tempest-react-sdk 0.77.0 → 0.79.0

package/bin/tempest.mjs

@@ -9,7 +9,7 @@
 //   tempest gen <api|icons|component> …   code generators (`new component` = alias)
 //   tempest --help | --version
 import { spawnSync } from "node:child_process";
-import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -17,7 +17,14 @@ import { aliasImports } from "./lib/alias/index.mjs";
 import { describeTypeScript, loadTypeScript } from "./lib/alias/typescript.mjs";
 import { readTsconfig } from "./lib/alias/tsconfig.mjs";
 import { componentFiles } from "./lib/component/generate.mjs";
-import { analyzeCss, applyCssFixes, applyExtraction, planExtraction } from "./lib/css/index.mjs";
+import { landsInside, lstatOrNull } from "./lib/fs/contain.mjs";
+import {
+    analyzeCss,
+    applyCssFixes,
+    applyExtraction,
+    OUTSIDE_PROJECT,
+    planExtraction,
+} from "./lib/css/index.mjs";
 import { analyzeDesign } from "./lib/design/index.mjs";
 import { checkLucide } from "./lib/doctor/lucide.mjs";
 import { generateRegistry, loadIconTables } from "./lib/icons/generate.mjs";
@@ -1052,6 +1059,7 @@ function reportAlias(result, dryRun) {
     for (const err of result.errors) {
         console.log(`  ${c.red}✗ ${err.path}${c.reset} ${c.dim}${err.message}${c.reset}`);
     }
+    reportOutside(result.outside ?? 0);
     if (!result.total) {
         console.log(`  ${c.dim}nothing to convert${c.reset}`);
         return;
@@ -1062,6 +1070,22 @@ function reportAlias(result, dryRun) {
     );
 }
 
+/**
+ * Say how many files a `fix` pass left alone because they resolve outside the
+ * project through a symlink.
+ *
+ * The passes skip those files rather than rewrite them; printing the count here,
+ * and not only in `doctor`, keeps a planted `src -> /elsewhere` from turning
+ * `fix` into a silent no-op.
+ *
+ * @param {number} count - Files skipped by one pass.
+ * @returns {void}
+ */
+function reportOutside(count) {
+    if (count === 0) return;
+    console.log(`  ${c.yellow}! ${count} arquivo(s) fora do projeto (symlink) — pulados${c.reset}`);
+}
+
 /** Prefix for a finding line: red for a browser-visible defect, yellow otherwise. */
 function severityMark(severity) {
     if (severity === "error") return `${c.red}✗${c.reset}`;
@@ -1098,6 +1122,7 @@ function cssPass({ targets, dryRun, extract = false, target, prefix }) {
         );
         return 1;
     }
+    reportOutside(analysis.skipped.filter((s) => s.reason === OUTSIDE_PROJECT).length);
     if (analysis.stats.files === 0) {
         console.log(`  ${c.dim}no stylesheets found${c.reset}`);
         return 0;
@@ -1296,12 +1321,29 @@ async function genApi(args) {
         return 1;
     }
     const outDir = resolve(ROOT, parseOut(args, "src/api"));
+    const outProblem = writeTargetProblem(outDir, "dir");
+    if (outProblem) {
+        console.error(
+            `${c.red}✗ ${shownPath(outDir)} ${outProblem}.${c.reset} Nothing was written.`,
+        );
+        return 1;
+    }
     console.log(`${c.dim}→ loading ${source}${c.reset}`);
     const doc = await loadSpec(source);
     const { files, tags } = generate(doc);
 
-    for (const [rel, contents] of Object.entries(files)) {
-        const dest = join(outDir, rel);
+    const targets = Object.entries(files).map(([rel, contents]) => ({
+        dest: join(outDir, rel),
+        contents,
+    }));
+    for (const { dest } of targets) {
+        const problem = generatedFileProblem(outDir, dest);
+        if (problem) {
+            console.error(`${c.red}✗ ${problem}.${c.reset} Nothing was written.`);
+            return 1;
+        }
+    }
+    for (const { dest, contents } of targets) {
         await mkdir(dirname(dest), { recursive: true });
         await writeFile(dest, contents);
     }
@@ -1343,6 +1385,12 @@ async function genIcons(args) {
     const dirIndex = args.indexOf("--dir");
     const dirRel = dirIndex >= 0 && args[dirIndex + 1] ? args[dirIndex + 1] : "src";
     const dir = resolve(ROOT, dirRel);
+    const dest = resolve(ROOT, outRel);
+    const destProblem = generatedFileProblem(dirname(dest), dest);
+    if (destProblem) {
+        console.error(`${c.red}✗ ${destProblem}.${c.reset} Nothing was written.`);
+        return 1;
+    }
 
     let tables;
     try {
@@ -1361,7 +1409,6 @@ async function genIcons(args) {
         aliases: tables.aliases,
     });
 
