAssets}.\n * @param options - `maxChannels` is the channel count of the capture; the model\n *   is mono, and a stereo capture asks for two so a second channel is not lost.\n * @returns The denoised track and its teardown, or `null` when this context or\n *   this graph cannot host the suppressor.\n */\nexport async function createNeuralSuppressor(\n    context: AudioContext,\n    source: MediaStreamTrack,\n    assets: NeuralSuppressorAssets,\n    options: { maxChannels: number },\n): Promise<NeuralSuppressor | null> {\n    if (context.sampleRate !== 48_000) return null;\n\n    let binary: ArrayBuffer;\n    try {\n        binary = await prepareNeuralSuppressor(context, assets);\n    } catch {\n        return null;\n    }\n\n    let node: RnnoiseWorkletNode;\n    try {\n        node = new RnnoiseWorkletNode(context, {\n            maxChannels: options.maxChannels,\n            wasmBinary: binary,\n        });\n    } catch {\n        return null;\n    }\n\n    const input = context.createMediaStreamSource(new MediaStream([source]));\n    const output = context.createMediaStreamDestination();\n    input.connect(node);\n    node.connect(output);\n\n    const track = output.stream.getAudioTracks()[0];\n    if (!track) {\n        input.disconnect();\n        node.disconnect();\n        output.disconnect();\n        node.destroy();\n        return null;\n    }\n    track.contentHint = source.contentHint;\n\n    return {\n        track,\n        release: () => {\n            input.disconnect();\n            node.disconnect();\n            output.disconnect();\n            node.destroy();\n            track.stop();\n        },\n    };\n}\n"],"mappings":"A,qHAyCA,SAAgBG,GAAwC,CACpD,OACI,OAAO,iBAAqB,KAC5B,OAAO,OAAW,KAClB,OAAO,eAEf,CAYA,IAAIC,EAA6C,KAkB3CC,EAAgB,IAAI,QAc1B,eAAsBC,EAClB,EACA,EACoB,CACpB,IAAIC,EAAQF,EAAc,IAAIG,CAAO,EAoBrC,OAnBKD,IACD,EAAQC,EAAQ,aAAa,UAAUC,EAAO,UAAU,CAAC,CAAC,SAChD,IAAA,GACL,GAAmB,CAEhB,MADAJ,EAAc,OAAOG,CAAO,EACtBE,CACV,CACJ,EACAL,EAAc,IAAIG,EAASD,CAAK,GAEpC,MAAMA,EACFH,IAAkB,OAClB,GAAA,EAAgBJ,EAAAA,YAAAA,CAAY,CAAE,IAAKS,EAAO,QAAS,QAASA,EAAO,WAAY,CAAC,CAAC,CAAC,MAC7E,GAAmB,CAEhB,KADA,GAAgB,KACVC,CACV,CACJ,GAEGN,CACX,CAoDA,eAAsBO,EAClB,EACA,EACA,EACA,EACgC,CAChC,GAAIH,EAAQ,aAAe,KAAQ,OAAO,KAE1C,IAAII,EACJ,GAAI,CACA,EAAS,MAAMN,EAAwBE,EAASC,CAAM,CAC1D,MAAQ,CACJ,OAAO,IACX,CAEA,IAAII,EACJ,GAAI,CACA,EAAO,IAAIZ,EAAAA,mBAAmBO,EAAS,CACnC,YAAaM,EAAQ,YACrB,WAAYF,CAChB,CAAC,CACL,MAAQ,CACJ,OAAO,IACX,CAEA,IAAMG,EAAQP,EAAQ,wBAAwB,IAAI,YAAY,CAACQ,CAAM,CAAC,CAAC,EACjEC,EAAST,EAAQ,6BAA6B,EACpDO,EAAM,QAAQF,CAAI,EAClBA,EAAK,QAAQI,CAAM,EAEnB,IAAMC,EAAQD,EAAO,OAAO,eAAe,CAAC,CAAC,GAU7C,OATKC,GAOL,EAAM,YAAcF,EAAO,YAEpB,CACH,QACA,YAAe,CACXD,EAAM,WAAW,EACjBF,EAAK,WAAW,EAChBI,EAAO,WAAW,EAClBJ,EAAK,QAAQ,EACbK,EAAM,KAAK,CACf,CACJ,IAjBIH,EAAM,WAAW,EACjBF,EAAK,WAAW,EAChBI,EAAO,WAAW,EAClBJ,EAAK,QAAQ,EACN,KAcf,C"}

package/dist/neural.js.map

@@ -1 +1 @@
-{"version":3,"file":"neural.js","names":[],"sources":["../src/neural/index.ts"],"sourcesContent":["import { RnnoiseWorkletNode, loadRnnoise } from \"@sapphi-red/web-noise-suppressor\";\n\n/**\n * Where the suppressor's three pieces live, as URLs a bundler hands over.\n *\n * The `@sapphi-red/web-noise-suppressor` package ships the runnable assets next\n * to its code, but it cannot say where they are from inside a library: the\n * `?url` suffix that resolves a module to its served address is a bundler\n * feature, and every bundler answers it differently. So this subpath takes the\n * three resolved addresses as arguments and does the honest part — the graph,\n * the load-once semantics, the per-context registration — here.\n */\nexport interface NeuralSuppressorAssets {\n    /**\n     * The `AudioWorklet` processor module the model runs its DSP in\n     * (`rnnoiseWorklet.js`).\n     */\n    workletUrl: string;\n    /** The SIMD build of the model's wasm (`rnnoise_simd.wasm`). */\n    simdWasmUrl: string;\n    /** The baseline build, used where the engine lacks SIMD (`rnnoise.wasm`). */\n    wasmUrl: string;\n}\n\n/**\n * Whether this browser can run a worklet-based noise suppressor.\n *\n * Answered from the two things the path needs that nothing but the platform can\n * supply: `AudioWorkletNode` runs custom DSP on the audio thread, and a secure\n * context is what the browser requires before letting a module near the\n * microphone graph. Everything else — the models, the wasm — ships with the\n * caller, so it cannot be missing. The context must also run at 48 kHz, which\n * is checked at build time rather than here because the caller owns how its\n * context was opened.\n *\n * Deliberately conservative: anything it cannot establish answers `false`, and\n * a `false` sends the caller back to the browser's own `noiseSuppression`\n * constraint, which is weaker but always there.\n *\n * @returns True when a neural suppressor can be built on top of a capture.\n */\nexport function isNeuralSuppressionSupported(): boolean {\n    return (\n        typeof AudioWorkletNode !== \"undefined\" &&\n        typeof window !== \"undefined\" &&\n        window.isSecureContext\n    );\n}\n\n/**\n * The one wasm binary every suppressor shares, fetched once.\n *\n * `loadRnnoise` compiles the whole model, and the answer is identical for every\n * graph that opens afterwards — a mesh can build a suppressor per published\n * track and a settings dialog may build a second for its monitor within a\n * single frame. Held as the promise rather than the result so the first two\n * callers race into one fetch instead of two. Reset on failure, so the next\n * call retries instead of replaying a dead promise.\n */\nlet loadingBinary: Promise<ArrayBuffer> | null = null;\n\n/**\n * The contexts the worklet module has already been registered on, mapped to the\n * registration's own promise.\n *\n * `addModule` is per-context and throws on a name it already holds, so the\n * module records the moment a context is ready and skips the call next time.\n * The promise is what makes a fast caller that cannot wait — a mesh can open a\n * microphone and a preview within a single frame — race into one `addModule`\n * instead of two: had this been a set, the second caller would see the context\n * absent while the first was still awaiting and register the module twice.\n * Mapped to a promise rather than the module itself the way the wasm is,\n * because the registration belongs to one context while the wasm is shared,\n * and nothing here should keep a dead context alive — the value is dropped\n * with the context. On failure the entry is removed, so the next attempt\n * actually retries instead of replaying the broken registration.\n */\nconst readyContexts = new WeakMap<AudioContext, Promise<void>>();\n\n/**\n * The compiled model for this context, loading what is not ready yet.\n *\n * Idempotent across calls: the wasm fetch and the module registration both\n * happen exactly once. The wasm is shared by every suppressor, while the module\n * registration belongs to one context.\n *\n * @param context - The context the suppression graph will run in.\n * @param assets - The resolved asset addresses from {@link NeuralSuppressorAssets}.\n * @returns The compiled model binary, ready to hand to a worklet node.\n * @throws Whatever the fetch or the compile threw, for the caller to fall back on.\n */\nexport async function prepareNeuralSuppressor(\n    context: AudioContext,\n    assets: NeuralSuppressorAssets,\n): Promise<ArrayBuffer> {\n    let ready = readyContexts.get(context);\n    if (!ready) {\n        ready = context.audioWorklet.addModule(assets.workletUrl).then(\n            () => undefined,\n            (error: unknown) => {\n                readyContexts.delete(context);\n                throw error;\n            },\n        );\n        readyContexts.set(context, ready);\n    }\n    await ready;\n    if (loadingBinary === null) {\n        loadingBinary = loadRnnoise({ url: assets.wasmUrl, simdUrl: assets.simdWasmUrl }).catch(\n            (error: unknown) => {\n                loadingBinary = null;\n                throw error;\n            },\n        );\n    }\n    return loadingBinary;\n}\n\n/**\n * A denoised track plus the graph that has to come down with it.\n *\n * `track` is not the captured one — it is the output of a `MediaStream`\n * destination the worklet feeds — so stopping the published track is not enough\n * to free the microphone. `release` closes the graph; the captured track behind\n * it belongs to the caller.\n */\nexport interface NeuralSuppressor {\n    /** The track to publish in place of the captured one. */\n    track: MediaStreamTrack;\n    /** Tears the graph down. Does not stop the source track it was built from. */\n    release(): void;\n}\n\n/**\n * Build a suppressor graph on top of a captured microphone track.\n *\n * The model runs on the audio thread through an `AudioWorkletNode` — a\n * recurrent network trained on speech that separates a voice from everything\n * that is not one: keyboards, fans, traffic, a room full of people. The\n * browser's `noiseSuppression` constraint answers the same question with a\n * stationary-noise gate that either lets a transient through or eats the voice\n * with it.\n *\n * Prefer {@link prepareNeuralSuppressor} before the capture opens: the fallback\n * to the browser's own suppression is a `getUserMedia` constraint, and a\n * constraint cannot be added to a capture that already exists. A caller that\n * did not preload still works — the load happens here, idempotently.\n *\n * The model assumes 48 kHz. A context opened at any other rate answers `null`\n * before anything is fetched, because feeding speech samples of the wrong rate\n * into a network trained on 48 kHz produces mush, not a voice.\n *\n * Failure is not fatal and is reported as `null` — whether the wasm would not\n * load or the worklet node could not be built: by the time this runs the caller\n * has already committed to the neural path, so the honest outcome is a call\n * without suppression rather than a microphone that will not open. {@link\n * prepareNeuralSuppressor}, which exists to be called *before* the capture,\n * still throws so the caller can pick a different fallback while one is\n * reachable.\n *\n * @param context - The shared context, prepared at 48 kHz.\n * @param source - The captured microphone track.\n * @param assets - The resolved asset addresses from {@link NeuralSuppressorAssets}.\n * @param options - `maxChannels` is the channel count of the capture; the model\n *   is mono, and a stereo capture asks for two so a second channel is not lost.\n * @returns The denoised track and its teardown, or `null` when this context or\n *   this graph cannot host the suppressor.\n */\nexport async function createNeuralSuppressor(\n    context: AudioContext,\n    source: MediaStreamTrack,\n    assets: NeuralSuppressorAssets,\n    options: { maxChannels: number },\n): Promise<NeuralSuppressor | null> {\n    if (context.sampleRate !== 48_000) return null;\n\n    let binary: ArrayBuffer;\n    try {\n        binary = await prepareNeuralSuppressor(context, assets);\n    } catch {\n        return null;\n    }\n\n    let node: RnnoiseWorkletNode;\n    try {\n        node = new RnnoiseWorkletNode(context, {\n            maxChannels: options.maxChannels,\n            wasmBinary: binary,\n        });\n    } catch {\n        return null;\n    }\n\n    const input = context.createMediaStreamSource(new MediaStream([source]));\n    const output = context.createMediaStreamDestination();\n    input.connect(node);\n    node.connect(output);\n\n    const track = output.stream.getAudioTracks()[0];\n    if (!track) {\n        input.disconnect();\n        node.disconnect();\n        output.disconnect();\n        node.destroy();\n        return null;\n    }\n    track.contentHint = source.contentHint;\n\n    return {\n        track,\n        release: () => {\n            input.disconnect();\n            node.disconnect();\n            output.disconnect();\n            node.destroy();\n            track.stop();\n        },\n    };\n}\n"],"mappings":";;AAyCA,SAAgB,IAAwC;CACpD,OACI,OAAO,mBAAqB,OAC5B,OAAO,SAAW,OAClB,OAAO;AAEf;AAYA,IAAI,IAA6C,MAkB3C,oBAAgB,IAAI,QAAqC;AAc/D,eAAsB,EAClB,GACA,GACoB;CACpB,IAAI,IAAQ,EAAc,IAAI,CAAO;CAoBrC,OAnBK,MACD,IAAQ,EAAQ,aAAa,UAAU,EAAO,UAAU,CAAC,CAAC,WAChD,KAAA,IACL,MAAmB;EAEhB,MADA,EAAc,OAAO,CAAO,GACtB;CACV,CACJ,GACA,EAAc,IAAI,GAAS,CAAK,IAEpC,MAAM,GACF,MAAkB,SAClB,IAAgB,EAAY;EAAE,KAAK,EAAO;EAAS,SAAS,EAAO;CAAY,CAAC,CAAC,CAAC,OAC7E,MAAmB;EAEhB,MADA,IAAgB,MACV;CACV,CACJ,IAEG;AACX;AAoDA,eAAsB,EAClB,GACA,GACA,GACA,GACgC;CAChC,IAAI,EAAQ,eAAe,MAAQ,OAAO;CAE1C,IAAI;CACJ,IAAI;EACA,IAAS,MAAM,EAAwB,GAAS,CAAM;CAC1D,QAAQ;EACJ,OAAO;CACX;CAEA,IAAI;CACJ,IAAI;EACA,IAAO,IAAI,EAAmB,GAAS;GACnC,aAAa,EAAQ;GACrB,YAAY;EAChB,CAAC;CACL,QAAQ;EACJ,OAAO;CACX;CAEA,IAAM,IAAQ,EAAQ,wBAAwB,IAAI,YAAY,CAAC,CAAM,CAAC,CAAC,GACjE,IAAS,EAAQ,6BAA6B;CAEpD,AADA,EAAM,QAAQ,CAAI,GAClB,EAAK,QAAQ,CAAM;CAEnB,IAAM,IAAQ,EAAO,OAAO,eAAe,CAAC,CAAC;CAU7C,OATK,KAOL,EAAM,cAAc,EAAO,aAEpB;EACH;EACA,eAAe;GAKX,AAJA,EAAM,WAAW,GACjB,EAAK,WAAW,GAChB,EAAO,WAAW,GAClB,EAAK,QAAQ,GACb,EAAM,KAAK;EACf;CACJ,MAjBI,EAAM,WAAW,GACjB,EAAK,WAAW,GAChB,EAAO,WAAW,GAClB,EAAK,QAAQ,GACN;AAcf"}
+{"version":3,"file":"neural.js","names":["isNeuralSuppressionSupported","loadingBinary","readyContexts","prepareNeuralSuppressor","ready","context","assets","error","loadRnnoise","createNeuralSuppressor","binary","node","RnnoiseWorkletNode","options","input","source","output","track"],"sources":["../src/neural/index.ts"],"sourcesContent":["import { RnnoiseWorkletNode, loadRnnoise } from \"@sapphi-red/web-noise-suppressor\";\n\n/**\n * Where the suppressor's three pieces live, as URLs a bundler hands over.\n *\n * The `@sapphi-red/web-noise-suppressor` package ships the runnable assets next\n * to its code, but it cannot say where they are from inside a library: the\n * `?url` suffix that resolves a module to its served address is a bundler\n * feature, and every bundler answers it differently. So this subpath takes the\n * three resolved addresses as arguments and does the honest part — the graph,\n * the load-once semantics, the per-context registration — here.\n */\nexport interface NeuralSuppressorAssets {\n    /**\n     * The `AudioWorklet` processor module the model runs its DSP in\n     * (`rnnoiseWorklet.js`).\n     */\n    workletUrl: string;\n    /** The SIMD build of the model's wasm (`rnnoise_simd.wasm`). */\n    simdWasmUrl: string;\n    /** The baseline build, used where the engine lacks SIMD (`rnnoise.wasm`). */\n    wasmUrl: string;\n}\n\n/**\n * Whether this browser can run a worklet-based noise suppressor.\n *\n * Answered from the two things the path needs that nothing but the platform can\n * supply: `AudioWorkletNode` runs custom DSP on the audio thread, and a secure\n * context is what the browser requires before letting a module near the\n * microphone graph. Everything else — the models, the wasm — ships with the\n * caller, so it cannot be missing. The context must also run at 48 kHz, which\n * is checked at build time rather than here because the caller owns how its\n * context was opened.\n *\n * Deliberately conservative: anything it cannot establish answers `false`, and\n * a `false` sends the caller back to the browser's own `noiseSuppression`\n * constraint, which is weaker but always there.\n *\n * @returns True when a neural suppressor can be built on top of a capture.\n */\nexport function isNeuralSuppressionSupported(): boolean {\n    return (\n        typeof AudioWorkletNode !== \"undefined\" &&\n        typeof window !== \"undefined\" &&\n        window.isSecureContext\n    );\n}\n\n/**\n * The one wasm binary every suppressor shares, fetched once.\n *\n * `loadRnnoise` compiles the whole model, and the answer is identical for every\n * graph that opens afterwards — a mesh can build a suppressor per published\n * track and a settings dialog may build a second for its monitor within a\n * single frame. Held as the promise rather than the result so the first two\n * callers race into one fetch instead of two. Reset on failure, so the next\n * call retries instead of replaying a dead promise.\n */\nlet loadingBinary: Promise<ArrayBuffer> | null = null;\n\n/**\n * The contexts the worklet module has already been registered on, mapped to the\n * registration's own promise.\n *\n * `addModule` is per-context and throws on a name it already holds, so the\n * module records the moment a context is ready and skips the call next time.\n * The promise is what makes a fast caller that cannot wait — a mesh can open a\n * microphone and a preview within a single frame — race into one `addModule`\n * instead of two: had this been a set, the second caller would see the context\n * absent while the first was still awaiting and register the module twice.\n * Mapped to a promise rather than the module itself the way the wasm is,\n * because the registration belongs to one context while the wasm is shared,\n * and nothing here should keep a dead context alive — the value is dropped\n * with the context. On failure the entry is removed, so the next attempt\n * actually retries instead of replaying the broken registration.\n */\nconst readyContexts = new WeakMap<AudioContext, Promise<void>>();\n\n/**\n * The compiled model for this context, loading what is not ready yet.\n *\n * Idempotent across calls: the wasm fetch and the module registration both\n * happen exactly once. The wasm is shared by every suppressor, while the module\n * registration belongs to one context.\n *\n * @param context - The context the suppression graph will run in.\n * @param assets - The resolved asset addresses from {@link NeuralSuppressorAssets}.\n * @returns The compiled model binary, ready to hand to a worklet node.\n * @throws Whatever the fetch or the compile threw, for the caller to fall back on.\n */\nexport async function prepareNeuralSuppressor(\n    context: AudioContext,\n    assets: NeuralSuppressorAssets,\n): Promise<ArrayBuffer> {\n    let ready = readyContexts.get(context);\n    if (!ready) {\n        ready = context.audioWorklet.addModule(assets.workletUrl).then(\n            () => undefined,\n            (error: unknown) => {\n                readyContexts.delete(context);\n                throw error;\n            },\n        );\n        readyContexts.set(context, ready);\n    }\n    await ready;\n    if (loadingBinary === null) {\n        loadingBinary = loadRnnoise({ url: assets.wasmUrl, simdUrl: assets.simdWasmUrl }).catch(\n            (error: unknown) => {\n                loadingBinary = null;\n                throw error;\n            },\n        );\n    }\n    return loadingBinary;\n}\n\n/**\n * A denoised track plus the graph that has to come down with it.\n *\n * `track` is not the captured one — it is the output of a `MediaStream`\n * destination the worklet feeds — so stopping the published track is not enough\n * to free the microphone. `release` closes the graph; the captured track behind\n * it belongs to the caller.\n */\nexport interface NeuralSuppressor {\n    /** The track to publish in place of the captured one. */\n    track: MediaStreamTrack;\n    /** Tears the graph down. Does not stop the source track it was built from. */\n    release(): void;\n}\n\n/**\n * Build a suppressor graph on top of a captured microphone track.\n *\n * The model runs on the audio thread through an `AudioWorkletNode` — a\n * recurrent network trained on speech that separates a voice from everything\n * that is not one: keyboards, fans, traffic, a room full of people. The\n * browser's `noiseSuppression` constraint answers the same question with a\n * stationary-noise gate that either lets a transient through or eats the voice\n * with it.\n *\n * Prefer {@link prepareNeuralSuppressor} before the capture opens: the fallback\n * to the browser's own suppression is a `getUserMedia` constraint, and a\n * constraint cannot be added to a capture that already exists. A caller that\n * did not preload still works — the load happens here, idempotently.\n *\n * The model assumes 48 kHz. A context opened at any other rate answers `null`\n * before anything is fetched, because feeding speech samples of the wrong rate\n * into a network trained on 48 kHz produces mush, not a voice.\n *\n * Failure is not fatal and is reported as `null` — whether the wasm would not\n * load or the worklet node could not be built: by the time this runs the caller\n * has already committed to the neural path, so the honest outcome is a call\n * without suppression rather than a microphone that will not open. {@link\n * prepareNeuralSuppressor}, which exists to be called *before* the capture,\n * still throws so the caller can pick a different fallback while one is\n * reachable.\n *\n * @param context - The shared context, prepared at 48 kHz.\n * @param source - The captured microphone track.\n * @param assets - The resolved asset addresses from {@link NeuralSuppressorAssets}.\n * @param options - `maxChannels` is the channel count of the capture; the model\n *   is mono, and a stereo capture asks for two so a second channel is not lost.\n * @returns The denoised track and its teardown, or `null` when this context or\n *   this graph cannot host the suppressor.\n */\nexport async function createNeuralSuppressor(\n    context: AudioContext,\n    source: MediaStreamTrack,\n    assets: NeuralSuppressorAssets,\n    options: { maxChannels: number },\n): Promise<NeuralSuppressor | null> {\n    if (context.sampleRate !== 48_000) return null;\n\n    let binary: ArrayBuffer;\n    try {\n        binary = await prepareNeuralSuppressor(context, assets);\n    } catch {\n        return null;\n    }\n\n    let node: RnnoiseWorkletNode;\n    try {\n        node = new RnnoiseWorkletNode(context, {\n            maxChannels: options.maxChannels,\n            wasmBinary: binary,\n        });\n    } catch {\n        return null;\n    }\n\n    const input = context.createMediaStreamSource(new MediaStream([source]));\n    const output = context.createMediaStreamDestination();\n    input.connect(node);\n    node.connect(output);\n\n    const track = output.stream.getAudioTracks()[0];\n    if (!track) {\n        input.disconnect();\n        node.disconnect();\n        output.disconnect();\n        node.destroy();\n        return null;\n    }\n    track.contentHint = source.contentHint;\n\n    return {\n        track,\n        release: () => {\n            input.disconnect();\n            node.disconnect();\n            output.disconnect();\n            node.destroy();\n            track.stop();\n        },\n    };\n}\n"],"mappings":";;AAyCA,SAAgBA,IAAwC;CACpD,OACI,OAAO,mBAAqB,OAC5B,OAAO,SAAW,OAClB,OAAO;AAEf;AAYA,IAAIC,IAA6C,MAkB3CC,oBAAgB,IAAI,QAAqC;AAc/D,eAAsBC,EAClB,GACA,GACoB;CACpB,IAAIC,IAAQF,EAAc,IAAIG,CAAO;CAoBrC,OAnBKD,MACD,IAAQC,EAAQ,aAAa,UAAUC,EAAO,UAAU,CAAC,CAAC,WAChD,KAAA,IACL,MAAmB;EAEhB,MADAJ,EAAc,OAAOG,CAAO,GACtBE;CACV,CACJ,GACAL,EAAc,IAAIG,GAASD,CAAK,IAEpC,MAAMA,GACFH,MAAkB,SAClB,IAAgBO,EAAY;EAAE,KAAKF,EAAO;EAAS,SAASA,EAAO;CAAY,CAAC,CAAC,CAAC,OAC7E,MAAmB;EAEhB,MADA,IAAgB,MACVC;CACV,CACJ,IAEGN;AACX;AAoDA,eAAsBQ,EAClB,GACA,GACA,GACA,GACgC;CAChC,IAAIJ,EAAQ,eAAe,MAAQ,OAAO;CAE1C,IAAIK;CACJ,IAAI;EACA,IAAS,MAAMP,EAAwBE,GAASC,CAAM;CAC1D,QAAQ;EACJ,OAAO;CACX;CAEA,IAAIK;CACJ,IAAI;EACA,IAAO,IAAIC,EAAmBP,GAAS;GACnC,aAAaQ,EAAQ;GACrB,YAAYH;EAChB,CAAC;CACL,QAAQ;EACJ,OAAO;CACX;CAEA,IAAMI,IAAQT,EAAQ,wBAAwB,IAAI,YAAY,CAACU,CAAM,CAAC,CAAC,GACjEC,IAASX,EAAQ,6BAA6B;CAEpD,AADAS,EAAM,QAAQH,CAAI,GAClBA,EAAK,QAAQK,CAAM;CAEnB,IAAMC,IAAQD,EAAO,OAAO,eAAe,CAAC,CAAC;CAU7C,OATKC,KAOL,EAAM,cAAcF,EAAO,aAEpB;EACH;EACA,eAAe;GAKX,AAJAD,EAAM,WAAW,GACjBH,EAAK,WAAW,GAChBK,EAAO,WAAW,GAClBL,EAAK,QAAQ,GACbM,EAAM,KAAK;EACf;CACJ,MAjBIH,EAAM,WAAW,GACjBH,EAAK,WAAW,GAChBK,EAAO,WAAW,GAClBL,EAAK,QAAQ,GACN;AAcf"}

package/dist/oauth/GoogleSignIn.cjs

@@ -1,2 +1,2 @@
-let e=require("react/jsx-runtime");function t({component:t,onSuccess:n,onError:r,locale:i,theme:a,text:o,shape:s,size:c,disableOneTap:l,width:u,className:d,style:f}){return(0,e.jsx)(`div`,{className:d,style:f,children:t({onSuccess:e=>{if(!e.credential){r?.({provider:`google`,message:`Google returned no credential`,raw:e});return}return n({idToken:e.credential,provider:`google`,raw:e})},onError:()=>{r?.({provider:`google`,message:`Google login failed`})},locale:i,theme:a,text:o,shape:s,size:c,useOneTap:!l,width:u})})}exports.GoogleSignIn=t;
+let e=require("react/jsx-runtime");function t({component:t,onSuccess:n,onError:r,locale:i,theme:a,text:o,shape:s,size:c,disableOneTap:l,width:u,className:d,style:f}){return(0,e.jsx)(`div`,{className:d,style:f,children:t({onSuccess:e=>{if(!e.credential)r?.({provider:`google`,message:`Google returned no credential`,raw:e});else return n({idToken:e.credential,provider:`google`,raw:e})},onError:()=>{r?.({provider:`google`,message:`Google login failed`})},locale:i,theme:a,text:o,shape:s,size:c,useOneTap:!l,width:u})})}exports.GoogleSignIn=t;
 //# sourceMappingURL=GoogleSignIn.cjs.map

package/dist/oauth/GoogleSignIn.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleSignIn.cjs","names":[],"sources":["../../src/oauth/GoogleSignIn.tsx"],"sourcesContent":["/**\n * @tempest-limits props-count — component, theme, text, shape, size and width are\n * Google's own button parameters, passed through with their names intact so the\n * reader can match them to Google's documentation;\n * onSuccess/onError/locale/disableOneTap are the wrapper's.\n */\nimport type { CSSProperties, ReactNode } from \"react\";\nimport type { OAuthCredential, OAuthError } from \"./types\";\n\nexport type GoogleSignInTheme = \"filled_blue\" | \"filled_black\" | \"outline\";\nexport type GoogleSignInText = \"signin_with\" | \"signup_with\" | \"continue_with\" | \"signin\";\nexport type GoogleSignInShape = \"rectangular\" | \"pill\" | \"circle\" | \"square\";\nexport type GoogleSignInSize = \"large\" | \"medium\" | \"small\";\n\nexport interface GoogleSignInProps {\n    /**\n     * `GoogleLogin` component from `@react-oauth/google`. The caller imports\n     * it and passes it through so the SDK doesn't take `@react-oauth/google`\n     * as a peer dep.\n     */\n    component: (props: Record<string, unknown>) => ReactNode;\n    /** Fired with the validated credential on success. */\n    onSuccess: (credential: OAuthCredential) => void | Promise<void>;\n    /** Fired with a normalised error on failure. */\n    onError?: (error: OAuthError) => void;\n    /** Optional locale override (e.g. `\"pt-BR\"`). Falls back to browser locale. */\n    locale?: string;\n    /** Visual theme — passed through to `<GoogleLogin>`. */\n    theme?: GoogleSignInTheme;\n    /** Button text variant. */\n    text?: GoogleSignInText;\n    /** Button shape. */\n    shape?: GoogleSignInShape;\n    /** Button size. */\n    size?: GoogleSignInSize;\n    /** Disable Google's \"One Tap\" auto-prompt. Default `false`. */\n    disableOneTap?: boolean;\n    /** Optional `width` override (px) — Google's button is fixed-width. */\n    width?: number;\n    /** Optional className applied to the wrapper. */\n    className?: string;\n    /** Optional inline style applied to the wrapper. */\n    style?: CSSProperties;\n}\n\n/**\n * Thin wrapper over `@react-oauth/google`'s `<GoogleLogin>` that:\n *\n * 1. Normalises the success payload into [[OAuthCredential]] (`idToken`,\n *    `provider: \"google\"`, `raw`).\n * 2. Normalises errors into [[OAuthError]].\n * 3. Lets you pass `GoogleLogin` via the `component` prop, so the SDK does\n *    not declare `@react-oauth/google` as a peer dep — apps that don't use\n *    Google never pay for it.\n *\n * @example\n * import { GoogleLogin, GoogleOAuthProvider } from \"@react-oauth/google\";\n * import { GoogleSignIn } from \"tempest-react-sdk\";\n *\n * <GoogleOAuthProvider clientId={import.meta.env.VITE_GOOGLE_CLIENT_ID}>\n *     <GoogleSignIn\n *         component={GoogleLogin}\n *         onSuccess={async ({ idToken }) => {\n *             await api.post(\"/auth/google\", { body: { id_token: idToken } });\n *         }}\n *         onError={(err) => toast.error(err.message)}\n *     />\n * </GoogleOAuthProvider>\n */\nexport function GoogleSignIn({\n    component: Component,\n    onSuccess,\n    onError,\n    locale,\n    theme,\n    text,\n    shape,\n    size,\n    disableOneTap,\n    width,\n    className,\n    style,\n}: GoogleSignInProps) {\n    return (\n        <div className={className} style={style}>\n            {Component({\n                onSuccess: (response: { credential?: string }) => {\n                    if (!response.credential) {\n                        onError?.({\n                            provider: \"google\",\n                            message: \"Google returned no credential\",\n                            raw: response,\n                        });\n                        return;\n                    }\n                    return onSuccess({\n                        idToken: response.credential,\n                        provider: \"google\",\n                        raw: response,\n                    });\n                },\n                onError: () => {\n                    onError?.({\n                        provider: \"google\",\n                        message: \"Google login failed\",\n                    });\n                },\n                locale,\n                theme,\n                text,\n                shape,\n                size,\n                useOneTap: !disableOneTap,\n                width,\n            })}\n        </div>\n    );\n}\n"],"mappings":"mCAqEA,SAAgB,EAAa,CACzB,UAAW,EACX,YACA,UACA,SACA,QACA,OACA,QACA,OACA,gBACA,QACA,YACA,SACkB,CAClB,OACI,EAAA,EAAA,IAAA,CAAC,MAAD,CAAgB,YAAkB,QAC7B,SAAA,EAAU,CACP,UAAY,GAAsC,CAC9C,GAAI,CAAC,EAAS,WAAY,CACtB,IAAU,CACN,SAAU,SACV,QAAS,gCACT,IAAK,CACT,CAAC,EACD,MACJ,CACA,OAAO,EAAU,CACb,QAAS,EAAS,WAClB,SAAU,SACV,IAAK,CACT,CAAC,CACL,EACA,YAAe,CACX,IAAU,CACN,SAAU,SACV,QAAS,qBACb,CAAC,CACL,EACA,SACA,QACA,OACA,QACA,OACA,UAAW,CAAC,EACZ,OACJ,CAAC,CACA,CAAA,CAEb"}
+{"version":3,"file":"GoogleSignIn.cjs","names":["react_jsx_runtime","GoogleSignIn","Component","response","onError","onSuccess","disableOneTap"],"sources":["../../src/oauth/GoogleSignIn.tsx"],"sourcesContent":["/**\n * @tempest-limits props-count — component, theme, text, shape, size and width are\n * Google's own button parameters, passed through with their names intact so the\n * reader can match them to Google's documentation;\n * onSuccess/onError/locale/disableOneTap are the wrapper's.\n */\nimport type { CSSProperties, ReactNode } from \"react\";\nimport type { OAuthCredential, OAuthError } from \"./types\";\n\nexport type GoogleSignInTheme = \"filled_blue\" | \"filled_black\" | \"outline\";\nexport type GoogleSignInText = \"signin_with\" | \"signup_with\" | \"continue_with\" | \"signin\";\nexport type GoogleSignInShape = \"rectangular\" | \"pill\" | \"circle\" | \"square\";\nexport type GoogleSignInSize = \"large\" | \"medium\" | \"small\";\n\nexport interface GoogleSignInProps {\n    /**\n     * `GoogleLogin` component from `@react-oauth/google`. The caller imports\n     * it and passes it through so the SDK doesn't take `@react-oauth/google`\n     * as a peer dep.\n     */\n    component: (props: Record<string, unknown>) => ReactNode;\n    /** Fired with the validated credential on success. */\n    onSuccess: (credential: OAuthCredential) => void | Promise<void>;\n    /** Fired with a normalised error on failure. */\n    onError?: (error: OAuthError) => void;\n    /** Optional locale override (e.g. `\"pt-BR\"`). Falls back to browser locale. */\n    locale?: string;\n    /** Visual theme — passed through to `<GoogleLogin>`. */\n    theme?: GoogleSignInTheme;\n    /** Button text variant. */\n    text?: GoogleSignInText;\n    /** Button shape. */\n    shape?: GoogleSignInShape;\n    /** Button size. */\n    size?: GoogleSignInSize;\n    /** Disable Google's \"One Tap\" auto-prompt. Default `false`. */\n    disableOneTap?: boolean;\n    /** Optional `width` override (px) — Google's button is fixed-width. */\n    width?: number;\n    /** Optional className applied to the wrapper. */\n    className?: string;\n    /** Optional inline style applied to the wrapper. */\n    style?: CSSProperties;\n}\n\n/**\n * Thin wrapper over `@react-oauth/google`'s `<GoogleLogin>` that:\n *\n * 1. Normalises the success payload into [[OAuthCredential]] (`idToken`,\n *    `provider: \"google\"`, `raw`).\n * 2. Normalises errors into [[OAuthError]].\n * 3. Lets you pass `GoogleLogin` via the `component` prop, so the SDK does\n *    not declare `@react-oauth/google` as a peer dep — apps that don't use\n *    Google never pay for it.\n *\n * @example\n * import { GoogleLogin, GoogleOAuthProvider } from \"@react-oauth/google\";\n * import { GoogleSignIn } from \"tempest-react-sdk\";\n *\n * <GoogleOAuthProvider clientId={import.meta.env.VITE_GOOGLE_CLIENT_ID}>\n *     <GoogleSignIn\n *         component={GoogleLogin}\n *         onSuccess={async ({ idToken }) => {\n *             await api.post(\"/auth/google\", { body: { id_token: idToken } });\n *         }}\n *         onError={(err) => toast.error(err.message)}\n *     />\n * </GoogleOAuthProvider>\n */\nexport function GoogleSignIn({\n    component: Component,\n    onSuccess,\n    onError,\n    locale,\n    theme,\n    text,\n    shape,\n    size,\n    disableOneTap,\n    width,\n    className,\n    style,\n}: GoogleSignInProps) {\n    return (\n        <div className={className} style={style}>\n            {Component({\n                onSuccess: (response: { credential?: string }) => {\n                    if (!response.credential) {\n                        onError?.({\n                            provider: \"google\",\n                            message: \"Google returned no credential\",\n                            raw: response,\n                        });\n                        return;\n                    }\n                    return onSuccess({\n                        idToken: response.credential,\n                        provider: \"google\",\n                        raw: response,\n                    });\n                },\n                onError: () => {\n                    onError?.({\n                        provider: \"google\",\n                        message: \"Google login failed\",\n                    });\n                },\n                locale,\n                theme,\n                text,\n                shape,\n                size,\n                useOneTap: !disableOneTap,\n                width,\n            })}\n        </div>\n    );\n}\n"],"mappings":"A,mCAqEA,SAAgBC,EAAa,CACzB,UAAWC,EACX,YACA,UACA,SACA,QACA,OACA,QACA,OACA,gBACA,QACA,YACA,SACkB,CAClB,OACI,EAAAF,EAAA,IAAA,CAAC,MAAD,CAAgB,YAAkB,QAC7B,SAAAE,EAAU,CACP,UAAY,GAAsC,CAC9C,GAAI,CAACC,EAAS,WACVC,IAAU,CACN,SAAU,SACV,QAAS,gCACT,IAAKD,CACT,CAAC,OAGL,OAAOE,EAAU,CACb,QAASF,EAAS,WAClB,SAAU,SACV,IAAKA,CACT,CAAC,CACL,EACA,YAAe,CACXC,IAAU,CACN,SAAU,SACV,QAAS,qBACb,CAAC,CACL,EACA,SACA,QACA,OACA,QACA,OACA,UAAW,CAACE,EACZ,OACJ,CAAC,CACA,CAAA,CAEb,C"}

package/dist/oauth/GoogleSignIn.js

@@ -6,15 +6,12 @@ function t({ component: t, onSuccess: n, onError: r, locale: i, theme: a, text:
 		style: f,
 		children: t({
 			onSuccess: (e) => {
-				if (!e.credential) {
-					r?.({
-						provider: "google",
-						message: "Google returned no credential",
-						raw: e
-					});
-					return;
-				}
-				return n({
+				if (!e.credential) r?.({
+					provider: "google",
+					message: "Google returned no credential",
+					raw: e
+				});
+				else return n({
 					idToken: e.credential,
 					provider: "google",
 					raw: e