-    const dest = resolve(ROOT, outRel);
     await mkdir(dirname(dest), { recursive: true });
     await writeFile(dest, source);
 
@@ -1380,34 +1427,74 @@ async function genIcons(args) {
 // ------------------------------------------------------- gen component ----
 
 /**
- * `lstat` that answers `null` for a missing path instead of throwing.
+ * Why a generator must not write `path`, or `null` when it may.
  *
- * @param {string} path - Absolute path.
- * @returns {import("node:fs").Stats | null}
+ * The one check every generator (`gen api`, `gen icons`, `gen component`) runs on
+ * each folder it creates and each file it writes, before the first write:
+ *
+ * - `path` itself must not be a symlink — dangling included, since `mkdir` and
+ *   `writeFile` follow a link to wherever it points, existing or not;
+ * - it must land inside the project once symlinks are resolved
+ *   ({@link landsInside});
+ * - if it exists, it must be what is about to be written there: a folder for
+ *   `"dir"`, a regular file for `"file"`.
+ *
+ * A symlinked ancestor that resolves inside the project is accepted, as it
+ * always was for `gen component`; one that leaves it, or dangles, is refused.
+ *
+ * @param {string} path - Absolute path about to be created or rewritten.
+ * @param {"dir" | "file"} kind - What the generator writes there.
+ * @returns {string | null} A phrase completing "`<path>` …", or `null`.
  */
-function lstatOrNull(path) {
-    try {
-        return lstatSync(path);
-    } catch {
-        return null;
-    }
+function writeTargetProblem(path, kind) {
+    const stat = lstatOrNull(path);
+    if (stat?.isSymbolicLink()) return "is a symlink; refusing to write through it";
+    if (!landsInside(ROOT, path)) {
+        return `is outside the project (${ROOT}) once symlinks are resolved`;
+    }
+    if (stat && kind === "dir" && !stat.isDirectory()) return "exists and is not a folder";
+    if (stat && kind === "file" && !stat.isFile()) return "is not a regular file";
+    return null;
 }
 
 /**
- * Whether `path` would be created inside the project.
+ * Check one generated file and every folder between `base` and it.
  *
- * Resolves the nearest ancestor that exists through `realpath`, so `../x`, an
- * absolute path and an ancestor that is a symlink to somewhere else
- * (`src/components -> /elsewhere`) are all seen where they really land.
+ * `gen api` writes `<out>/<tag>/service.ts`, so a symlink at `<out>/<tag>` would
+ * carry the write elsewhere as surely as one at `<out>`; each level is checked,
+ * not just the leaf.
  *
- * @param {string} path - Absolute path about to be created.
- * @returns {boolean}
+ * @param {string} base - Folder already checked (the `--out` of `gen api`), or
+ *   the file's own folder when nothing above it is generated.
+ * @param {string} dest - Absolute path of the file about to be written.
+ * @returns {string | null} The full refusal ("`<path>` is …"), or `null`.
  */
-function landsInsideProject(path) {
-    let existing = path;
-    while (!existsSync(existing) && dirname(existing) !== existing) existing = dirname(existing);
-    const rel = relative(realpathSync(ROOT), realpathSync(existing));
-    return !(rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel));
+function generatedFileProblem(base, dest) {
+    const rel = relative(base, dirname(dest));
+    const folders = [base];
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+        folders[0] = dirname(dest);
+    } else {
+        for (const segment of rel.split(sep).filter(Boolean)) {
+            folders.push(join(folders[folders.length - 1], segment));
+        }
+    }
+    for (const folder of folders) {
+        const problem = writeTargetProblem(folder, "dir");
+        if (problem) return `${shownPath(folder)} ${problem}`;
+    }
+    const problem = writeTargetProblem(dest, "file");
+    return problem ? `${shownPath(dest)} ${problem}` : null;
+}
+
+/**
+ * `path` relative to the project, with `/` separators, for messages.
+ *
+ * @param {string} path - Absolute path.
+ * @returns {string}
+ */
+function shownPath(path) {
+    return relative(ROOT, path).split(sep).join("/") || ".";
 }
 