package/dist/oauth/GoogleSignIn.js.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleSignIn.js","names":[],"sources":["../../src/oauth/GoogleSignIn.tsx"],"sourcesContent":["/**\n * @tempest-limits props-count — component, theme, text, shape, size and width are\n * Google's own button parameters, passed through with their names intact so the\n * reader can match them to Google's documentation;\n * onSuccess/onError/locale/disableOneTap are the wrapper's.\n */\nimport type { CSSProperties, ReactNode } from \"react\";\nimport type { OAuthCredential, OAuthError } from \"./types\";\n\nexport type GoogleSignInTheme = \"filled_blue\" | \"filled_black\" | \"outline\";\nexport type GoogleSignInText = \"signin_with\" | \"signup_with\" | \"continue_with\" | \"signin\";\nexport type GoogleSignInShape = \"rectangular\" | \"pill\" | \"circle\" | \"square\";\nexport type GoogleSignInSize = \"large\" | \"medium\" | \"small\";\n\nexport interface GoogleSignInProps {\n    /**\n     * `GoogleLogin` component from `@react-oauth/google`. The caller imports\n     * it and passes it through so the SDK doesn't take `@react-oauth/google`\n     * as a peer dep.\n     */\n    component: (props: Record<string, unknown>) => ReactNode;\n    /** Fired with the validated credential on success. */\n    onSuccess: (credential: OAuthCredential) => void | Promise<void>;\n    /** Fired with a normalised error on failure. */\n    onError?: (error: OAuthError) => void;\n    /** Optional locale override (e.g. `\"pt-BR\"`). Falls back to browser locale. */\n    locale?: string;\n    /** Visual theme — passed through to `<GoogleLogin>`. */\n    theme?: GoogleSignInTheme;\n    /** Button text variant. */\n    text?: GoogleSignInText;\n    /** Button shape. */\n    shape?: GoogleSignInShape;\n    /** Button size. */\n    size?: GoogleSignInSize;\n    /** Disable Google's \"One Tap\" auto-prompt. Default `false`. */\n    disableOneTap?: boolean;\n    /** Optional `width` override (px) — Google's button is fixed-width. */\n    width?: number;\n    /** Optional className applied to the wrapper. */\n    className?: string;\n    /** Optional inline style applied to the wrapper. */\n    style?: CSSProperties;\n}\n\n/**\n * Thin wrapper over `@react-oauth/google`'s `<GoogleLogin>` that:\n *\n * 1. Normalises the success payload into [[OAuthCredential]] (`idToken`,\n *    `provider: \"google\"`, `raw`).\n * 2. Normalises errors into [[OAuthError]].\n * 3. Lets you pass `GoogleLogin` via the `component` prop, so the SDK does\n *    not declare `@react-oauth/google` as a peer dep — apps that don't use\n *    Google never pay for it.\n *\n * @example\n * import { GoogleLogin, GoogleOAuthProvider } from \"@react-oauth/google\";\n * import { GoogleSignIn } from \"tempest-react-sdk\";\n *\n * <GoogleOAuthProvider clientId={import.meta.env.VITE_GOOGLE_CLIENT_ID}>\n *     <GoogleSignIn\n *         component={GoogleLogin}\n *         onSuccess={async ({ idToken }) => {\n *             await api.post(\"/auth/google\", { body: { id_token: idToken } });\n *         }}\n *         onError={(err) => toast.error(err.message)}\n *     />\n * </GoogleOAuthProvider>\n */\nexport function GoogleSignIn({\n    component: Component,\n    onSuccess,\n    onError,\n    locale,\n    theme,\n    text,\n    shape,\n    size,\n    disableOneTap,\n    width,\n    className,\n    style,\n}: GoogleSignInProps) {\n    return (\n        <div className={className} style={style}>\n            {Component({\n                onSuccess: (response: { credential?: string }) => {\n                    if (!response.credential) {\n                        onError?.({\n                            provider: \"google\",\n                            message: \"Google returned no credential\",\n                            raw: response,\n                        });\n                        return;\n                    }\n                    return onSuccess({\n                        idToken: response.credential,\n                        provider: \"google\",\n                        raw: response,\n                    });\n                },\n                onError: () => {\n                    onError?.({\n                        provider: \"google\",\n                        message: \"Google login failed\",\n                    });\n                },\n                locale,\n                theme,\n                text,\n                shape,\n                size,\n                useOneTap: !disableOneTap,\n                width,\n            })}\n        </div>\n    );\n}\n"],"mappings":";;AAqEA,SAAgB,EAAa,EACzB,WAAW,GACX,cACA,YACA,WACA,UACA,SACA,UACA,SACA,kBACA,UACA,cACA,YACkB;CAClB,OACI,kBAAC,OAAD;EAAgB;EAAkB;EAC7B,UAAA,EAAU;GACP,YAAY,MAAsC;IAC9C,IAAI,CAAC,EAAS,YAAY;KACtB,IAAU;MACN,UAAU;MACV,SAAS;MACT,KAAK;KACT,CAAC;KACD;IACJ;IACA,OAAO,EAAU;KACb,SAAS,EAAS;KAClB,UAAU;KACV,KAAK;IACT,CAAC;GACL;GACA,eAAe;IACX,IAAU;KACN,UAAU;KACV,SAAS;IACb,CAAC;GACL;GACA;GACA;GACA;GACA;GACA;GACA,WAAW,CAAC;GACZ;EACJ,CAAC;CACA,CAAA;AAEb"}
+{"version":3,"file":"GoogleSignIn.js","names":["GoogleSignIn","Component","response","onSuccess","disableOneTap"],"sources":["../../src/oauth/GoogleSignIn.tsx"],"sourcesContent":["/**\n * @tempest-limits props-count — component, theme, text, shape, size and width are\n * Google's own button parameters, passed through with their names intact so the\n * reader can match them to Google's documentation;\n * onSuccess/onError/locale/disableOneTap are the wrapper's.\n */\nimport type { CSSProperties, ReactNode } from \"react\";\nimport type { OAuthCredential, OAuthError } from \"./types\";\n\nexport type GoogleSignInTheme = \"filled_blue\" | \"filled_black\" | \"outline\";\nexport type GoogleSignInText = \"signin_with\" | \"signup_with\" | \"continue_with\" | \"signin\";\nexport type GoogleSignInShape = \"rectangular\" | \"pill\" | \"circle\" | \"square\";\nexport type GoogleSignInSize = \"large\" | \"medium\" | \"small\";\n\nexport interface GoogleSignInProps {\n    /**\n     * `GoogleLogin` component from `@react-oauth/google`. The caller imports\n     * it and passes it through so the SDK doesn't take `@react-oauth/google`\n     * as a peer dep.\n     */\n    component: (props: Record<string, unknown>) => ReactNode;\n    /** Fired with the validated credential on success. */\n    onSuccess: (credential: OAuthCredential) => void | Promise<void>;\n    /** Fired with a normalised error on failure. */\n    onError?: (error: OAuthError) => void;\n    /** Optional locale override (e.g. `\"pt-BR\"`). Falls back to browser locale. */\n    locale?: string;\n    /** Visual theme — passed through to `<GoogleLogin>`. */\n    theme?: GoogleSignInTheme;\n    /** Button text variant. */\n    text?: GoogleSignInText;\n    /** Button shape. */\n    shape?: GoogleSignInShape;\n    /** Button size. */\n    size?: GoogleSignInSize;\n    /** Disable Google's \"One Tap\" auto-prompt. Default `false`. */\n    disableOneTap?: boolean;\n    /** Optional `width` override (px) — Google's button is fixed-width. */\n    width?: number;\n    /** Optional className applied to the wrapper. */\n    className?: string;\n    /** Optional inline style applied to the wrapper. */\n    style?: CSSProperties;\n}\n\n/**\n * Thin wrapper over `@react-oauth/google`'s `<GoogleLogin>` that:\n *\n * 1. Normalises the success payload into [[OAuthCredential]] (`idToken`,\n *    `provider: \"google\"`, `raw`).\n * 2. Normalises errors into [[OAuthError]].\n * 3. Lets you pass `GoogleLogin` via the `component` prop, so the SDK does\n *    not declare `@react-oauth/google` as a peer dep — apps that don't use\n *    Google never pay for it.\n *\n * @example\n * import { GoogleLogin, GoogleOAuthProvider } from \"@react-oauth/google\";\n * import { GoogleSignIn } from \"tempest-react-sdk\";\n *\n * <GoogleOAuthProvider clientId={import.meta.env.VITE_GOOGLE_CLIENT_ID}>\n *     <GoogleSignIn\n *         component={GoogleLogin}\n *         onSuccess={async ({ idToken }) => {\n *             await api.post(\"/auth/google\", { body: { id_token: idToken } });\n *         }}\n *         onError={(err) => toast.error(err.message)}\n *     />\n * </GoogleOAuthProvider>\n */\nexport function GoogleSignIn({\n    component: Component,\n    onSuccess,\n    onError,\n    locale,\n    theme,\n    text,\n    shape,\n    size,\n    disableOneTap,\n    width,\n    className,\n    style,\n}: GoogleSignInProps) {\n    return (\n        <div className={className} style={style}>\n            {Component({\n                onSuccess: (response: { credential?: string }) => {\n                    if (!response.credential) {\n                        onError?.({\n                            provider: \"google\",\n                            message: \"Google returned no credential\",\n                            raw: response,\n                        });\n                        return;\n                    }\n                    return onSuccess({\n                        idToken: response.credential,\n                        provider: \"google\",\n                        raw: response,\n                    });\n                },\n                onError: () => {\n                    onError?.({\n                        provider: \"google\",\n                        message: \"Google login failed\",\n                    });\n                },\n                locale,\n                theme,\n                text,\n                shape,\n                size,\n                useOneTap: !disableOneTap,\n                width,\n            })}\n        </div>\n    );\n}\n"],"mappings":";;AAqEA,SAAgBA,EAAa,EACzB,WAAWC,GACX,cACA,YACA,WACA,UACA,SACA,UACA,SACA,kBACA,UACA,cACA,YACkB;CAClB,OACI,kBAAC,OAAD;EAAgB;EAAkB;EAC7B,UAAAA,EAAU;GACP,YAAY,MAAsC;IAC9C,IAAI,CAACC,EAAS,YACV,IAAU;KACN,UAAU;KACV,SAAS;KACT,KAAKA;IACT,CAAC;SAGL,OAAOC,EAAU;KACb,SAASD,EAAS;KAClB,UAAU;KACV,KAAKA;IACT,CAAC;GACL;GACA,eAAe;IACX,IAAU;KACN,UAAU;KACV,SAAS;IACb,CAAC;GACL;GACA;GACA;GACA;GACA;GACA;GACA,WAAW,CAACE;GACZ;EACJ,CAAC;CACA,CAAA;AAEb"}

package/dist/oauth/callback.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"callback.cjs","names":[],"sources":["../../src/oauth/callback.ts"],"sourcesContent":["import type { ApiClient } from \"@/http/types\";\n\n/** Why {@link readOAuthCallbackParams} refused a callback URL. */\nexport type OAuthCallbackErrorReason = \"provider_error\" | \"missing_state\" | \"missing_code\";\n\n/**\n * A provider redirect that cannot be exchanged for a session.\n *\n * Thrown before any request leaves the browser, so a forged or truncated\n * callback never reaches the backend's exchange route.\n */\nexport class OAuthCallbackError extends Error {\n    /** Which part of the callback was wrong. */\n    readonly reason: OAuthCallbackErrorReason;\n    /** The provider's `error` param (e.g. `\"access_denied\"`), when `reason` is `\"provider_error\"`. */\n    readonly providerError?: string;\n\n    /**\n     * @param reason - Which part of the callback was wrong.\n     * @param providerError - The provider's `error` param, when it sent one.\n     */\n    constructor(reason: OAuthCallbackErrorReason, providerError?: string) {\n        super(\n            reason === \"provider_error\"\n                ? `OAuth provider returned an error: ${providerError ?? \"unknown\"}`\n                : `OAuth callback is missing the \"${reason === \"missing_state\" ? \"state\" : \"code\"}\" param`,\n        );\n        this.name = \"OAuthCallbackError\";\n        this.reason = reason;\n        this.providerError = providerError;\n    }\n}\n\n/** The two values a provider appends to the redirect URI on success. */\nexport interface OAuthCallbackParams {\n    /** Single-use authorization code. */\n    code: string;\n    /**\n     * The CSRF `state` the backend minted when the flow started. Forwarded\n     * verbatim: only the backend holds the value it must match.\n     */\n    state: string;\n}\n\n/** Options for {@link readOAuthCallbackParams}. */\nexport interface ReadOAuthCallbackOptions {\n    /**\n     * Remove `code` and `state` from the address bar after reading them, with\n     * `history.replaceState` — other params, the hash and `history.state` are\n     * kept. Default: `true` when reading `window.location`, `false` when an\n     * explicit `search` is passed (there is no URL of yours to clean then).\n     */\n    scrubUrl?: boolean;\n}\n\nconst CALLBACK_SECRETS: readonly string[] = [\"code\", \"state\"];\n\n/**\n * Drop `code` and `state` from the current URL without a navigation.\n *\n * Left in place, the single-use code sits in the history entry, in a bookmark,\n * in a shared screenshot and in the `Referer` of the next request. Passing\n * `history.state` back keeps a router's own bookkeeping (React Router's `idx`)\n * intact. No-op when neither param is present.\n */\nfunction scrubCallbackUrl(): void {\n    const url = new URL(window.location.href);\n    if (!CALLBACK_SECRETS.some((key) => url.searchParams.has(key))) return;\n    for (const key of CALLBACK_SECRETS) url.searchParams.delete(key);\n    window.history.replaceState(\n        window.history.state,\n        \"\",\n        `${url.pathname}${url.search}${url.hash}`,\n    );\n}\n\n/**\n * Read `code` and `state` from a provider's redirect, refusing an incomplete one.\n *\n * The `state` is what ties the callback to the browser that started the flow.\n * Without it, an attacker sends the victim to `/callback?code=<attacker's code>`\n * and the victim ends up signed in to the attacker's account — a login CSRF.\n * The old recipe read only `code` and posted `{ code }`, so the `state` never\n * reached a backend that could compare it (#449). This reader makes dropping it\n * impossible: it returns both or throws.\n *\n * It does **not** compare the state. In the `tempest-fastapi-sdk` flow the\n * backend mints it in `GET {prefix}/oauth/{provider}/login`, keeps it in an\n * `HttpOnly` cookie bound to the provider, and checks it with\n * `hmac.compare_digest` in the callback (single use, `AUTH_OAUTH_STATE_TTL_SECONDS`\n * expiry). The browser cannot read that cookie, so any check here would be\n * theatre; forwarding the value is the browser's whole job.\n *\n * When it reads `window.location`, it also removes `code` and `state` from the\n * address bar (see {@link ReadOAuthCallbackOptions.scrubUrl}) — before\n * validating, so a refused callback is cleaned too.\n *\n * @param search - The query string or params to read. Default: `window.location.search`.\n * @param options - Whether to scrub the URL.\n * @returns The `code` and `state`.\n * @throws {OAuthCallbackError} `\"provider_error\"` when the provider sent `error`\n *   (the user declined, for instance), `\"missing_state\"` without `state`,\n *   `\"missing_code\"` without `code`.\n *\n * @example\n * const { code, state } = readOAuthCallbackParams(\"?code=4%2F0A&state=xyz\");\n */\nexport function readOAuthCallbackParams(\n    search?: string | URLSearchParams,\n    options: ReadOAuthCallbackOptions = {},\n): OAuthCallbackParams {\n    const fromLocation = search === undefined;\n    const { scrubUrl = fromLocation } = options;\n    const source = search ?? globalThis.location?.search ?? \"\";\n    const params = typeof source === \"string\" ? new URLSearchParams(source) : source;\n    const error = params.get(\"error\");\n    const state = params.get(\"state\");\n    const code = params.get(\"code\");\n    if (scrubUrl && typeof window !== \"undefined\") scrubCallbackUrl();\n    if (error) throw new OAuthCallbackError(\"provider_error\", error);\n    if (!state) throw new OAuthCallbackError(\"missing_state\");\n    if (!code) throw new OAuthCallbackError(\"missing_code\");\n    return { code, state };\n}\n\n/** Options for {@link exchangeOAuthCallback}. */\nexport interface ExchangeOAuthCallbackOptions {\n    /**\n     * Path the backend's auth router is mounted at — the `prefix` given to\n     * `make_auth_router`. Default: `\"/auth\"`.\n     */\n    prefix?: string;\n    /** Where to read the provider's redirect from. Default: `window.location.search`. */\n    search?: string | URLSearchParams;\n    /** Forwarded to {@link readOAuthCallbackParams}. Default: scrub when reading `window.location`. */\n    scrubUrl?: boolean;\n    /** Abort the exchange. */\n    signal?: AbortSignal;\n}\n\n/**\n * Finish a `tempest-fastapi-sdk` social login from the SPA's callback route.\n *\n * Reads the redirect with {@link readOAuthCallbackParams} and forwards `code`\n * **and** `state` to `GET {prefix}/oauth/{provider}/callback`, where the backend\n * compares the state against its `HttpOnly` cookie, redeems the code and\n * answers with the same JWT pair `POST {prefix}/login` returns.\n *\n * The request goes with `credentials: \"include\"` because the state cookie is\n * the other half of the comparison; with `skipAuth`, since there is no session\n * yet and a `401` here means a forged or expired callback, not an expired token\n * to refresh; and with `retry: false`, because the backend clears the state\n * cookie on the first attempt and a code redeems once.\n *\n * Pass it as the `exchange` of {@link useOAuthCallback}, which runs it once even\n * under StrictMode.\n *\n * @param api - The client from `createApiClient` (or `createTempestAuth().api`).\n * @param provider - The provider key registered on the backend (e.g. `\"google\"`).\n * @param options - Router prefix, the query string to read, abort signal.\n * @returns The backend's login response.\n * @throws {OAuthCallbackError} Before any request, when the redirect carries\n *   `error` or lacks `state` or `code`.\n *\n * @example\n * const { loading, error } = useOAuthCallback<LoginResponse>({\n *     exchange: () => exchangeOAuthCallback<LoginResponse>(api, \"google\"),\n *     onSuccess: () => navigate(\"/\", { replace: true }),\n * });\n */\nexport async function exchangeOAuthCallback<T>(\n    api: ApiClient,\n    provider: string,\n    options: ExchangeOAuthCallbackOptions = {},\n): Promise<T> {\n    const { prefix = \"/auth\", search, scrubUrl, signal } = options;\n    const { code, state } = readOAuthCallbackParams(search, { scrubUrl });\n    const base = prefix.replace(/\\/+$/, \"\");\n    return api.get<T>(`${base}/oauth/${encodeURIComponent(provider)}/callback`, {\n        params: { code, state },\n        credentials: \"include\",\n        skipAuth: true,\n        retry: false,\n        signal,\n    });\n}\n"],"mappings":"AAWA,IAAa,EAAb,cAAwC,KAAM,CAE1C,OAEA,cAMA,YAAY,EAAkC,EAAwB,CAClE,MACI,IAAW,iBACL,qCAAqC,GAAiB,YACtD,kCAAkC,IAAW,gBAAkB,QAAU,OAAO,QAC1F,EACA,KAAK,KAAO,qBACZ,KAAK,OAAS,EACd,KAAK,cAAgB,CACzB,CACJ,EAwBM,EAAsC,CAAC,OAAQ,OAAO,EAU5D,SAAS,GAAyB,CAC9B,IAAM,EAAM,IAAI,IAAI,OAAO,SAAS,IAAI,EACnC,KAAiB,KAAM,GAAQ,EAAI,aAAa,IAAI,CAAG,CAAC,EAC7D,KAAK,IAAM,KAAO,EAAkB,EAAI,aAAa,OAAO,CAAG,EAC/D,OAAO,QAAQ,aACX,OAAO,QAAQ,MACf,GACA,GAAG,EAAI,WAAW,EAAI,SAAS,EAAI,MACvC,CAL+D,CAMnE,CAiCA,SAAgB,EACZ,EACA,EAAoC,CAAC,EAClB,CACnB,IAAM,EAAe,IAAW,IAAA,GAC1B,CAAE,WAAW,GAAiB,EAC9B,EAAS,GAAU,WAAW,UAAU,QAAU,GAClD,EAAS,OAAO,GAAW,SAAW,IAAI,gBAAgB,CAAM,EAAI,EACpE,EAAQ,EAAO,IAAI,OAAO,EAC1B,EAAQ,EAAO,IAAI,OAAO,EAC1B,EAAO,EAAO,IAAI,MAAM,EAE9B,GADI,GAAY,OAAO,OAAW,KAAa,EAAiB,EAC5D,EAAO,MAAM,IAAI,EAAmB,iBAAkB,CAAK,EAC/D,GAAI,CAAC,EAAO,MAAM,IAAI,EAAmB,eAAe,EACxD,GAAI,CAAC,EAAM,MAAM,IAAI,EAAmB,cAAc,EACtD,MAAO,CAAE,OAAM,OAAM,CACzB,CA+CA,eAAsB,EAClB,EACA,EACA,EAAwC,CAAC,EAC/B,CACV,GAAM,CAAE,SAAS,QAAS,SAAQ,WAAU,UAAW,EACjD,CAAE,OAAM,SAAU,EAAwB,EAAQ,CAAE,UAAS,CAAC,EAC9D,EAAO,EAAO,QAAQ,OAAQ,EAAE,EACtC,OAAO,EAAI,IAAO,GAAG,EAAK,SAAS,mBAAmB,CAAQ,EAAE,WAAY,CACxE,OAAQ,CAAE,OAAM,OAAM,EACtB,YAAa,UACb,SAAU,GACV,MAAO,GACP,QACJ,CAAC,CACL"}
+{"version":3,"file":"callback.cjs","names":["OAuthCallbackError","reason","providerError","CALLBACK_SECRETS","scrubCallbackUrl","url","key","readOAuthCallbackParams","fromLocation","search","options","source","params","error","state","code","scrubUrl","exchangeOAuthCallback","base","prefix","api","provider"],"sources":["../../src/oauth/callback.ts"],"sourcesContent":["import type { ApiClient } from \"@/http/types\";\n\n/** Why {@link readOAuthCallbackParams} refused a callback URL. */\nexport type OAuthCallbackErrorReason = \"provider_error\" | \"missing_state\" | \"missing_code\";\n\n/**\n * A provider redirect that cannot be exchanged for a session.\n *\n * Thrown before any request leaves the browser, so a forged or truncated\n * callback never reaches the backend's exchange route.\n */\nexport class OAuthCallbackError extends Error {\n    /** Which part of the callback was wrong. */\n    readonly reason: OAuthCallbackErrorReason;\n    /** The provider's `error` param (e.g. `\"access_denied\"`), when `reason` is `\"provider_error\"`. */\n    readonly providerError?: string;\n\n    /**\n     * @param reason - Which part of the callback was wrong.\n     * @param providerError - The provider's `error` param, when it sent one.\n     */\n    constructor(reason: OAuthCallbackErrorReason, providerError?: string) {\n        super(\n            reason === \"provider_error\"\n                ? `OAuth provider returned an error: ${providerError ?? \"unknown\"}`\n                : `OAuth callback is missing the \"${reason === \"missing_state\" ? \"state\" : \"code\"}\" param`,\n        );\n        this.name = \"OAuthCallbackError\";\n        this.reason = reason;\n        this.providerError = providerError;\n    }\n}\n\n/** The two values a provider appends to the redirect URI on success. */\nexport interface OAuthCallbackParams {\n    /** Single-use authorization code. */\n    code: string;\n    /**\n     * The CSRF `state` the backend minted when the flow started. Forwarded\n     * verbatim: only the backend holds the value it must match.\n     */\n    state: string;\n}\n\n/** Options for {@link readOAuthCallbackParams}. */\nexport interface ReadOAuthCallbackOptions {\n    /**\n     * Remove `code` and `state` from the address bar after reading them, with\n     * `history.replaceState` — other params, the hash and `history.state` are\n     * kept. Default: `true` when reading `window.location`, `false` when an\n     * explicit `search` is passed (there is no URL of yours to clean then).\n     */\n    scrubUrl?: boolean;\n}\n\nconst CALLBACK_SECRETS: readonly string[] = [\"code\", \"state\"];\n\n/**\n * Drop `code` and `state` from the current URL without a navigation.\n *\n * Left in place, the single-use code sits in the history entry, in a bookmark,\n * in a shared screenshot and in the `Referer` of the next request. Passing\n * `history.state` back keeps a router's own bookkeeping (React Router's `idx`)\n * intact. No-op when neither param is present.\n */\nfunction scrubCallbackUrl(): void {\n    const url = new URL(window.location.href);\n    if (!CALLBACK_SECRETS.some((key) => url.searchParams.has(key))) return;\n    for (const key of CALLBACK_SECRETS) url.searchParams.delete(key);\n    window.history.replaceState(\n        window.history.state,\n        \"\",\n        `${url.pathname}${url.search}${url.hash}`,\n    );\n}\n\n/**\n * Read `code` and `state` from a provider's redirect, refusing an incomplete one.\n *\n * The `state` is what ties the callback to the browser that started the flow.\n * Without it, an attacker sends the victim to `/callback?code=<attacker's code>`\n * and the victim ends up signed in to the attacker's account — a login CSRF.\n * The old recipe read only `code` and posted `{ code }`, so the `state` never\n * reached a backend that could compare it (#449). This reader makes dropping it\n * impossible: it returns both or throws.\n *\n * It does **not** compare the state. In the `tempest-fastapi-sdk` flow the\n * backend mints it in `GET {prefix}/oauth/{provider}/login`, keeps it in an\n * `HttpOnly` cookie bound to the provider, and checks it with\n * `hmac.compare_digest` in the callback (single use, `AUTH_OAUTH_STATE_TTL_SECONDS`\n * expiry). The browser cannot read that cookie, so any check here would be\n * theatre; forwarding the value is the browser's whole job.\n *\n * When it reads `window.location`, it also removes `code` and `state` from the\n * address bar (see {@link ReadOAuthCallbackOptions.scrubUrl}) — before\n * validating, so a refused callback is cleaned too.\n *\n * @param search - The query string or params to read. Default: `window.location.search`.\n * @param options - Whether to scrub the URL.\n * @returns The `code` and `state`.\n * @throws {OAuthCallbackError} `\"provider_error\"` when the provider sent `error`\n *   (the user declined, for instance), `\"missing_state\"` without `state`,\n *   `\"missing_code\"` without `code`.\n *\n * @example\n * const { code, state } = readOAuthCallbackParams(\"?code=4%2F0A&state=xyz\");\n */\nexport function readOAuthCallbackParams(\n    search?: string | URLSearchParams,\n    options: ReadOAuthCallbackOptions = {},\n): OAuthCallbackParams {\n    const fromLocation = search === undefined;\n    const { scrubUrl = fromLocation } = options;\n    const source = search ?? globalThis.location?.search ?? \"\";\n    const params = typeof source === \"string\" ? new URLSearchParams(source) : source;\n    const error = params.get(\"error\");\n    const state = params.get(\"state\");\n    const code = params.get(\"code\");\n    if (scrubUrl && typeof window !== \"undefined\") scrubCallbackUrl();\n    if (error) throw new OAuthCallbackError(\"provider_error\", error);\n    if (!state) throw new OAuthCallbackError(\"missing_state\");\n    if (!code) throw new OAuthCallbackError(\"missing_code\");\n    return { code, state };\n}\n\n/** Options for {@link exchangeOAuthCallback}. */\nexport interface ExchangeOAuthCallbackOptions {\n    /**\n     * Path the backend's auth router is mounted at — the `prefix` given to\n     * `make_auth_router`. Default: `\"/auth\"`.\n     */\n    prefix?: string;\n    /** Where to read the provider's redirect from. Default: `window.location.search`. */\n    search?: string | URLSearchParams;\n    /** Forwarded to {@link readOAuthCallbackParams}. Default: scrub when reading `window.location`. */\n    scrubUrl?: boolean;\n    /** Abort the exchange. */\n    signal?: AbortSignal;\n}\n\n/**\n * Finish a `tempest-fastapi-sdk` social login from the SPA's callback route.\n *\n * Reads the redirect with {@link readOAuthCallbackParams} and forwards `code`\n * **and** `state` to `GET {prefix}/oauth/{provider}/callback`, where the backend\n * compares the state against its `HttpOnly` cookie, redeems the code and\n * answers with the same JWT pair `POST {prefix}/login` returns.\n *\n * The request goes with `credentials: \"include\"` because the state cookie is\n * the other half of the comparison; with `skipAuth`, since there is no session\n * yet and a `401` here means a forged or expired callback, not an expired token\n * to refresh; and with `retry: false`, because the backend clears the state\n * cookie on the first attempt and a code redeems once.\n *\n * Pass it as the `exchange` of {@link useOAuthCallback}, which runs it once even\n * under StrictMode.\n *\n * @param api - The client from `createApiClient` (or `createTempestAuth().api`).\n * @param provider - The provider key registered on the backend (e.g. `\"google\"`).\n * @param options - Router prefix, the query string to read, abort signal.\n * @returns The backend's login response.\n * @throws {OAuthCallbackError} Before any request, when the redirect carries\n *   `error` or lacks `state` or `code`.\n *\n * @example\n * const { loading, error } = useOAuthCallback<LoginResponse>({\n *     exchange: () => exchangeOAuthCallback<LoginResponse>(api, \"google\"),\n *     onSuccess: () => navigate(\"/\", { replace: true }),\n * });\n */\nexport async function exchangeOAuthCallback<T>(\n    api: ApiClient,\n    provider: string,\n    options: ExchangeOAuthCallbackOptions = {},\n): Promise<T> {\n    const { prefix = \"/auth\", search, scrubUrl, signal } = options;\n    const { code, state } = readOAuthCallbackParams(search, { scrubUrl });\n    const base = prefix.replace(/\\/+$/, \"\");\n    return api.get<T>(`${base}/oauth/${encodeURIComponent(provider)}/callback`, {\n        params: { code, state },\n        credentials: \"include\",\n        skipAuth: true,\n        retry: false,\n        signal,\n    });\n}\n"],"mappings":"AAWA,IAAaA,EAAb,cAAwC,KAAM,CAE1C,OAEA,cAMA,YAAY,EAAkC,EAAwB,CAClE,MACIC,IAAW,iBACL,qCAAqCC,GAAiB,YACtD,kCAAkCD,IAAW,gBAAkB,QAAU,OAAO,QAC1F,EACA,KAAK,KAAO,qBACZ,KAAK,OAASA,EACd,KAAK,cAAgBC,CACzB,CACJ,EAwBMC,EAAsC,CAAC,OAAQ,OAAO,EAU5D,SAASC,GAAyB,CAC9B,IAAMC,EAAM,IAAI,IAAI,OAAO,SAAS,IAAI,EACxC,GAAKF,EAAiB,KAAM,GAAQE,EAAI,aAAa,IAAIC,CAAG,CAAC,EAC7D,KAAK,IAAMA,KAAOH,EAAkBE,EAAI,aAAa,OAAOC,CAAG,EAC/D,OAAO,QAAQ,aACX,OAAO,QAAQ,MACf,GACA,GAAGD,EAAI,WAAWA,EAAI,SAASA,EAAI,MACvC,CAL+D,CAMnE,CAiCA,SAAgBE,EACZ,EACA,EAAoC,CAAC,EAClB,CACnB,IAAMC,EAAeC,IAAW,IAAA,GAC1B,CAAE,WAAWD,GAAiBE,EAC9BC,EAASF,GAAU,WAAW,UAAU,QAAU,GAClDG,EAAS,OAAOD,GAAW,SAAW,IAAI,gBAAgBA,CAAM,EAAIA,EACpEE,EAAQD,EAAO,IAAI,OAAO,EAC1BE,EAAQF,EAAO,IAAI,OAAO,EAC1BG,EAAOH,EAAO,IAAI,MAAM,EAE9B,GADII,GAAY,OAAO,OAAW,KAAaZ,EAAiB,EAC5DS,EAAO,MAAM,IAAIb,EAAmB,iBAAkBa,CAAK,EAC/D,GAAI,CAACC,EAAO,MAAM,IAAId,EAAmB,eAAe,EACxD,GAAI,CAACe,EAAM,MAAM,IAAIf,EAAmB,cAAc,EACtD,MAAO,CAAE,OAAM,OAAM,CACzB,CA+CA,eAAsBiB,EAClB,EACA,EACA,EAAwC,CAAC,EAC/B,CACV,GAAM,CAAE,SAAS,QAAS,SAAQ,WAAU,UAAWP,EACjD,CAAE,OAAM,SAAUH,EAAwBE,EAAQ,CAAE,UAAS,CAAC,EAC9DS,EAAOC,EAAO,QAAQ,OAAQ,EAAE,EACtC,OAAOC,EAAI,IAAO,GAAGF,EAAK,SAAS,mBAAmBG,CAAQ,EAAE,WAAY,CACxE,OAAQ,CAAE,OAAM,OAAM,EACtB,YAAa,UACb,SAAU,GACV,MAAO,GACP,QACJ,CAAC,CACL,C"}

package/dist/oauth/callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback.js","names":[],"sources":["../../src/oauth/callback.ts"],"sourcesContent":["import type { ApiClient } from \"@/http/types\";\n\n/** Why {@link readOAuthCallbackParams} refused a callback URL. */\nexport type OAuthCallbackErrorReason = \"provider_error\" | \"missing_state\" | \"missing_code\";\n\n/**\n * A provider redirect that cannot be exchanged for a session.\n *\n * Thrown before any request leaves the browser, so a forged or truncated\n * callback never reaches the backend's exchange route.\n */\nexport class OAuthCallbackError extends Error {\n    /** Which part of the callback was wrong. */\n    readonly reason: OAuthCallbackErrorReason;\n    /** The provider's `error` param (e.g. `\"access_denied\"`), when `reason` is `\"provider_error\"`. */\n    readonly providerError?: string;\n\n    /**\n     * @param reason - Which part of the callback was wrong.\n     * @param providerError - The provider's `error` param, when it sent one.\n     */\n    constructor(reason: OAuthCallbackErrorReason, providerError?: string) {\n        super(\n            reason === \"provider_error\"\n                ? `OAuth provider returned an error: ${providerError ?? \"unknown\"}`\n                : `OAuth callback is missing the \"${reason === \"missing_state\" ? \"state\" : \"code\"}\" param`,\n        );\n        this.name = \"OAuthCallbackError\";\n        this.reason = reason;\n        this.providerError = providerError;\n    }\n}\n\n/** The two values a provider appends to the redirect URI on success. */\nexport interface OAuthCallbackParams {\n    /** Single-use authorization code. */\n    code: string;\n    /**\n     * The CSRF `state` the backend minted when the flow started. Forwarded\n     * verbatim: only the backend holds the value it must match.\n     */\n    state: string;\n}\n\n/** Options for {@link readOAuthCallbackParams}. */\nexport interface ReadOAuthCallbackOptions {\n    /**\n     * Remove `code` and `state` from the address bar after reading them, with\n     * `history.replaceState` — other params, the hash and `history.state` are\n     * kept. Default: `true` when reading `window.location`, `false` when an\n     * explicit `search` is passed (there is no URL of yours to clean then).\n     */\n    scrubUrl?: boolean;\n}\n\nconst CALLBACK_SECRETS: readonly string[] = [\"code\", \"state\"];\n\n/**\n * Drop `code` and `state` from the current URL without a navigation.\n *\n * Left in place, the single-use code sits in the history entry, in a bookmark,\n * in a shared screenshot and in the `Referer` of the next request. Passing\n * `history.state` back keeps a router's own bookkeeping (React Router's `idx`)\n * intact. No-op when neither param is present.\n */\nfunction scrubCallbackUrl(): void {\n    const url = new URL(window.location.href);\n    if (!CALLBACK_SECRETS.some((key) => url.searchParams.has(key))) return;\n    for (const key of CALLBACK_SECRETS) url.searchParams.delete(key);\n    window.history.replaceState(\n        window.history.state,\n        \"\",\n        `${url.pathname}${url.search}${url.hash}`,\n    );\n}\n\n/**\n * Read `code` and `state` from a provider's redirect, refusing an incomplete one.\n *\n * The `state` is what ties the callback to the browser that started the flow.\n * Without it, an attacker sends the victim to `/callback?code=<attacker's code>`\n * and the victim ends up signed in to the attacker's account — a login CSRF.\n * The old recipe read only `code` and posted `{ code }`, so the `state` never\n * reached a backend that could compare it (#449). This reader makes dropping it\n * impossible: it returns both or throws.\n *\n * It does **not** compare the state. In the `tempest-fastapi-sdk` flow the\n * backend mints it in `GET {prefix}/oauth/{provider}/login`, keeps it in an\n * `HttpOnly` cookie bound to the provider, and checks it with\n * `hmac.compare_digest` in the callback (single use, `AUTH_OAUTH_STATE_TTL_SECONDS`\n * expiry). The browser cannot read that cookie, so any check here would be\n * theatre; forwarding the value is the browser's whole job.\n *\n * When it reads `window.location`, it also removes `code` and `state` from the\n * address bar (see {@link ReadOAuthCallbackOptions.scrubUrl}) — before\n * validating, so a refused callback is cleaned too.\n *\n * @param search - The query string or params to read. Default: `window.location.search`.\n * @param options - Whether to scrub the URL.\n * @returns The `code` and `state`.\n * @throws {OAuthCallbackError} `\"provider_error\"` when the provider sent `error`\n *   (the user declined, for instance), `\"missing_state\"` without `state`,\n *   `\"missing_code\"` without `code`.\n *\n * @example\n * const { code, state } = readOAuthCallbackParams(\"?code=4%2F0A&state=xyz\");\n */\nexport function readOAuthCallbackParams(\n    search?: string | URLSearchParams,\n    options: ReadOAuthCallbackOptions = {},\n): OAuthCallbackParams {\n    const fromLocation = search === undefined;\n    const { scrubUrl = fromLocation } = options;\n    const source = search ?? globalThis.location?.search ?? \"\";\n    const params = typeof source === \"string\" ? new URLSearchParams(source) : source;\n    const error = params.get(\"error\");\n    const state = params.get(\"state\");\n    const code = params.get(\"code\");\n    if (scrubUrl && typeof window !== \"undefined\") scrubCallbackUrl();\n    if (error) throw new OAuthCallbackError(\"provider_error\", error);\n    if (!state) throw new OAuthCallbackError(\"missing_state\");\n    if (!code) throw new OAuthCallbackError(\"missing_code\");\n    return { code, state };\n}\n\n/** Options for {@link exchangeOAuthCallback}. */\nexport interface ExchangeOAuthCallbackOptions {\n    /**\n     * Path the backend's auth router is mounted at — the `prefix` given to\n     * `make_auth_router`. Default: `\"/auth\"`.\n     */\n    prefix?: string;\n    /** Where to read the provider's redirect from. Default: `window.location.search`. */\n    search?: string | URLSearchParams;\n    /** Forwarded to {@link readOAuthCallbackParams}. Default: scrub when reading `window.location`. */\n    scrubUrl?: boolean;\n    /** Abort the exchange. */\n    signal?: AbortSignal;\n}\n\n/**\n * Finish a `tempest-fastapi-sdk` social login from the SPA's callback route.\n *\n * Reads the redirect with {@link readOAuthCallbackParams} and forwards `code`\n * **and** `state` to `GET {prefix}/oauth/{provider}/callback`, where the backend\n * compares the state against its `HttpOnly` cookie, redeems the code and\n * answers with the same JWT pair `POST {prefix}/login` returns.\n *\n * The request goes with `credentials: \"include\"` because the state cookie is\n * the other half of the comparison; with `skipAuth`, since there is no session\n * yet and a `401` here means a forged or expired callback, not an expired token\n * to refresh; and with `retry: false`, because the backend clears the state\n * cookie on the first attempt and a code redeems once.\n *\n * Pass it as the `exchange` of {@link useOAuthCallback}, which runs it once even\n * under StrictMode.\n *\n * @param api - The client from `createApiClient` (or `createTempestAuth().api`).\n * @param provider - The provider key registered on the backend (e.g. `\"google\"`).\n * @param options - Router prefix, the query string to read, abort signal.\n * @returns The backend's login response.\n * @throws {OAuthCallbackError} Before any request, when the redirect carries\n *   `error` or lacks `state` or `code`.\n *\n * @example\n * const { loading, error } = useOAuthCallback<LoginResponse>({\n *     exchange: () => exchangeOAuthCallback<LoginResponse>(api, \"google\"),\n *     onSuccess: () => navigate(\"/\", { replace: true }),\n * });\n */\nexport async function exchangeOAuthCallback<T>(\n    api: ApiClient,\n    provider: string,\n    options: ExchangeOAuthCallbackOptions = {},\n): Promise<T> {\n    const { prefix = \"/auth\", search, scrubUrl, signal } = options;\n    const { code, state } = readOAuthCallbackParams(search, { scrubUrl });\n    const base = prefix.replace(/\\/+$/, \"\");\n    return api.get<T>(`${base}/oauth/${encodeURIComponent(provider)}/callback`, {\n        params: { code, state },\n        credentials: \"include\",\n        skipAuth: true,\n        retry: false,\n        signal,\n    });\n}\n"],"mappings":";AAWA,IAAa,IAAb,cAAwC,MAAM;CAE1C;CAEA;CAMA,YAAY,GAAkC,GAAwB;EAQlE,AAPA,MACI,MAAW,mBACL,qCAAqC,KAAiB,cACtD,kCAAkC,MAAW,kBAAkB,UAAU,OAAO,QAC1F,GACA,KAAK,OAAO,sBACZ,KAAK,SAAS,GACd,KAAK,gBAAgB;CACzB;AACJ,GAwBM,IAAsC,CAAC,QAAQ,OAAO;AAU5D,SAAS,IAAyB;CAC9B,IAAM,IAAM,IAAI,IAAI,OAAO,SAAS,IAAI;CACnC,MAAiB,MAAM,MAAQ,EAAI,aAAa,IAAI,CAAG,CAAC,GAC7D;OAAK,IAAM,KAAO,GAAkB,EAAI,aAAa,OAAO,CAAG;EAC/D,OAAO,QAAQ,aACX,OAAO,QAAQ,OACf,IACA,GAAG,EAAI,WAAW,EAAI,SAAS,EAAI,MACvC;CAL+D;AAMnE;AAiCA,SAAgB,EACZ,GACA,IAAoC,CAAC,GAClB;CACnB,IAAM,IAAe,MAAW,KAAA,GAC1B,EAAE,cAAW,MAAiB,GAC9B,IAAS,KAAU,WAAW,UAAU,UAAU,IAClD,IAAS,OAAO,KAAW,WAAW,IAAI,gBAAgB,CAAM,IAAI,GACpE,IAAQ,EAAO,IAAI,OAAO,GAC1B,IAAQ,EAAO,IAAI,OAAO,GAC1B,IAAO,EAAO,IAAI,MAAM;CAE9B,IADI,KAAY,OAAO,SAAW,OAAa,EAAiB,GAC5D,GAAO,MAAM,IAAI,EAAmB,kBAAkB,CAAK;CAC/D,IAAI,CAAC,GAAO,MAAM,IAAI,EAAmB,eAAe;CACxD,IAAI,CAAC,GAAM,MAAM,IAAI,EAAmB,cAAc;CACtD,OAAO;EAAE;EAAM;CAAM;AACzB;AA+CA,eAAsB,EAClB,GACA,GACA,IAAwC,CAAC,GAC/B;CACV,IAAM,EAAE,YAAS,SAAS,WAAQ,aAAU,cAAW,GACjD,EAAE,SAAM,aAAU,EAAwB,GAAQ,EAAE,YAAS,CAAC,GAC9D,IAAO,EAAO,QAAQ,QAAQ,EAAE;CACtC,OAAO,EAAI,IAAO,GAAG,EAAK,SAAS,mBAAmB,CAAQ,EAAE,YAAY;EACxE,QAAQ;GAAE;GAAM;EAAM;EACtB,aAAa;EACb,UAAU;EACV,OAAO;EACP;CACJ,CAAC;AACL"}
+{"version":3,"file":"callback.js","names":["OAuthCallbackError","reason","providerError","CALLBACK_SECRETS","scrubCallbackUrl","url","key","readOAuthCallbackParams","fromLocation","search","options","source","params","error","state","code","scrubUrl","exchangeOAuthCallback","base","prefix","api","provider"],"sources":["../../src/oauth/callback.ts"],"sourcesContent":["import type { ApiClient } from \"@/http/types\";\n\n/** Why {@link readOAuthCallbackParams} refused a callback URL. */\nexport type OAuthCallbackErrorReason = \"provider_error\" | \"missing_state\" | \"missing_code\";\n\n/**\n * A provider redirect that cannot be exchanged for a session.\n *\n * Thrown before any request leaves the browser, so a forged or truncated\n * callback never reaches the backend's exchange route.\n */\nexport class OAuthCallbackError extends Error {\n    /** Which part of the callback was wrong. */\n    readonly reason: OAuthCallbackErrorReason;\n    /** The provider's `error` param (e.g. `\"access_denied\"`), when `reason` is `\"provider_error\"`. */\n    readonly providerError?: string;\n\n    /**\n     * @param reason - Which part of the callback was wrong.\n     * @param providerError - The provider's `error` param, when it sent one.\n     */\n    constructor(reason: OAuthCallbackErrorReason, providerError?: string) {\n        super(\n            reason === \"provider_error\"\n                ? `OAuth provider returned an error: ${providerError ?? \"unknown\"}`\n                : `OAuth callback is missing the \"${reason === \"missing_state\" ? \"state\" : \"code\"}\" param`,\n        );\n        this.name = \"OAuthCallbackError\";\n        this.reason = reason;\n        this.providerError = providerError;\n    }\n}\n\n/** The two values a provider appends to the redirect URI on success. */\nexport interface OAuthCallbackParams {\n    /** Single-use authorization code. */\n    code: string;\n    /**\n     * The CSRF `state` the backend minted when the flow started. Forwarded\n     * verbatim: only the backend holds the value it must match.\n     */\n    state: string;\n}\n\n/** Options for {@link readOAuthCallbackParams}. */\nexport interface ReadOAuthCallbackOptions {\n    /**\n     * Remove `code` and `state` from the address bar after reading them, with\n     * `history.replaceState` — other params, the hash and `history.state` are\n     * kept. Default: `true` when reading `window.location`, `false` when an\n     * explicit `search` is passed (there is no URL of yours to clean then).\n     */\n    scrubUrl?: boolean;\n}\n\nconst CALLBACK_SECRETS: readonly string[] = [\"code\", \"state\"];\n\n/**\n * Drop `code` and `state` from the current URL without a navigation.\n *\n * Left in place, the single-use code sits in the history entry, in a bookmark,\n * in a shared screenshot and in the `Referer` of the next request. Passing\n * `history.state` back keeps a router's own bookkeeping (React Router's `idx`)\n * intact. No-op when neither param is present.\n */\nfunction scrubCallbackUrl(): void {\n    const url = new URL(window.location.href);\n    if (!CALLBACK_SECRETS.some((key) => url.searchParams.has(key))) return;\n    for (const key of CALLBACK_SECRETS) url.searchParams.delete(key);\n    window.history.replaceState(\n        window.history.state,\n        \"\",\n        `${url.pathname}${url.search}${url.hash}`,\n    );\n}\n\n/**\n * Read `code` and `state` from a provider's redirect, refusing an incomplete one.\n *\n * The `state` is what ties the callback to the browser that started the flow.\n * Without it, an attacker sends the victim to `/callback?code=<attacker's code>`\n * and the victim ends up signed in to the attacker's account — a login CSRF.\n * The old recipe read only `code` and posted `{ code }`, so the `state` never\n * reached a backend that could compare it (#449). This reader makes dropping it\n * impossible: it returns both or throws.\n *\n * It does **not** compare the state. In the `tempest-fastapi-sdk` flow the\n * backend mints it in `GET {prefix}/oauth/{provider}/login`, keeps it in an\n * `HttpOnly` cookie bound to the provider, and checks it with\n * `hmac.compare_digest` in the callback (single use, `AUTH_OAUTH_STATE_TTL_SECONDS`\n * expiry). The browser cannot read that cookie, so any check here would be\n * theatre; forwarding the value is the browser's whole job.\n *\n * When it reads `window.location`, it also removes `code` and `state` from the\n * address bar (see {@link ReadOAuthCallbackOptions.scrubUrl}) — before\n * validating, so a refused callback is cleaned too.\n *\n * @param search - The query string or params to read. Default: `window.location.search`.\n * @param options - Whether to scrub the URL.\n * @returns The `code` and `state`.\n * @throws {OAuthCallbackError} `\"provider_error\"` when the provider sent `error`\n *   (the user declined, for instance), `\"missing_state\"` without `state`,\n *   `\"missing_code\"` without `code`.\n *\n * @example\n * const { code, state } = readOAuthCallbackParams(\"?code=4%2F0A&state=xyz\");\n */\nexport function readOAuthCallbackParams(\n    search?: string | URLSearchParams,\n    options: ReadOAuthCallbackOptions = {},\n): OAuthCallbackParams {\n    const fromLocation = search === undefined;\n    const { scrubUrl = fromLocation } = options;\n    const source = search ?? globalThis.location?.search ?? \"\";\n    const params = typeof source === \"string\" ? new URLSearchParams(source) : source;\n    const error = params.get(\"error\");\n    const state = params.get(\"state\");\n    const code = params.get(\"code\");\n    if (scrubUrl && typeof window !== \"undefined\") scrubCallbackUrl();\n    if (error) throw new OAuthCallbackError(\"provider_error\", error);\n    if (!state) throw new OAuthCallbackError(\"missing_state\");\n    if (!code) throw new OAuthCallbackError(\"missing_code\");\n    return { code, state };\n}\n\n/** Options for {@link exchangeOAuthCallback}. */\nexport interface ExchangeOAuthCallbackOptions {\n    /**\n     * Path the backend's auth router is mounted at — the `prefix` given to\n     * `make_auth_router`. Default: `\"/auth\"`.\n     */\n    prefix?: string;\n    /** Where to read the provider's redirect from. Default: `window.location.search`. */\n    search?: string | URLSearchParams;\n    /** Forwarded to {@link readOAuthCallbackParams}. Default: scrub when reading `window.location`. */\n    scrubUrl?: boolean;\n    /** Abort the exchange. */\n    signal?: AbortSignal;\n}\n\n/**\n * Finish a `tempest-fastapi-sdk` social login from the SPA's callback route.\n *\n * Reads the redirect with {@link readOAuthCallbackParams} and forwards `code`\n * **and** `state` to `GET {prefix}/oauth/{provider}/callback`, where the backend\n * compares the state against its `HttpOnly` cookie, redeems the code and\n * answers with the same JWT pair `POST {prefix}/login` returns.\n *\n * The request goes with `credentials: \"include\"` because the state cookie is\n * the other half of the comparison; with `skipAuth`, since there is no session\n * yet and a `401` here means a forged or expired callback, not an expired token\n * to refresh; and with `retry: false`, because the backend clears the state\n * cookie on the first attempt and a code redeems once.\n *\n * Pass it as the `exchange` of {@link useOAuthCallback}, which runs it once even\n * under StrictMode.\n *\n * @param api - The client from `createApiClient` (or `createTempestAuth().api`).\n * @param provider - The provider key registered on the backend (e.g. `\"google\"`).\n * @param options - Router prefix, the query string to read, abort signal.\n * @returns The backend's login response.\n * @throws {OAuthCallbackError} Before any request, when the redirect carries\n *   `error` or lacks `state` or `code`.\n *\n * @example\n * const { loading, error } = useOAuthCallback<LoginResponse>({\n *     exchange: () => exchangeOAuthCallback<LoginResponse>(api, \"google\"),\n *     onSuccess: () => navigate(\"/\", { replace: true }),\n * });\n */\nexport async function exchangeOAuthCallback<T>(\n    api: ApiClient,\n    provider: string,\n    options: ExchangeOAuthCallbackOptions = {},\n): Promise<T> {\n    const { prefix = \"/auth\", search, scrubUrl, signal } = options;\n    const { code, state } = readOAuthCallbackParams(search, { scrubUrl });\n    const base = prefix.replace(/\\/+$/, \"\");\n    return api.get<T>(`${base}/oauth/${encodeURIComponent(provider)}/callback`, {\n        params: { code, state },\n        credentials: \"include\",\n        skipAuth: true,\n        retry: false,\n        signal,\n    });\n}\n"],"mappings":";AAWA,IAAaA,IAAb,cAAwC,MAAM;CAE1C;CAEA;CAMA,YAAY,GAAkC,GAAwB;EAQlE,AAPA,MACIC,MAAW,mBACL,qCAAqCC,KAAiB,cACtD,kCAAkCD,MAAW,kBAAkB,UAAU,OAAO,QAC1F,GACA,KAAK,OAAO,sBACZ,KAAK,SAASA,GACd,KAAK,gBAAgBC;CACzB;AACJ,GAwBMC,IAAsC,CAAC,QAAQ,OAAO;AAU5D,SAASC,IAAyB;CAC9B,IAAMC,IAAM,IAAI,IAAI,OAAO,SAAS,IAAI;CACxC,IAAKF,EAAiB,MAAM,MAAQE,EAAI,aAAa,IAAIC,CAAG,CAAC,GAC7D;OAAK,IAAMA,KAAOH,GAAkB,EAAI,aAAa,OAAOG,CAAG;EAC/D,OAAO,QAAQ,aACX,OAAO,QAAQ,OACf,IACA,GAAGD,EAAI,WAAWA,EAAI,SAASA,EAAI,MACvC;CAL+D;AAMnE;AAiCA,SAAgBE,EACZ,GACA,IAAoC,CAAC,GAClB;CACnB,IAAMC,IAAeC,MAAW,KAAA,GAC1B,EAAE,cAAWD,MAAiBE,GAC9BC,IAASF,KAAU,WAAW,UAAU,UAAU,IAClDG,IAAS,OAAOD,KAAW,WAAW,IAAI,gBAAgBA,CAAM,IAAIA,GACpEE,IAAQD,EAAO,IAAI,OAAO,GAC1BE,IAAQF,EAAO,IAAI,OAAO,GAC1BG,IAAOH,EAAO,IAAI,MAAM;CAE9B,IADII,KAAY,OAAO,SAAW,OAAaZ,EAAiB,GAC5DS,GAAO,MAAM,IAAIb,EAAmB,kBAAkBa,CAAK;CAC/D,IAAI,CAACC,GAAO,MAAM,IAAId,EAAmB,eAAe;CACxD,IAAI,CAACe,GAAM,MAAM,IAAIf,EAAmB,cAAc;CACtD,OAAO;EAAE;EAAM;CAAM;AACzB;AA+CA,eAAsBiB,EAClB,GACA,GACA,IAAwC,CAAC,GAC/B;CACV,IAAM,EAAE,YAAS,SAAS,WAAQ,aAAU,cAAWP,GACjD,EAAE,SAAM,aAAUH,EAAwBE,GAAQ,EAAE,YAAS,CAAC,GAC9DS,IAAOC,EAAO,QAAQ,QAAQ,EAAE;CACtC,OAAOC,EAAI,IAAO,GAAGF,EAAK,SAAS,mBAAmBG,CAAQ,EAAE,YAAY;EACxE,QAAQ;GAAE;GAAM;EAAM;EACtB,aAAa;EACb,UAAU;EACV,OAAO;EACP;CACJ,CAAC;AACL"}

package/dist/oauth/use-oauth-callback.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-oauth-callback.cjs","names":[],"sources":["../../src/oauth/use-oauth-callback.ts"],"sourcesContent":["import { useEffect, useRef, useState } from \"react\";\n\nexport interface UseOAuthCallbackOptions<T> {\n    /** Function that exchanges the provider response for an app session. Called once on mount. */\n    exchange: () => Promise<T>;\n    /** Fired with the result on success. Receives the value resolved by `exchange`. */\n    onSuccess?: (result: T) => void | Promise<void>;\n    /** Fired when `exchange` throws or rejects. */\n    onError?: (error: unknown) => void;\n}\n\nexport interface UseOAuthCallbackResult<T> {\n    /** `true` while the exchange promise is pending. */\n    loading: boolean;\n    /** Last resolved value, when `status === \"success\"`. */\n    data: T | null;\n    /** Last rejection reason, when `status === \"error\"`. */\n    error: unknown;\n    /** Aggregated state — `\"pending\"`, `\"success\"`, or `\"error\"`. */\n    status: \"pending\" | \"success\" | \"error\";\n}\n\n/**\n * Run an OAuth-callback \"exchange\" exactly once on mount. Designed for\n * `/callback` routes that receive provider redirects and need to swap a\n * code/token for an app session via the backend.\n *\n * Runs `exchange` once per logical mount and keeps its result. StrictMode's\n * simulated unmount/remount in dev and a parent re-render with inline\n * callbacks used to cancel the only exchange and skip the second, leaving the\n * hook `\"pending\"` forever with the single-use code already spent. Now the\n * options live in a latest-value ref, the effect has no dependencies, and the\n * result is dropped only when the component is still unmounted when it lands.\n * The newest `onSuccess`/`onError` are the ones called.\n *\n * For a provider redirect, the exchange must carry the `state` along with the\n * `code`, or no backend can tell a forged callback from a real one (login\n * CSRF). `exchangeOAuthCallback` does that against a\n * `tempest-fastapi-sdk` backend; `readOAuthCallbackParams` returns both\n * values (or throws) for any other backend.\n *\n * @example\n * function OAuthCallback() {\n *     const { loading, error } = useOAuthCallback<LoginResponse>({\n *         exchange: () => exchangeOAuthCallback<LoginResponse>(api, \"google\"),\n *         onSuccess: ({ user_id, access_token }) => {\n *             useAuthStore.getState().setSession({ user: { id: user_id }, token: access_token });\n *             navigate(\"/dashboard\", { replace: true });\n *         },\n *         onError: () => navigate(\"/login?error=oauth\", { replace: true }),\n *     });\n *\n *     if (loading) return <Spinner />;\n *     if (error) return <ErrorState description=\"OAuth falhou\" />;\n *     return null;\n * }\n */\nexport function useOAuthCallback<T>(\n    options: UseOAuthCallbackOptions<T>,\n): UseOAuthCallbackResult<T> {\n    const [data, setData] = useState<T | null>(null);\n    const [error, setError] = useState<unknown>(null);\n    const [status, setStatus] = useState<\"pending\" | \"success\" | \"error\">(\"pending\");\n    const optionsRef = useRef<UseOAuthCallbackOptions<T>>(options);\n    const ranRef = useRef<boolean>(false);\n    const mountedRef = useRef<boolean>(false);\n\n    useEffect(() => {\n        optionsRef.current = options;\n    });\n\n    useEffect(() => {\n        mountedRef.current = true;\n        if (!ranRef.current) {\n            ranRef.current = true;\n            optionsRef.current\n                .exchange()\n                .then((result) => {\n                    if (!mountedRef.current) return;\n                    setData(result);\n                    setStatus(\"success\");\n                    return optionsRef.current.onSuccess?.(result);\n                })\n                .catch((err: unknown) => {\n                    if (!mountedRef.current) return;\n                    setError(err);\n                    setStatus(\"error\");\n                    optionsRef.current.onError?.(err);\n                });\n        }\n        return () => {\n            mountedRef.current = false;\n        };\n    }, []);\n\n    return { loading: status === \"pending\", data, error, status };\n}\n"],"mappings":"uBAyDA,SAAgB,EACZ,EACyB,CACzB,GAAM,CAAC,EAAM,IAAA,EAAW,EAAA,SAAA,CAAmB,IAAI,EACzC,CAAC,EAAO,IAAA,EAAY,EAAA,SAAA,CAAkB,IAAI,EAC1C,CAAC,EAAQ,IAAA,EAAa,EAAA,SAAA,CAA0C,SAAS,EACzE,GAAA,EAAa,EAAA,OAAA,CAAmC,CAAO,EACvD,GAAA,EAAS,EAAA,OAAA,CAAgB,EAAK,EAC9B,GAAA,EAAa,EAAA,OAAA,CAAgB,EAAK,EA8BxC,OA5BA,EAAA,EAAA,UAAA,KAAgB,CACZ,EAAW,QAAU,CACzB,CAAC,GAED,EAAA,EAAA,UAAA,MACI,EAAW,QAAU,GAChB,EAAO,UACR,EAAO,QAAU,GACjB,EAAW,QACN,SAAS,CAAC,CACV,KAAM,GAAW,CACT,KAAW,QAGhB,OAFA,EAAQ,CAAM,EACd,EAAU,SAAS,EACZ,EAAW,QAAQ,YAAY,CAAM,CAChD,CAAC,CAAC,CACD,MAAO,GAAiB,CAChB,EAAW,UAChB,EAAS,CAAG,EACZ,EAAU,OAAO,EACjB,EAAW,QAAQ,UAAU,CAAG,EACpC,CAAC,OAEI,CACT,EAAW,QAAU,EACzB,GACD,CAAC,CAAC,EAEE,CAAE,QAAS,IAAW,UAAW,OAAM,QAAO,QAAO,CAChE"}
+{"version":3,"file":"use-oauth-callback.cjs","names":["useState","useRef","react","useOAuthCallback","data","setData","error","setError","status","setStatus","optionsRef","options","ranRef","mountedRef","result","err"],"sources":["../../src/oauth/use-oauth-callback.ts"],"sourcesContent":["import { useEffect, useRef, useState } from \"react\";\n\nexport interface UseOAuthCallbackOptions<T> {\n    /** Function that exchanges the provider response for an app session. Called once on mount. */\n    exchange: () => Promise<T>;\n    /** Fired with the result on success. Receives the value resolved by `exchange`. */\n    onSuccess?: (result: T) => void | Promise<void>;\n    /** Fired when `exchange` throws or rejects. */\n    onError?: (error: unknown) => void;\n}\n\nexport interface UseOAuthCallbackResult<T> {\n    /** `true` while the exchange promise is pending. */\n    loading: boolean;\n    /** Last resolved value, when `status === \"success\"`. */\n    data: T | null;\n    /** Last rejection reason, when `status === \"error\"`. */\n    error: unknown;\n    /** Aggregated state — `\"pending\"`, `\"success\"`, or `\"error\"`. */\n    status: \"pending\" | \"success\" | \"error\";\n}\n\n/**\n * Run an OAuth-callback \"exchange\" exactly once on mount. Designed for\n * `/callback` routes that receive provider redirects and need to swap a\n * code/token for an app session via the backend.\n *\n * Runs `exchange` once per logical mount and keeps its result. StrictMode's\n * simulated unmount/remount in dev and a parent re-render with inline\n * callbacks used to cancel the only exchange and skip the second, leaving the\n * hook `\"pending\"` forever with the single-use code already spent. Now the\n * options live in a latest-value ref, the effect has no dependencies, and the\n * result is dropped only when the component is still unmounted when it lands.\n * The newest `onSuccess`/`onError` are the ones called.\n *\n * For a provider redirect, the exchange must carry the `state` along with the\n * `code`, or no backend can tell a forged callback from a real one (login\n * CSRF). `exchangeOAuthCallback` does that against a\n * `tempest-fastapi-sdk` backend; `readOAuthCallbackParams` returns both\n * values (or throws) for any other backend.\n *\n * @example\n * function OAuthCallback() {\n *     const { loading, error } = useOAuthCallback<LoginResponse>({\n *         exchange: () => exchangeOAuthCallback<LoginResponse>(api, \"google\"),\n *         onSuccess: ({ user_id, access_token }) => {\n *             useAuthStore.getState().setSession({ user: { id: user_id }, token: access_token });\n *             navigate(\"/dashboard\", { replace: true });\n *         },\n *         onError: () => navigate(\"/login?error=oauth\", { replace: true }),\n *     });\n *\n *     if (loading) return <Spinner />;\n *     if (error) return <ErrorState description=\"OAuth falhou\" />;\n *     return null;\n * }\n */\nexport function useOAuthCallback<T>(\n    options: UseOAuthCallbackOptions<T>,\n): UseOAuthCallbackResult<T> {\n    const [data, setData] = useState<T | null>(null);\n    const [error, setError] = useState<unknown>(null);\n    const [status, setStatus] = useState<\"pending\" | \"success\" | \"error\">(\"pending\");\n    const optionsRef = useRef<UseOAuthCallbackOptions<T>>(options);\n    const ranRef = useRef<boolean>(false);\n    const mountedRef = useRef<boolean>(false);\n\n    useEffect(() => {\n        optionsRef.current = options;\n    });\n\n    useEffect(() => {\n        mountedRef.current = true;\n        if (!ranRef.current) {\n            ranRef.current = true;\n            optionsRef.current\n                .exchange()\n                .then((result) => {\n                    if (!mountedRef.current) return;\n                    setData(result);\n                    setStatus(\"success\");\n                    return optionsRef.current.onSuccess?.(result);\n                })\n                .catch((err: unknown) => {\n                    if (!mountedRef.current) return;\n                    setError(err);\n                    setStatus(\"error\");\n                    optionsRef.current.onError?.(err);\n                });\n        }\n        return () => {\n            mountedRef.current = false;\n        };\n    }, []);\n\n    return { loading: status === \"pending\", data, error, status };\n}\n"],"mappings":"A,uBAyDA,SAAgBG,EACZ,EACyB,CACzB,GAAM,CAACC,EAAMC,IAAA,EAAWL,EAAAA,SAAAA,CAAmB,IAAI,EACzC,CAACM,EAAOC,IAAA,EAAYP,EAAAA,SAAAA,CAAkB,IAAI,EAC1C,CAACQ,EAAQC,IAAA,EAAaT,EAAAA,SAAAA,CAA0C,SAAS,EACzEU,GAAA,EAAaT,EAAAA,OAAAA,CAAmCU,CAAO,EACvDC,GAAA,EAASX,EAAAA,OAAAA,CAAgB,EAAK,EAC9BY,GAAA,EAAaZ,EAAAA,OAAAA,CAAgB,EAAK,EA8BxC,OA5BA,EAAAC,EAAA,UAAA,KAAgB,CACZ,EAAW,QAAUS,CACzB,CAAC,GAED,EAAAT,EAAA,UAAA,MACI,EAAW,QAAU,GAChBU,EAAO,UACR,EAAO,QAAU,GACjBF,EAAW,QACN,SAAS,CAAC,CACV,KAAM,GAAW,CACd,GAAKG,EAAW,QAGhB,OAFAR,EAAQS,CAAM,EACdL,EAAU,SAAS,EACZC,EAAW,QAAQ,YAAYI,CAAM,CAChD,CAAC,CAAC,CACD,MAAO,GAAiB,CAChBD,EAAW,UAChBN,EAASQ,CAAG,EACZN,EAAU,OAAO,EACjBC,EAAW,QAAQ,UAAUK,CAAG,EACpC,CAAC,OAEI,CACT,EAAW,QAAU,EACzB,GACD,CAAC,CAAC,EAEE,CAAE,QAASP,IAAW,UAAW,OAAM,QAAO,QAAO,CAChE,C"}

package/dist/oauth/use-oauth-callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-oauth-callback.js","names":[],"sources":["../../src/oauth/use-oauth-callback.ts"],"sourcesContent":["import { useEffect, useRef, useState } from \"react\";\n\nexport interface UseOAuthCallbackOptions<T> {\n    /** Function that exchanges the provider response for an app session. Called once on mount. */\n    exchange: () => Promise<T>;\n    /** Fired with the result on success. Receives the value resolved by `exchange`. */\n    onSuccess?: (result: T) => void | Promise<void>;\n    /** Fired when `exchange` throws or rejects. */\n    onError?: (error: unknown) => void;\n}\n\nexport interface UseOAuthCallbackResult<T> {\n    /** `true` while the exchange promise is pending. */\n    loading: boolean;\n    /** Last resolved value, when `status === \"success\"`. */\n    data: T | null;\n    /** Last rejection reason, when `status === \"error\"`. */\n    error: unknown;\n    /** Aggregated state — `\"pending\"`, `\"success\"`, or `\"error\"`. */\n    status: \"pending\" | \"success\" | \"error\";\n}\n\n/**\n * Run an OAuth-callback \"exchange\" exactly once on mount. Designed for\n * `/callback` routes that receive provider redirects and need to swap a\n * code/token for an app session via the backend.\n *\n * Runs `exchange` once per logical mount and keeps its result. StrictMode's\n * simulated unmount/remount in dev and a parent re-render with inline\n * callbacks used to cancel the only exchange and skip the second, leaving the\n * hook `\"pending\"` forever with the single-use code already spent. Now the\n * options live in a latest-value ref, the effect has no dependencies, and the\n * result is dropped only when the component is still unmounted when it lands.\n * The newest `onSuccess`/`onError` are the ones called.\n *\n * For a provider redirect, the exchange must carry the `state` along with the\n * `code`, or no backend can tell a forged callback from a real one (login\n * CSRF). `exchangeOAuthCallback` does that against a\n * `tempest-fastapi-sdk` backend; `readOAuthCallbackParams` returns both\n * values (or throws) for any other backend.\n *\n * @example\n * function OAuthCallback() {\n *     const { loading, error } = useOAuthCallback<LoginResponse>({\n *         exchange: () => exchangeOAuthCallback<LoginResponse>(api, \"google\"),\n *         onSuccess: ({ user_id, access_token }) => {\n *             useAuthStore.getState().setSession({ user: { id: user_id }, token: access_token });\n *             navigate(\"/dashboard\", { replace: true });\n *         },\n *         onError: () => navigate(\"/login?error=oauth\", { replace: true }),\n *     });\n *\n *     if (loading) return <Spinner />;\n *     if (error) return <ErrorState description=\"OAuth falhou\" />;\n *     return null;\n * }\n */\nexport function useOAuthCallback<T>(\n    options: UseOAuthCallbackOptions<T>,\n): UseOAuthCallbackResult<T> {\n    const [data, setData] = useState<T | null>(null);\n    const [error, setError] = useState<unknown>(null);\n    const [status, setStatus] = useState<\"pending\" | \"success\" | \"error\">(\"pending\");\n    const optionsRef = useRef<UseOAuthCallbackOptions<T>>(options);\n    const ranRef = useRef<boolean>(false);\n    const mountedRef = useRef<boolean>(false);\n\n    useEffect(() => {\n        optionsRef.current = options;\n    });\n\n    useEffect(() => {\n        mountedRef.current = true;\n        if (!ranRef.current) {\n            ranRef.current = true;\n            optionsRef.current\n                .exchange()\n                .then((result) => {\n                    if (!mountedRef.current) return;\n                    setData(result);\n                    setStatus(\"success\");\n                    return optionsRef.current.onSuccess?.(result);\n                })\n                .catch((err: unknown) => {\n                    if (!mountedRef.current) return;\n                    setError(err);\n                    setStatus(\"error\");\n                    optionsRef.current.onError?.(err);\n                });\n        }\n        return () => {\n            mountedRef.current = false;\n        };\n    }, []);\n\n    return { loading: status === \"pending\", data, error, status };\n}\n"],"mappings":";;AAyDA,SAAgB,EACZ,GACyB;CACzB,IAAM,CAAC,GAAM,KAAW,EAAmB,IAAI,GACzC,CAAC,GAAO,KAAY,EAAkB,IAAI,GAC1C,CAAC,GAAQ,KAAa,EAA0C,SAAS,GACzE,IAAa,EAAmC,CAAO,GACvD,IAAS,EAAgB,EAAK,GAC9B,IAAa,EAAgB,EAAK;CA8BxC,OA5BA,QAAgB;EACZ,EAAW,UAAU;CACzB,CAAC,GAED,SACI,EAAW,UAAU,IAChB,EAAO,YACR,EAAO,UAAU,IACjB,EAAW,QACN,SAAS,CAAC,CACV,MAAM,MAAW;EACT,MAAW,SAGhB,OAFA,EAAQ,CAAM,GACd,EAAU,SAAS,GACZ,EAAW,QAAQ,YAAY,CAAM;CAChD,CAAC,CAAC,CACD,OAAO,MAAiB;EAChB,EAAW,YAChB,EAAS,CAAG,GACZ,EAAU,OAAO,GACjB,EAAW,QAAQ,UAAU,CAAG;CACpC,CAAC,UAEI;EACT,EAAW,UAAU;CACzB,IACD,CAAC,CAAC,GAEE;EAAE,SAAS,MAAW;EAAW;EAAM;EAAO;CAAO;AAChE"}
+{"version":3,"file":"use-oauth-callback.js","names":["useOAuthCallback","data","setData","useState","error","setError","status","setStatus","optionsRef","useRef","options","ranRef","mountedRef","useEffect","result","err"],"sources":["../../src/oauth/use-oauth-callback.ts"],"sourcesContent":["import { useEffect, useRef, useState } from \"react\";\n\nexport interface UseOAuthCallbackOptions<T> {\n    /** Function that exchanges the provider response for an app session. Called once on mount. */\n    exchange: () => Promise<T>;\n    /** Fired with the result on success. Receives the value resolved by `exchange`. */\n    onSuccess?: (result: T) => void | Promise<void>;\n    /** Fired when `exchange` throws or rejects. */\n    onError?: (error: unknown) => void;\n}\n\nexport interface UseOAuthCallbackResult<T> {\n    /** `true` while the exchange promise is pending. */\n    loading: boolean;\n    /** Last resolved value, when `status === \"success\"`. */\n    data: T | null;\n    /** Last rejection reason, when `status === \"error\"`. */\n    error: unknown;\n    /** Aggregated state — `\"pending\"`, `\"success\"`, or `\"error\"`. */\n    status: \"pending\" | \"success\" | \"error\";\n}\n\n/**\n * Run an OAuth-callback \"exchange\" exactly once on mount. Designed for\n * `/callback` routes that receive provider redirects and need to swap a\n * code/token for an app session via the backend.\n *\n * Runs `exchange` once per logical mount and keeps its result. StrictMode's\n * simulated unmount/remount in dev and a parent re-render with inline\n * callbacks used to cancel the only exchange and skip the second, leaving the\n * hook `\"pending\"` forever with the single-use code already spent. Now the\n * options live in a latest-value ref, the effect has no dependencies, and the\n * result is dropped only when the component is still unmounted when it lands.\n * The newest `onSuccess`/`onError` are the ones called.\n *\n * For a provider redirect, the exchange must carry the `state` along with the\n * `code`, or no backend can tell a forged callback from a real one (login\n * CSRF). `exchangeOAuthCallback` does that against a\n * `tempest-fastapi-sdk` backend; `readOAuthCallbackParams` returns both\n * values (or throws) for any other backend.\n *\n * @example\n * function OAuthCallback() {\n *     const { loading, error } = useOAuthCallback<LoginResponse>({\n *         exchange: () => exchangeOAuthCallback<LoginResponse>(api, \"google\"),\n *         onSuccess: ({ user_id, access_token }) => {\n *             useAuthStore.getState().setSession({ user: { id: user_id }, token: access_token });\n *             navigate(\"/dashboard\", { replace: true });\n *         },\n *         onError: () => navigate(\"/login?error=oauth\", { replace: true }),\n *     });\n *\n *     if (loading) return <Spinner />;\n *     if (error) return <ErrorState description=\"OAuth falhou\" />;\n *     return null;\n * }\n */\nexport function useOAuthCallback<T>(\n    options: UseOAuthCallbackOptions<T>,\n): UseOAuthCallbackResult<T> {\n    const [data, setData] = useState<T | null>(null);\n    const [error, setError] = useState<unknown>(null);\n    const [status, setStatus] = useState<\"pending\" | \"success\" | \"error\">(\"pending\");\n    const optionsRef = useRef<UseOAuthCallbackOptions<T>>(options);\n    const ranRef = useRef<boolean>(false);\n    const mountedRef = useRef<boolean>(false);\n\n    useEffect(() => {\n        optionsRef.current = options;\n    });\n\n    useEffect(() => {\n        mountedRef.current = true;\n        if (!ranRef.current) {\n            ranRef.current = true;\n            optionsRef.current\n                .exchange()\n                .then((result) => {\n                    if (!mountedRef.current) return;\n                    setData(result);\n                    setStatus(\"success\");\n                    return optionsRef.current.onSuccess?.(result);\n                })\n                .catch((err: unknown) => {\n                    if (!mountedRef.current) return;\n                    setError(err);\n                    setStatus(\"error\");\n                    optionsRef.current.onError?.(err);\n                });\n        }\n        return () => {\n            mountedRef.current = false;\n        };\n    }, []);\n\n    return { loading: status === \"pending\", data, error, status };\n}\n"],"mappings":";;AAyDA,SAAgBA,EACZ,GACyB;CACzB,IAAM,CAACC,GAAMC,KAAWC,EAAmB,IAAI,GACzC,CAACC,GAAOC,KAAYF,EAAkB,IAAI,GAC1C,CAACG,GAAQC,KAAaJ,EAA0C,SAAS,GACzEK,IAAaC,EAAmCC,CAAO,GACvDC,IAASF,EAAgB,EAAK,GAC9BG,IAAaH,EAAgB,EAAK;CA8BxC,OA5BAI,QAAgB;EACZ,EAAW,UAAUH;CACzB,CAAC,GAEDG,SACI,EAAW,UAAU,IAChBF,EAAO,YACR,EAAO,UAAU,IACjBH,EAAW,QACN,SAAS,CAAC,CACV,MAAM,MAAW;EACd,IAAKI,EAAW,SAGhB,OAFAV,EAAQY,CAAM,GACdP,EAAU,SAAS,GACZC,EAAW,QAAQ,YAAYM,CAAM;CAChD,CAAC,CAAC,CACD,OAAO,MAAiB;EACrB,AAAKF,EAAW,YAChBP,EAASU,CAAG,GACZR,EAAU,OAAO,GACjBC,EAAW,QAAQ,UAAUO,CAAG;CACpC,CAAC,UAEI;EACT,EAAW,UAAU;CACzB,IACD,CAAC,CAAC,GAEE;EAAE,SAAST,MAAW;EAAW;EAAM;EAAO;CAAO;AAChE"}

package/dist/offline/conflict.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"conflict.cjs","names":[],"sources":["../../src/offline/conflict.ts"],"sourcesContent":["/**\n * Conflict-resolution helpers for the `applyRemote` callback of\n * {@link createOfflineSync}. Each takes the current local record (or\n * `undefined` when the record is new locally) and the incoming remote record,\n * and returns the winner. Ties resolve to the remote copy, treating the server\n * as authoritative.\n */\n\n/** Normalise a timestamp-ish value to epoch milliseconds. */\nfunction toMillis(value: number | string | Date): number {\n    if (value instanceof Date) return value.getTime();\n    if (typeof value === \"number\") return value;\n    const parsed = Date.parse(value);\n    return Number.isNaN(parsed) ? 0 : parsed;\n}\n\n/**\n * Resolve a conflict by keeping whichever record was written last, comparing a\n * timestamp field. The remote record wins ties.\n *\n * @typeParam T - The record shape.\n * @param local - The current local record, or `undefined` when new.\n * @param remote - The incoming remote record.\n * @param getTimestamp - Reads the comparison timestamp (epoch ms, ISO string or `Date`).\n * @returns The winning record.\n *\n * @example\n * applyRemote: async (dto) => {\n *     const local = await store.get(dto.id);\n *     await store.save(lastWriteWins(local, dto, (r) => r.updatedAt));\n * }\n */\nexport function lastWriteWins<T>(\n    local: T | undefined,\n    remote: T,\n    getTimestamp: (record: T) => number | string | Date,\n): T {\n    if (local === undefined) return remote;\n    return toMillis(getTimestamp(remote)) >= toMillis(getTimestamp(local)) ? remote : local;\n}\n\n/**\n * Resolve a conflict by keeping whichever record carries the higher version\n * number (monotonic counter / row version). The remote record wins ties.\n *\n * @typeParam T - The record shape.\n * @param local - The current local record, or `undefined` when new.\n * @param remote - The incoming remote record.\n * @param getVersion - Reads the monotonic version number.\n * @returns The winning record.\n *\n * @example\n * applyRemote: async (dto) => {\n *     const local = await store.get(dto.id);\n *     await store.save(higherVersionWins(local, dto, (r) => r.version));\n * }\n */\nexport function higherVersionWins<T>(\n    local: T | undefined,\n    remote: T,\n    getVersion: (record: T) => number,\n): T {\n    if (local === undefined) return remote;\n    return getVersion(remote) >= getVersion(local) ? remote : local;\n}\n"],"mappings":"AASA,SAAS,EAAS,EAAuC,CACrD,GAAI,aAAiB,KAAM,OAAO,EAAM,QAAQ,EAChD,GAAI,OAAO,GAAU,SAAU,OAAO,EACtC,IAAM,EAAS,KAAK,MAAM,CAAK,EAC/B,OAAO,OAAO,MAAM,CAAM,EAAI,EAAI,CACtC,CAkBA,SAAgB,EACZ,EACA,EACA,EACC,CAED,OADI,IAAU,IAAA,IACP,EAAS,EAAa,CAAM,CAAC,GAAK,EAAS,EAAa,CAAK,CAAC,EADrC,EACkD,CACtF,CAkBA,SAAgB,EACZ,EACA,EACA,EACC,CAED,OADI,IAAU,IAAA,IACP,EAAW,CAAM,GAAK,EAAW,CAAK,EADb,EAC0B,CAC9D"}
+{"version":3,"file":"conflict.cjs","names":["toMillis","value","parsed","lastWriteWins","local","getTimestamp","remote","higherVersionWins","getVersion"],"sources":["../../src/offline/conflict.ts"],"sourcesContent":["/**\n * Conflict-resolution helpers for the `applyRemote` callback of\n * {@link createOfflineSync}. Each takes the current local record (or\n * `undefined` when the record is new locally) and the incoming remote record,\n * and returns the winner. Ties resolve to the remote copy, treating the server\n * as authoritative.\n */\n\n/** Normalise a timestamp-ish value to epoch milliseconds. */\nfunction toMillis(value: number | string | Date): number {\n    if (value instanceof Date) return value.getTime();\n    if (typeof value === \"number\") return value;\n    const parsed = Date.parse(value);\n    return Number.isNaN(parsed) ? 0 : parsed;\n}\n\n/**\n * Resolve a conflict by keeping whichever record was written last, comparing a\n * timestamp field. The remote record wins ties.\n *\n * @typeParam T - The record shape.\n * @param local - The current local record, or `undefined` when new.\n * @param remote - The incoming remote record.\n * @param getTimestamp - Reads the comparison timestamp (epoch ms, ISO string or `Date`).\n * @returns The winning record.\n *\n * @example\n * applyRemote: async (dto) => {\n *     const local = await store.get(dto.id);\n *     await store.save(lastWriteWins(local, dto, (r) => r.updatedAt));\n * }\n */\nexport function lastWriteWins<T>(\n    local: T | undefined,\n    remote: T,\n    getTimestamp: (record: T) => number | string | Date,\n): T {\n    if (local === undefined) return remote;\n    return toMillis(getTimestamp(remote)) >= toMillis(getTimestamp(local)) ? remote : local;\n}\n\n/**\n * Resolve a conflict by keeping whichever record carries the higher version\n * number (monotonic counter / row version). The remote record wins ties.\n *\n * @typeParam T - The record shape.\n * @param local - The current local record, or `undefined` when new.\n * @param remote - The incoming remote record.\n * @param getVersion - Reads the monotonic version number.\n * @returns The winning record.\n *\n * @example\n * applyRemote: async (dto) => {\n *     const local = await store.get(dto.id);\n *     await store.save(higherVersionWins(local, dto, (r) => r.version));\n * }\n */\nexport function higherVersionWins<T>(\n    local: T | undefined,\n    remote: T,\n    getVersion: (record: T) => number,\n): T {\n    if (local === undefined) return remote;\n    return getVersion(remote) >= getVersion(local) ? remote : local;\n}\n"],"mappings":"AASA,SAASA,EAAS,EAAuC,CACrD,GAAIC,aAAiB,KAAM,OAAOA,EAAM,QAAQ,EAChD,GAAI,OAAOA,GAAU,SAAU,OAAOA,EACtC,IAAMC,EAAS,KAAK,MAAMD,CAAK,EAC/B,OAAO,OAAO,MAAMC,CAAM,EAAI,EAAIA,CACtC,CAkBA,SAAgBC,EACZ,EACA,EACA,EACC,CAED,OADIC,IAAU,IAAA,IACPJ,EAASK,EAAaC,CAAM,CAAC,GAAKN,EAASK,EAAaD,CAAK,CAAC,EADrCE,EACkDF,CACtF,CAkBA,SAAgBG,EACZ,EACA,EACA,EACC,CAED,OADIH,IAAU,IAAA,IACPI,EAAWF,CAAM,GAAKE,EAAWJ,CAAK,EADbE,EAC0BF,CAC9D,C"}

package/dist/offline/conflict.js.map

@@ -1 +1 @@
-{"version":3,"file":"conflict.js","names":[],"sources":["../../src/offline/conflict.ts"],"sourcesContent":["/**\n * Conflict-resolution helpers for the `applyRemote` callback of\n * {@link createOfflineSync}. Each takes the current local record (or\n * `undefined` when the record is new locally) and the incoming remote record,\n * and returns the winner. Ties resolve to the remote copy, treating the server\n * as authoritative.\n */\n\n/** Normalise a timestamp-ish value to epoch milliseconds. */\nfunction toMillis(value: number | string | Date): number {\n    if (value instanceof Date) return value.getTime();\n    if (typeof value === \"number\") return value;\n    const parsed = Date.parse(value);\n    return Number.isNaN(parsed) ? 0 : parsed;\n}\n\n/**\n * Resolve a conflict by keeping whichever record was written last, comparing a\n * timestamp field. The remote record wins ties.\n *\n * @typeParam T - The record shape.\n * @param local - The current local record, or `undefined` when new.\n * @param remote - The incoming remote record.\n * @param getTimestamp - Reads the comparison timestamp (epoch ms, ISO string or `Date`).\n * @returns The winning record.\n *\n * @example\n * applyRemote: async (dto) => {\n *     const local = await store.get(dto.id);\n *     await store.save(lastWriteWins(local, dto, (r) => r.updatedAt));\n * }\n */\nexport function lastWriteWins<T>(\n    local: T | undefined,\n    remote: T,\n    getTimestamp: (record: T) => number | string | Date,\n): T {\n    if (local === undefined) return remote;\n    return toMillis(getTimestamp(remote)) >= toMillis(getTimestamp(local)) ? remote : local;\n}\n\n/**\n * Resolve a conflict by keeping whichever record carries the higher version\n * number (monotonic counter / row version). The remote record wins ties.\n *\n * @typeParam T - The record shape.\n * @param local - The current local record, or `undefined` when new.\n * @param remote - The incoming remote record.\n * @param getVersion - Reads the monotonic version number.\n * @returns The winning record.\n *\n * @example\n * applyRemote: async (dto) => {\n *     const local = await store.get(dto.id);\n *     await store.save(higherVersionWins(local, dto, (r) => r.version));\n * }\n */\nexport function higherVersionWins<T>(\n    local: T | undefined,\n    remote: T,\n    getVersion: (record: T) => number,\n): T {\n    if (local === undefined) return remote;\n    return getVersion(remote) >= getVersion(local) ? remote : local;\n}\n"],"mappings":";AASA,SAAS,EAAS,GAAuC;CACrD,IAAI,aAAiB,MAAM,OAAO,EAAM,QAAQ;CAChD,IAAI,OAAO,KAAU,UAAU,OAAO;CACtC,IAAM,IAAS,KAAK,MAAM,CAAK;CAC/B,OAAO,OAAO,MAAM,CAAM,IAAI,IAAI;AACtC;AAkBA,SAAgB,EACZ,GACA,GACA,GACC;CAED,OADI,MAAU,KAAA,KACP,EAAS,EAAa,CAAM,CAAC,KAAK,EAAS,EAAa,CAAK,CAAC,IADrC,IACkD;AACtF;AAkBA,SAAgB,EACZ,GACA,GACA,GACC;CAED,OADI,MAAU,KAAA,KACP,EAAW,CAAM,KAAK,EAAW,CAAK,IADb,IAC0B;AAC9D"}
+{"version":3,"file":"conflict.js","names":["toMillis","value","parsed","lastWriteWins","local","getTimestamp","remote","higherVersionWins","getVersion"],"sources":["../../src/offline/conflict.ts"],"sourcesContent":["/**\n * Conflict-resolution helpers for the `applyRemote` callback of\n * {@link createOfflineSync}. Each takes the current local record (or\n * `undefined` when the record is new locally) and the incoming remote record,\n * and returns the winner. Ties resolve to the remote copy, treating the server\n * as authoritative.\n */\n\n/** Normalise a timestamp-ish value to epoch milliseconds. */\nfunction toMillis(value: number | string | Date): number {\n    if (value instanceof Date) return value.getTime();\n    if (typeof value === \"number\") return value;\n    const parsed = Date.parse(value);\n    return Number.isNaN(parsed) ? 0 : parsed;\n}\n\n/**\n * Resolve a conflict by keeping whichever record was written last, comparing a\n * timestamp field. The remote record wins ties.\n *\n * @typeParam T - The record shape.\n * @param local - The current local record, or `undefined` when new.\n * @param remote - The incoming remote record.\n * @param getTimestamp - Reads the comparison timestamp (epoch ms, ISO string or `Date`).\n * @returns The winning record.\n *\n * @example\n * applyRemote: async (dto) => {\n *     const local = await store.get(dto.id);\n *     await store.save(lastWriteWins(local, dto, (r) => r.updatedAt));\n * }\n */\nexport function lastWriteWins<T>(\n    local: T | undefined,\n    remote: T,\n    getTimestamp: (record: T) => number | string | Date,\n): T {\n    if (local === undefined) return remote;\n    return toMillis(getTimestamp(remote)) >= toMillis(getTimestamp(local)) ? remote : local;\n}\n\n/**\n * Resolve a conflict by keeping whichever record carries the higher version\n * number (monotonic counter / row version). The remote record wins ties.\n *\n * @typeParam T - The record shape.\n * @param local - The current local record, or `undefined` when new.\n * @param remote - The incoming remote record.\n * @param getVersion - Reads the monotonic version number.\n * @returns The winning record.\n *\n * @example\n * applyRemote: async (dto) => {\n *     const local = await store.get(dto.id);\n *     await store.save(higherVersionWins(local, dto, (r) => r.version));\n * }\n */\nexport function higherVersionWins<T>(\n    local: T | undefined,\n    remote: T,\n    getVersion: (record: T) => number,\n): T {\n    if (local === undefined) return remote;\n    return getVersion(remote) >= getVersion(local) ? remote : local;\n}\n"],"mappings":";AASA,SAASA,EAAS,GAAuC;CACrD,IAAIC,aAAiB,MAAM,OAAOA,EAAM,QAAQ;CAChD,IAAI,OAAOA,KAAU,UAAU,OAAOA;CACtC,IAAMC,IAAS,KAAK,MAAMD,CAAK;CAC/B,OAAO,OAAO,MAAMC,CAAM,IAAI,IAAIA;AACtC;AAkBA,SAAgBC,EACZ,GACA,GACA,GACC;CAED,OADIC,MAAU,KAAA,KACPJ,EAASK,EAAaC,CAAM,CAAC,KAAKN,EAASK,EAAaD,CAAK,CAAC,IADrCE,IACkDF;AACtF;AAkBA,SAAgBG,EACZ,GACA,GACA,GACC;CAED,OADIH,MAAU,KAAA,KACPI,EAAWF,CAAM,KAAKE,EAAWJ,CAAK,IADbE,IAC0BF;AAC9D"}

package/dist/offline/create-offline-database.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"create-offline-database.cjs","names":[],"sources":["../../src/offline/create-offline-database.ts"],"sourcesContent":["import Dexie, { type Table } from \"dexie\";\n\nimport { buildStore, type OfflineStore, type OfflineStoreConfig } from \"./create-offline-store\";\n\nexport interface OfflineTableConfig<TItem> {\n    /**\n     * Dexie index definition for this table. Use `&` for a unique primary key,\n     * e.g. `\"&id, service_id, created_at\"`.\n     */\n    indexes: string;\n    /** Property used as the primary key (default: `\"id\"`). */\n    keyPath?: keyof TItem & string;\n    /**\n     * Optional owner scoping for this table. Set per table, since one database\n     * commonly mixes scoped and unscoped data.\n     */\n    ownerField?: keyof TItem & string;\n}\n\n/** Maps each table name to the record type it stores. */\nexport type OfflineSchema = Record<string, unknown>;\n\nexport type OfflineTablesConfig<TSchema extends OfflineSchema> = {\n    [K in keyof TSchema]: OfflineTableConfig<TSchema[K]>;\n};\n\nexport interface OfflineDatabaseConfig<TSchema extends OfflineSchema> {\n    /** IndexedDB database name. */\n    databaseName: string;\n    /** Schema version. Bump when changing any table's indexes. */\n    version: number;\n    /** One entry per object store, all inside this single database. */\n    tables: OfflineTablesConfig<TSchema>;\n}\n\nexport interface OfflineDatabase<TSchema extends OfflineSchema> {\n    /**\n     * The {@link OfflineStore} for one table.\n     *\n     * The name is checked against the declared schema; the record type is\n     * supplied by the caller — `store<Chat>(\"chats\")`. Deriving it from the\n     * schema instead (`OfflineStore<TSchema[K], string>`) is what the shape\n     * below documents as unavailable: Dexie's `Table<T>` expands `UpdateSpec<T>`\n     * over the keys of `T`, and an unresolved indexed access there makes the\n     * checker answer TS2589 no matter how the value is cast.\n     *\n     * Stores are created once and memoised, so repeated calls with the same\n     * name return the same object.\n     */\n    store: <TItem>(name: keyof TSchema & string) => OfflineStore<TItem, string>;\n    /** The Dexie instance shared by every store. */\n    db: Dexie;\n    /** Delete the whole database from the browser. */\n    destroy: () => Promise<void>;\n}\n\nclass MultiTableDb extends Dexie {\n    constructor(name: string, version: number, stores: Record<string, string>) {\n        super(name);\n        this.version(version).stores(stores);\n    }\n}\n\n/**\n * Build several {@link OfflineStore}s that share one IndexedDB database.\n *\n * `createOfflineStore` gives each store a database of its own, which is the\n * right shape for one isolated cache. It is the wrong shape as soon as the\n * tables belong together: chats and their messages, an entity and its drafts,\n * anything you would read or clear as a unit. Splitting those across databases\n * costs a real transaction — Dexie runs one atomically only *within* a single\n * database — and it splits the version bump for a related change across two\n * places.\n *\n * This keeps them in one database at one version, so a schema change is one\n * bump and a multi-table write can be wrapped in `db.transaction(...)`.\n *\n * Stores are reached through `store<TItem>(name)` rather than a prebuilt map.\n * That is forced rather than chosen: Dexie's `Table<T>` expands `UpdateSpec<T>`\n * over the keys of `T`, so building `{ [K in keyof TSchema]: OfflineStore<…> }`\n * — or even naming `OfflineStore<TSchema[K], string>` inside the accessor —\n * makes the checker answer TS2589 (\"excessively deep\"). Taking the record type\n * as a parameter keeps it a plain type argument, which resolves fine. The table\n * name is still checked against the declared schema.\n *\n * The store surface is identical to `createOfflineStore`; only ownership of the\n * database changes. `ownerField` is set per table, since a database commonly\n * mixes per-user data with shared data.\n *\n * @param config - Database name, version, and one entry per table.\n * @returns A `store(name)` accessor, the shared Dexie instance, and a\n *   `destroy()` that drops the database.\n *\n * @example\n * type Chat = { id: string; service_id: string; updated_at: string };\n * type Message = { id: string; service_chat_id: string; created_at: string };\n *\n * const database = createOfflineDatabase<{ chats: Chat; messages: Message }>({\n *     databaseName: \"ChatDatabase\",\n *     version: 1,\n *     tables: {\n *         chats: { indexes: \"&id, service_id, updated_at\" },\n *         messages: { indexes: \"&id, service_chat_id, created_at\" },\n *     },\n * });\n *\n * const chats = database.store<Chat>(\"chats\");\n * const messages = database.store<Message>(\"messages\");\n *\n * // Both tables in one atomic transaction — impossible across two databases.\n * await database.db.transaction(\"rw\", chats.raw, messages.raw, async () => {\n *     await chats.put(chat);\n *     await messages.bulkPut(pending);\n * });\n */\nexport function createOfflineDatabase<TSchema extends OfflineSchema>(\n    config: OfflineDatabaseConfig<TSchema>,\n): OfflineDatabase<TSchema> {\n    const { databaseName, version, tables } = config;\n\n    const schema: Record<string, string> = {};\n    for (const name of Object.keys(tables)) {\n        schema[name] = tables[name as keyof TSchema].indexes;\n    }\n\n    const db = new MultiTableDb(databaseName, version, schema);\n    const built = new Map<string, unknown>();\n\n    function store<TItem>(name: keyof TSchema & string): OfflineStore<TItem, string> {\n        const cached = built.get(name);\n        if (cached) return cached as OfflineStore<TItem, string>;\n\n        if (!(name in tables)) {\n            throw new Error(\n                `Table \"${name}\" is not declared in ${databaseName}. ` +\n                    `Available: ${Object.keys(tables).join(\", \")}.`,\n            );\n        }\n\n        const table = db.table(name) as Table<TItem>;\n        const tableConfig = tables[name] as Pick<\n            OfflineStoreConfig<TItem>,\n            \"keyPath\" | \"ownerField\"\n        >;\n        // Dexie's `Table<T>` drags in `UpdateSpec<T>`, which maps over the keys\n        // of `T`. Instantiating that from inside a second generic function is\n        // past what the checker will unfold, and it answers TS2589\n        // (\"excessively deep\") — for every shape tried: `unknown`, `object`,\n        // `Record<string, unknown>`, a closed interface, an explicit type\n        // argument, and a cast through `never`. `createOfflineStore` calls this\n        // same `buildStore` without complaint, so it is the nesting, not the\n        // store.\n        //\n        // Suppressed rather than worked around: the emitted types and the\n        // runtime are both correct — `create-offline-database.test.ts` covers\n        // the full surface, cross-table transactions included.\n        // `@ts-expect-error` over `@ts-ignore` on purpose: if a later\n        // TypeScript raises the limit, this line starts failing and says so.\n        // @ts-expect-error TS2589 — see above\n        const created: OfflineStore<TItem> = buildStore<TItem>(db, table, tableConfig);\n        built.set(name, created);\n        return created;\n    }\n\n    return {\n        store,\n        db,\n        destroy: () => db.delete(),\n    };\n}\n"],"mappings":"qIAwDA,IAAM,EAAN,cAA2B,EAAA,OAAM,CAC7B,YAAY,EAAc,EAAiB,EAAgC,CACvE,MAAM,CAAI,EACV,KAAK,QAAQ,CAAO,CAAC,CAAC,OAAO,CAAM,CACvC,CACJ,EAsDA,SAAgB,EACZ,EACwB,CACxB,GAAM,CAAE,eAAc,UAAS,UAAW,EAEpC,EAAiC,CAAC,EACxC,IAAK,IAAM,KAAQ,OAAO,KAAK,CAAM,EACjC,EAAO,GAAQ,EAAO,EAAsB,CAAC,QAGjD,IAAM,EAAK,IAAI,EAAa,EAAc,EAAS,CAAM,EACnD,EAAQ,IAAI,IAElB,SAAS,EAAa,EAA2D,CAC7E,IAAM,EAAS,EAAM,IAAI,CAAI,EAC7B,GAAI,EAAQ,OAAO,EAEnB,GAAI,EAAE,KAAQ,GACV,MAAU,MACN,UAAU,EAAK,uBAAuB,EAAa,eACjC,OAAO,KAAK,CAAM,CAAC,CAAC,KAAK,IAAI,EAAE,EACrD,EAGJ,IAAM,EAAQ,EAAG,MAAM,CAAI,EACrB,EAAc,EAAO,GAmBrB,EAA+B,EAAA,WAAkB,EAAI,EAAO,CAAW,EAE7E,OADA,EAAM,IAAI,EAAM,CAAO,EAChB,CACX,CAEA,MAAO,CACH,QACA,KACA,YAAe,EAAG,OAAO,CAC7B,CACJ"}
+{"version":3,"file":"create-offline-database.cjs","names":["Dexie","buildStore","require_runtime","require_create_offline_store","dexie","MultiTableDb","name","version","stores","createOfflineDatabase","config","schema","tables","db","databaseName","built","store","cached","table","tableConfig","created"],"sources":["../../src/offline/create-offline-database.ts"],"sourcesContent":["import Dexie, { type Table } from \"dexie\";\n\nimport { buildStore, type OfflineStore, type OfflineStoreConfig } from \"./create-offline-store\";\n\nexport interface OfflineTableConfig<TItem> {\n    /**\n     * Dexie index definition for this table. Use `&` for a unique primary key,\n     * e.g. `\"&id, service_id, created_at\"`.\n     */\n    indexes: string;\n    /** Property used as the primary key (default: `\"id\"`). */\n    keyPath?: keyof TItem & string;\n    /**\n     * Optional owner scoping for this table. Set per table, since one database\n     * commonly mixes scoped and unscoped data.\n     */\n    ownerField?: keyof TItem & string;\n}\n\n/** Maps each table name to the record type it stores. */\nexport type OfflineSchema = Record<string, unknown>;\n\nexport type OfflineTablesConfig<TSchema extends OfflineSchema> = {\n    [K in keyof TSchema]: OfflineTableConfig<TSchema[K]>;\n};\n\nexport interface OfflineDatabaseConfig<TSchema extends OfflineSchema> {\n    /** IndexedDB database name. */\n    databaseName: string;\n    /** Schema version. Bump when changing any table's indexes. */\n    version: number;\n    /** One entry per object store, all inside this single database. */\n    tables: OfflineTablesConfig<TSchema>;\n}\n\nexport interface OfflineDatabase<TSchema extends OfflineSchema> {\n    /**\n     * The {@link OfflineStore} for one table.\n     *\n     * The name is checked against the declared schema; the record type is\n     * supplied by the caller — `store<Chat>(\"chats\")`. Deriving it from the\n     * schema instead (`OfflineStore<TSchema[K], string>`) is what the shape\n     * below documents as unavailable: Dexie's `Table<T>` expands `UpdateSpec<T>`\n     * over the keys of `T`, and an unresolved indexed access there makes the\n     * checker answer TS2589 no matter how the value is cast.\n     *\n     * Stores are created once and memoised, so repeated calls with the same\n     * name return the same object.\n     */\n    store: <TItem>(name: keyof TSchema & string) => OfflineStore<TItem, string>;\n    /** The Dexie instance shared by every store. */\n    db: Dexie;\n    /** Delete the whole database from the browser. */\n    destroy: () => Promise<void>;\n}\n\nclass MultiTableDb extends Dexie {\n    constructor(name: string, version: number, stores: Record<string, string>) {\n        super(name);\n        this.version(version).stores(stores);\n    }\n}\n\n/**\n * Build several {@link OfflineStore}s that share one IndexedDB database.\n *\n * `createOfflineStore` gives each store a database of its own, which is the\n * right shape for one isolated cache. It is the wrong shape as soon as the\n * tables belong together: chats and their messages, an entity and its drafts,\n * anything you would read or clear as a unit. Splitting those across databases\n * costs a real transaction — Dexie runs one atomically only *within* a single\n * database — and it splits the version bump for a related change across two\n * places.\n *\n * This keeps them in one database at one version, so a schema change is one\n * bump and a multi-table write can be wrapped in `db.transaction(...)`.\n *\n * Stores are reached through `store<TItem>(name)` rather than a prebuilt map.\n * That is forced rather than chosen: Dexie's `Table<T>` expands `UpdateSpec<T>`\n * over the keys of `T`, so building `{ [K in keyof TSchema]: OfflineStore<…> }`\n * — or even naming `OfflineStore<TSchema[K], string>` inside the accessor —\n * makes the checker answer TS2589 (\"excessively deep\"). Taking the record type\n * as a parameter keeps it a plain type argument, which resolves fine. The table\n * name is still checked against the declared schema.\n *\n * The store surface is identical to `createOfflineStore`; only ownership of the\n * database changes. `ownerField` is set per table, since a database commonly\n * mixes per-user data with shared data.\n *\n * @param config - Database name, version, and one entry per table.\n * @returns A `store(name)` accessor, the shared Dexie instance, and a\n *   `destroy()` that drops the database.\n *\n * @example\n * type Chat = { id: string; service_id: string; updated_at: string };\n * type Message = { id: string; service_chat_id: string; created_at: string };\n *\n * const database = createOfflineDatabase<{ chats: Chat; messages: Message }>({\n *     databaseName: \"ChatDatabase\",\n *     version: 1,\n *     tables: {\n *         chats: { indexes: \"&id, service_id, updated_at\" },\n *         messages: { indexes: \"&id, service_chat_id, created_at\" },\n *     },\n * });\n *\n * const chats = database.store<Chat>(\"chats\");\n * const messages = database.store<Message>(\"messages\");\n *\n * // Both tables in one atomic transaction — impossible across two databases.\n * await database.db.transaction(\"rw\", chats.raw, messages.raw, async () => {\n *     await chats.put(chat);\n *     await messages.bulkPut(pending);\n * });\n */\nexport function createOfflineDatabase<TSchema extends OfflineSchema>(\n    config: OfflineDatabaseConfig<TSchema>,\n): OfflineDatabase<TSchema> {\n    const { databaseName, version, tables } = config;\n\n    const schema: Record<string, string> = {};\n    for (const name of Object.keys(tables)) {\n        schema[name] = tables[name as keyof TSchema].indexes;\n    }\n\n    const db = new MultiTableDb(databaseName, version, schema);\n    const built = new Map<string, unknown>();\n\n    function store<TItem>(name: keyof TSchema & string): OfflineStore<TItem, string> {\n        const cached = built.get(name);\n        if (cached) return cached as OfflineStore<TItem, string>;\n\n        if (!(name in tables)) {\n            throw new Error(\n                `Table \"${name}\" is not declared in ${databaseName}. ` +\n                    `Available: ${Object.keys(tables).join(\", \")}.`,\n            );\n        }\n\n        const table = db.table(name) as Table<TItem>;\n        const tableConfig = tables[name] as Pick<\n            OfflineStoreConfig<TItem>,\n            \"keyPath\" | \"ownerField\"\n        >;\n        // Dexie's `Table<T>` drags in `UpdateSpec<T>`, which maps over the keys\n        // of `T`. Instantiating that from inside a second generic function is\n        // past what the checker will unfold, and it answers TS2589\n        // (\"excessively deep\") — for every shape tried: `unknown`, `object`,\n        // `Record<string, unknown>`, a closed interface, an explicit type\n        // argument, and a cast through `never`. `createOfflineStore` calls this\n        // same `buildStore` without complaint, so it is the nesting, not the\n        // store.\n        //\n        // Suppressed rather than worked around: the emitted types and the\n        // runtime are both correct — `create-offline-database.test.ts` covers\n        // the full surface, cross-table transactions included.\n        // `@ts-expect-error` over `@ts-ignore` on purpose: if a later\n        // TypeScript raises the limit, this line starts failing and says so.\n        // @ts-expect-error TS2589 — see above\n        const created: OfflineStore<TItem> = buildStore<TItem>(db, table, tableConfig);\n        built.set(name, created);\n        return created;\n    }\n\n    return {\n        store,\n        db,\n        destroy: () => db.delete(),\n    };\n}\n"],"mappings":"A,qIAwDA,IAAMK,EAAN,cAA2BL,EAAAA,OAAM,CAC7B,YAAY,EAAc,EAAiB,EAAgC,CACvE,MAAMM,CAAI,EACV,KAAK,QAAQC,CAAO,CAAC,CAAC,OAAOC,CAAM,CACvC,CACJ,EAsDA,SAAgBC,EACZ,EACwB,CACxB,GAAM,CAAE,eAAc,UAAS,UAAWC,EAEpCC,EAAiC,CAAC,EACxC,IAAK,IAAML,KAAQ,OAAO,KAAKM,CAAM,EACjC,EAAON,GAAQM,EAAON,EAAsB,CAAC,QAGjD,IAAMO,EAAK,IAAIR,EAAaS,EAAcP,EAASI,CAAM,EACnDI,EAAQ,IAAI,IAElB,SAASC,EAAa,EAA2D,CAC7E,IAAMC,EAASF,EAAM,IAAIT,CAAI,EAC7B,GAAIW,EAAQ,OAAOA,EAEnB,GAAI,EAAEX,KAAQM,GACV,MAAU,MACN,UAAUN,EAAK,uBAAuBQ,EAAa,eACjC,OAAO,KAAKF,CAAM,CAAC,CAAC,KAAK,IAAI,EAAE,EACrD,EAGJ,IAAMM,EAAQL,EAAG,MAAMP,CAAI,EACrBa,EAAcP,EAAON,GAmBrBc,EAA+BnB,EAAAA,WAAkBY,EAAIK,EAAOC,CAAW,EAE7E,OADAJ,EAAM,IAAIT,EAAMc,CAAO,EAChBA,CACX,CAEA,MAAO,CACH,QACA,KACA,YAAeP,EAAG,OAAO,CAC7B,CACJ,C"}

package/dist/offline/create-offline-database.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-offline-database.js","names":[],"sources":["../../src/offline/create-offline-database.ts"],"sourcesContent":["import Dexie, { type Table } from \"dexie\";\n\nimport { buildStore, type OfflineStore, type OfflineStoreConfig } from \"./create-offline-store\";\n\nexport interface OfflineTableConfig<TItem> {\n    /**\n     * Dexie index definition for this table. Use `&` for a unique primary key,\n     * e.g. `\"&id, service_id, created_at\"`.\n     */\n    indexes: string;\n    /** Property used as the primary key (default: `\"id\"`). */\n    keyPath?: keyof TItem & string;\n    /**\n     * Optional owner scoping for this table. Set per table, since one database\n     * commonly mixes scoped and unscoped data.\n     */\n    ownerField?: keyof TItem & string;\n}\n\n/** Maps each table name to the record type it stores. */\nexport type OfflineSchema = Record<string, unknown>;\n\nexport type OfflineTablesConfig<TSchema extends OfflineSchema> = {\n    [K in keyof TSchema]: OfflineTableConfig<TSchema[K]>;\n};\n\nexport interface OfflineDatabaseConfig<TSchema extends OfflineSchema> {\n    /** IndexedDB database name. */\n    databaseName: string;\n    /** Schema version. Bump when changing any table's indexes. */\n    version: number;\n    /** One entry per object store, all inside this single database. */\n    tables: OfflineTablesConfig<TSchema>;\n}\n\nexport interface OfflineDatabase<TSchema extends OfflineSchema> {\n    /**\n     * The {@link OfflineStore} for one table.\n     *\n     * The name is checked against the declared schema; the record type is\n     * supplied by the caller — `store<Chat>(\"chats\")`. Deriving it from the\n     * schema instead (`OfflineStore<TSchema[K], string>`) is what the shape\n     * below documents as unavailable: Dexie's `Table<T>` expands `UpdateSpec<T>`\n     * over the keys of `T`, and an unresolved indexed access there makes the\n     * checker answer TS2589 no matter how the value is cast.\n     *\n     * Stores are created once and memoised, so repeated calls with the same\n     * name return the same object.\n     */\n    store: <TItem>(name: keyof TSchema & string) => OfflineStore<TItem, string>;\n    /** The Dexie instance shared by every store. */\n    db: Dexie;\n    /** Delete the whole database from the browser. */\n    destroy: () => Promise<void>;\n}\n\nclass MultiTableDb extends Dexie {\n    constructor(name: string, version: number, stores: Record<string, string>) {\n        super(name);\n        this.version(version).stores(stores);\n    }\n}\n\n/**\n * Build several {@link OfflineStore}s that share one IndexedDB database.\n *\n * `createOfflineStore` gives each store a database of its own, which is the\n * right shape for one isolated cache. It is the wrong shape as soon as the\n * tables belong together: chats and their messages, an entity and its drafts,\n * anything you would read or clear as a unit. Splitting those across databases\n * costs a real transaction — Dexie runs one atomically only *within* a single\n * database — and it splits the version bump for a related change across two\n * places.\n *\n * This keeps them in one database at one version, so a schema change is one\n * bump and a multi-table write can be wrapped in `db.transaction(...)`.\n *\n * Stores are reached through `store<TItem>(name)` rather than a prebuilt map.\n * That is forced rather than chosen: Dexie's `Table<T>` expands `UpdateSpec<T>`\n * over the keys of `T`, so building `{ [K in keyof TSchema]: OfflineStore<…> }`\n * — or even naming `OfflineStore<TSchema[K], string>` inside the accessor —\n * makes the checker answer TS2589 (\"excessively deep\"). Taking the record type\n * as a parameter keeps it a plain type argument, which resolves fine. The table\n * name is still checked against the declared schema.\n *\n * The store surface is identical to `createOfflineStore`; only ownership of the\n * database changes. `ownerField` is set per table, since a database commonly\n * mixes per-user data with shared data.\n *\n * @param config - Database name, version, and one entry per table.\n * @returns A `store(name)` accessor, the shared Dexie instance, and a\n *   `destroy()` that drops the database.\n *\n * @example\n * type Chat = { id: string; service_id: string; updated_at: string };\n * type Message = { id: string; service_chat_id: string; created_at: string };\n *\n * const database = createOfflineDatabase<{ chats: Chat; messages: Message }>({\n *     databaseName: \"ChatDatabase\",\n *     version: 1,\n *     tables: {\n *         chats: { indexes: \"&id, service_id, updated_at\" },\n *         messages: { indexes: \"&id, service_chat_id, created_at\" },\n *     },\n * });\n *\n * const chats = database.store<Chat>(\"chats\");\n * const messages = database.store<Message>(\"messages\");\n *\n * // Both tables in one atomic transaction — impossible across two databases.\n * await database.db.transaction(\"rw\", chats.raw, messages.raw, async () => {\n *     await chats.put(chat);\n *     await messages.bulkPut(pending);\n * });\n */\nexport function createOfflineDatabase<TSchema extends OfflineSchema>(\n    config: OfflineDatabaseConfig<TSchema>,\n): OfflineDatabase<TSchema> {\n    const { databaseName, version, tables } = config;\n\n    const schema: Record<string, string> = {};\n    for (const name of Object.keys(tables)) {\n        schema[name] = tables[name as keyof TSchema].indexes;\n    }\n\n    const db = new MultiTableDb(databaseName, version, schema);\n    const built = new Map<string, unknown>();\n\n    function store<TItem>(name: keyof TSchema & string): OfflineStore<TItem, string> {\n        const cached = built.get(name);\n        if (cached) return cached as OfflineStore<TItem, string>;\n\n        if (!(name in tables)) {\n            throw new Error(\n                `Table \"${name}\" is not declared in ${databaseName}. ` +\n                    `Available: ${Object.keys(tables).join(\", \")}.`,\n            );\n        }\n\n        const table = db.table(name) as Table<TItem>;\n        const tableConfig = tables[name] as Pick<\n            OfflineStoreConfig<TItem>,\n            \"keyPath\" | \"ownerField\"\n        >;\n        // Dexie's `Table<T>` drags in `UpdateSpec<T>`, which maps over the keys\n        // of `T`. Instantiating that from inside a second generic function is\n        // past what the checker will unfold, and it answers TS2589\n        // (\"excessively deep\") — for every shape tried: `unknown`, `object`,\n        // `Record<string, unknown>`, a closed interface, an explicit type\n        // argument, and a cast through `never`. `createOfflineStore` calls this\n        // same `buildStore` without complaint, so it is the nesting, not the\n        // store.\n        //\n        // Suppressed rather than worked around: the emitted types and the\n        // runtime are both correct — `create-offline-database.test.ts` covers\n        // the full surface, cross-table transactions included.\n        // `@ts-expect-error` over `@ts-ignore` on purpose: if a later\n        // TypeScript raises the limit, this line starts failing and says so.\n        // @ts-expect-error TS2589 — see above\n        const created: OfflineStore<TItem> = buildStore<TItem>(db, table, tableConfig);\n        built.set(name, created);\n        return created;\n    }\n\n    return {\n        store,\n        db,\n        destroy: () => db.delete(),\n    };\n}\n"],"mappings":";;;AAwDA,IAAM,IAAN,cAA2B,EAAM;CAC7B,YAAY,GAAc,GAAiB,GAAgC;EAEvE,AADA,MAAM,CAAI,GACV,KAAK,QAAQ,CAAO,CAAC,CAAC,OAAO,CAAM;CACvC;AACJ;AAsDA,SAAgB,EACZ,GACwB;CACxB,IAAM,EAAE,iBAAc,YAAS,cAAW,GAEpC,IAAiC,CAAC;CACxC,KAAK,IAAM,KAAQ,OAAO,KAAK,CAAM,GACjC,EAAO,KAAQ,EAAO,EAAsB,CAAC;CAGjD,IAAM,IAAK,IAAI,EAAa,GAAc,GAAS,CAAM,GACnD,oBAAQ,IAAI,IAAqB;CAEvC,SAAS,EAAa,GAA2D;EAC7E,IAAM,IAAS,EAAM,IAAI,CAAI;EAC7B,IAAI,GAAQ,OAAO;EAEnB,IAAI,EAAE,KAAQ,IACV,MAAU,MACN,UAAU,EAAK,uBAAuB,EAAa,eACjC,OAAO,KAAK,CAAM,CAAC,CAAC,KAAK,IAAI,EAAE,EACrD;EAGJ,IAAM,IAAQ,EAAG,MAAM,CAAI,GACrB,IAAc,EAAO,IAmBrB,IAA+B,EAAkB,GAAI,GAAO,CAAW;EAE7E,OADA,EAAM,IAAI,GAAM,CAAO,GAChB;CACX;CAEA,OAAO;EACH;EACA;EACA,eAAe,EAAG,OAAO;CAC7B;AACJ"}
+{"version":3,"file":"create-offline-database.js","names":["Dexie","MultiTableDb","name","version","stores","createOfflineDatabase","config","schema","tables","db","databaseName","built","store","cached","table","tableConfig","created","buildStore"],"sources":["../../src/offline/create-offline-database.ts"],"sourcesContent":["import Dexie, { type Table } from \"dexie\";\n\nimport { buildStore, type OfflineStore, type OfflineStoreConfig } from \"./create-offline-store\";\n\nexport interface OfflineTableConfig<TItem> {\n    /**\n     * Dexie index definition for this table. Use `&` for a unique primary key,\n     * e.g. `\"&id, service_id, created_at\"`.\n     */\n    indexes: string;\n    /** Property used as the primary key (default: `\"id\"`). */\n    keyPath?: keyof TItem & string;\n    /**\n     * Optional owner scoping for this table. Set per table, since one database\n     * commonly mixes scoped and unscoped data.\n     */\n    ownerField?: keyof TItem & string;\n}\n\n/** Maps each table name to the record type it stores. */\nexport type OfflineSchema = Record<string, unknown>;\n\nexport type OfflineTablesConfig<TSchema extends OfflineSchema> = {\n    [K in keyof TSchema]: OfflineTableConfig<TSchema[K]>;\n};\n\nexport interface OfflineDatabaseConfig<TSchema extends OfflineSchema> {\n    /** IndexedDB database name. */\n    databaseName: string;\n    /** Schema version. Bump when changing any table's indexes. */\n    version: number;\n    /** One entry per object store, all inside this single database. */\n    tables: OfflineTablesConfig<TSchema>;\n}\n\nexport interface OfflineDatabase<TSchema extends OfflineSchema> {\n    /**\n     * The {@link OfflineStore} for one table.\n     *\n     * The name is checked against the declared schema; the record type is\n     * supplied by the caller — `store<Chat>(\"chats\")`. Deriving it from the\n     * schema instead (`OfflineStore<TSchema[K], string>`) is what the shape\n     * below documents as unavailable: Dexie's `Table<T>` expands `UpdateSpec<T>`\n     * over the keys of `T`, and an unresolved indexed access there makes the\n     * checker answer TS2589 no matter how the value is cast.\n     *\n     * Stores are created once and memoised, so repeated calls with the same\n     * name return the same object.\n     */\n    store: <TItem>(name: keyof TSchema & string) => OfflineStore<TItem, string>;\n    /** The Dexie instance shared by every store. */\n    db: Dexie;\n    /** Delete the whole database from the browser. */\n    destroy: () => Promise<void>;\n}\n\nclass MultiTableDb extends Dexie {\n    constructor(name: string, version: number, stores: Record<string, string>) {\n        super(name);\n        this.version(version).stores(stores);\n    }\n}\n\n/**\n * Build several {@link OfflineStore}s that share one IndexedDB database.\n *\n * `createOfflineStore` gives each store a database of its own, which is the\n * right shape for one isolated cache. It is the wrong shape as soon as the\n * tables belong together: chats and their messages, an entity and its drafts,\n * anything you would read or clear as a unit. Splitting those across databases\n * costs a real transaction — Dexie runs one atomically only *within* a single\n * database — and it splits the version bump for a related change across two\n * places.\n *\n * This keeps them in one database at one version, so a schema change is one\n * bump and a multi-table write can be wrapped in `db.transaction(...)`.\n *\n * Stores are reached through `store<TItem>(name)` rather than a prebuilt map.\n * That is forced rather than chosen: Dexie's `Table<T>` expands `UpdateSpec<T>`\n * over the keys of `T`, so building `{ [K in keyof TSchema]: OfflineStore<…> }`\n * — or even naming `OfflineStore<TSchema[K], string>` inside the accessor —\n * makes the checker answer TS2589 (\"excessively deep\"). Taking the record type\n * as a parameter keeps it a plain type argument, which resolves fine. The table\n * name is still checked against the declared schema.\n *\n * The store surface is identical to `createOfflineStore`; only ownership of the\n * database changes. `ownerField` is set per table, since a database commonly\n * mixes per-user data with shared data.\n *\n * @param config - Database name, version, and one entry per table.\n * @returns A `store(name)` accessor, the shared Dexie instance, and a\n *   `destroy()` that drops the database.\n *\n * @example\n * type Chat = { id: string; service_id: string; updated_at: string };\n * type Message = { id: string; service_chat_id: string; created_at: string };\n *\n * const database = createOfflineDatabase<{ chats: Chat; messages: Message }>({\n *     databaseName: \"ChatDatabase\",\n *     version: 1,\n *     tables: {\n *         chats: { indexes: \"&id, service_id, updated_at\" },\n *         messages: { indexes: \"&id, service_chat_id, created_at\" },\n *     },\n * });\n *\n * const chats = database.store<Chat>(\"chats\");\n * const messages = database.store<Message>(\"messages\");\n *\n * // Both tables in one atomic transaction — impossible across two databases.\n * await database.db.transaction(\"rw\", chats.raw, messages.raw, async () => {\n *     await chats.put(chat);\n *     await messages.bulkPut(pending);\n * });\n */\nexport function createOfflineDatabase<TSchema extends OfflineSchema>(\n    config: OfflineDatabaseConfig<TSchema>,\n): OfflineDatabase<TSchema> {\n    const { databaseName, version, tables } = config;\n\n    const schema: Record<string, string> = {};\n    for (const name of Object.keys(tables)) {\n        schema[name] = tables[name as keyof TSchema].indexes;\n    }\n\n    const db = new MultiTableDb(databaseName, version, schema);\n    const built = new Map<string, unknown>();\n\n    function store<TItem>(name: keyof TSchema & string): OfflineStore<TItem, string> {\n        const cached = built.get(name);\n        if (cached) return cached as OfflineStore<TItem, string>;\n\n        if (!(name in tables)) {\n            throw new Error(\n                `Table \"${name}\" is not declared in ${databaseName}. ` +\n                    `Available: ${Object.keys(tables).join(\", \")}.`,\n            );\n        }\n\n        const table = db.table(name) as Table<TItem>;\n        const tableConfig = tables[name] as Pick<\n            OfflineStoreConfig<TItem>,\n            \"keyPath\" | \"ownerField\"\n        >;\n        // Dexie's `Table<T>` drags in `UpdateSpec<T>`, which maps over the keys\n        // of `T`. Instantiating that from inside a second generic function is\n        // past what the checker will unfold, and it answers TS2589\n        // (\"excessively deep\") — for every shape tried: `unknown`, `object`,\n        // `Record<string, unknown>`, a closed interface, an explicit type\n        // argument, and a cast through `never`. `createOfflineStore` calls this\n        // same `buildStore` without complaint, so it is the nesting, not the\n        // store.\n        //\n        // Suppressed rather than worked around: the emitted types and the\n        // runtime are both correct — `create-offline-database.test.ts` covers\n        // the full surface, cross-table transactions included.\n        // `@ts-expect-error` over `@ts-ignore` on purpose: if a later\n        // TypeScript raises the limit, this line starts failing and says so.\n        // @ts-expect-error TS2589 — see above\n        const created: OfflineStore<TItem> = buildStore<TItem>(db, table, tableConfig);\n        built.set(name, created);\n        return created;\n    }\n\n    return {\n        store,\n        db,\n        destroy: () => db.delete(),\n    };\n}\n"],"mappings":";;;AAwDA,IAAMC,IAAN,cAA2BD,EAAM;CAC7B,YAAY,GAAc,GAAiB,GAAgC;EAEvE,AADA,MAAME,CAAI,GACV,KAAK,QAAQC,CAAO,CAAC,CAAC,OAAOC,CAAM;CACvC;AACJ;AAsDA,SAAgBC,EACZ,GACwB;CACxB,IAAM,EAAE,iBAAc,YAAS,cAAWC,GAEpCC,IAAiC,CAAC;CACxC,KAAK,IAAML,KAAQ,OAAO,KAAKM,CAAM,GACjC,EAAON,KAAQM,EAAON,EAAsB,CAAC;CAGjD,IAAMO,IAAK,IAAIR,EAAaS,GAAcP,GAASI,CAAM,GACnDI,oBAAQ,IAAI,IAAqB;CAEvC,SAASC,EAAa,GAA2D;EAC7E,IAAMC,IAASF,EAAM,IAAIT,CAAI;EAC7B,IAAIW,GAAQ,OAAOA;EAEnB,IAAI,EAAEX,KAAQM,IACV,MAAU,MACN,UAAUN,EAAK,uBAAuBQ,EAAa,eACjC,OAAO,KAAKF,CAAM,CAAC,CAAC,KAAK,IAAI,EAAE,EACrD;EAGJ,IAAMM,IAAQL,EAAG,MAAMP,CAAI,GACrBa,IAAcP,EAAON,IAmBrBc,IAA+BC,EAAkBR,GAAIK,GAAOC,CAAW;EAE7E,OADAJ,EAAM,IAAIT,GAAMc,CAAO,GAChBA;CACX;CAEA,OAAO;EACH;EACA;EACA,eAAeP,EAAG,OAAO;CAC7B;AACJ"}

package/dist/offline/create-offline-store.cjs

@@ -1,2 +1,2 @@
-const e=require("../_virtual/_rolldown/runtime.cjs");let t=require("dexie");t=e.__toESM(t,1);var n=class extends t.default{store;constructor(e,t,n,r){super(e),this.version(t).stores({[n]:r}),this.store=this.table(n)}};function r(e){let{databaseName:t,version:r,tableName:a,indexes:o}=e,s=new n(t,r,a,o);return i(s,s.store,e)}function i(e,t,n){let{keyPath:r=`id`,ownerField:i}=n;function a(e,t){return!i||!t?e:{...e,[i]:t}}async function o(e,n={}){let{orderBy:a=r,reverse:o=!1,limit:s,offset:c,filter:l}=n,u=i&&e?t.where(i).equals(e):t.toCollection();l&&(u=u.filter(l));let d=a===r?await u.toArray():await u.sortBy(a);return o&&(d=d.reverse()),c&&(d=d.slice(c)),typeof s==`number`&&(d=d.slice(0,s)),d}return{put:(e,n)=>t.put(a(e,n)),bulkPut:(e,n)=>t.bulkPut(e.map(e=>a(e,n))),get:e=>t.get(e),list:o,update:(e,n)=>t.update(e,n),updateMany:async(e,n)=>{let r=n;return i&&e?t.where(i).equals(e).modify(r):t.toCollection().modify(r)},delete:e=>t.delete(e),clear:async e=>{if(i&&e){await t.where(i).equals(e).delete();return}await t.clear()},count:e=>i&&e?t.where(i).equals(e).count():t.count(),raw:t,db:e}}exports.buildStore=i,exports.createOfflineStore=r;
+const e=require("../_virtual/_rolldown/runtime.cjs");let t=require("dexie");t=e.__toESM(t,1);var n=class extends t.default{store;constructor(e,t,n,r){super(e),this.version(t).stores({[n]:r}),this.store=this.table(n)}};function r(e){let{databaseName:t,version:r,tableName:a,indexes:o}=e,s=new n(t,r,a,o);return i(s,s.store,e)}function i(e,t,n){let{keyPath:r=`id`,ownerField:i}=n;function a(e,t){return!i||!t?e:{...e,[i]:t}}async function o(e,n={}){let{orderBy:a=r,reverse:o=!1,limit:s,offset:c,filter:l}=n,u=i&&e?t.where(i).equals(e):t.toCollection();l&&(u=u.filter(l));let d=a===r?await u.toArray():await u.sortBy(a);return o&&(d=d.reverse()),c&&(d=d.slice(c)),typeof s==`number`&&(d=d.slice(0,s)),d}return{put:(e,n)=>t.put(a(e,n)),bulkPut:(e,n)=>t.bulkPut(e.map(e=>a(e,n))),get:e=>t.get(e),list:o,update:(e,n)=>t.update(e,n),updateMany:async(e,n)=>{let r=n;return i&&e?t.where(i).equals(e).modify(r):t.toCollection().modify(r)},delete:e=>t.delete(e),clear:async e=>{i&&e?await t.where(i).equals(e).delete():await t.clear()},count:e=>i&&e?t.where(i).equals(e).count():t.count(),raw:t,db:e}}exports.buildStore=i,exports.createOfflineStore=r;
 //# sourceMappingURL=create-offline-store.cjs.map