 /**
@@ -1480,33 +1567,22 @@ async function genComponent(args) {
         return 1;
     }
     const dir = resolve(ROOT, parsed.out, generated.name);
-    const shown = relative(ROOT, dir).split(sep).join("/") || ".";
+    const shown = shownPath(dir);
 
-    if (!landsInsideProject(dir)) {
-        console.error(
-            `${c.red}✗ ${dir} is outside the project${c.reset} (${ROOT}), once symlinks are resolved. Pick an --out inside it.`,
-        );
-        return 1;
-    }
-    const dirStat = lstatOrNull(dir);
-    if (dirStat?.isSymbolicLink()) {
-        console.error(`${c.red}✗ ${shown} is a symlink; refusing to write through it.${c.reset}`);
+    const dirProblem = writeTargetProblem(dir, "dir");
+    if (dirProblem) {
+        console.error(`${c.red}✗ ${shown} ${dirProblem}.${c.reset}`);
         return 1;
     }
-    if (dirStat && !parsed.force) {
+    if (lstatOrNull(dir) && !parsed.force) {
         console.error(
             `${c.red}✗ ${shown} already exists.${c.reset} Pass --force to rewrite its five generated files.`,
         );
         return 1;
     }
-    if (dirStat && !dirStat.isDirectory()) {
-        console.error(`${c.red}✗ ${shown} exists and is not a folder.${c.reset}`);
-        return 1;
-    }
-    const blocked = Object.keys(generated.files).find((file) => {
-        const stat = lstatOrNull(join(dir, file));
-        return stat !== null && !stat.isFile();
-    });
+    const blocked = Object.keys(generated.files).find((file) =>
+        writeTargetProblem(join(dir, file), "file"),
+    );
     if (blocked) {
         console.error(
             `${c.red}✗ ${shown}/${blocked} is not a regular file${c.reset} (a folder or a symlink); nothing was written.`,

package/dist/access/Can.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"Can.cjs","names":[],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n    /**\n     * Rendered while an async check is still in flight. Defaults to\n     * {@link fallback}, which keeps the pre-existing behaviour.\n     *\n     * Worth setting whenever `fallback` says something denial-shaped: without\n     * it, a permission that resolves over the network flashes \"no access\" to\n     * someone who has it. `pending={null}` renders nothing until the answer\n     * lands; `pending={<Spinner />}` says why the screen is waiting.\n     */\n    pending?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed and `fallback` when it is denied. While an async check is\n * pending it renders `pending`, which defaults to `fallback`.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n *\n * @example\n * ```tsx\n * <Can\n *   action=\"read\"\n *   resource=\"finance\"\n *   fallback={<p>No access</p>}\n *   pending={<Spinner />}\n * >\n *   <FinancePanel />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback, pending }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{pending === undefined ? (fallback ?? null) : pending}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":"oEA6CA,SAAgB,EAAI,CAAE,SAAQ,WAAU,SAAQ,WAAU,WAAU,WAAqB,CACrF,GAAM,CAAE,UAAS,aAAc,EAAA,OAAO,CAAE,SAAQ,WAAU,QAAO,CAAC,EAElE,OADI,GAAkB,EAAA,EAAA,IAAA,CAAA,EAAA,SAAA,CAAA,SAAG,IAAY,IAAA,GAAa,GAAY,KAAQ,CAAU,CAAA,GACzE,EAAA,EAAA,IAAA,CAAA,EAAA,SAAA,CAAA,SAAG,EAAU,EAAY,GAAY,IAAQ,CAAA,CACxD"}
+{"version":3,"file":"Can.cjs","names":["useCan","_Fragment","require_use_can","react_jsx_runtime","Can","isLoading","pending","fallback","allowed","children"],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n    /**\n     * Rendered while an async check is still in flight. Defaults to\n     * {@link fallback}, which keeps the pre-existing behaviour.\n     *\n     * Worth setting whenever `fallback` says something denial-shaped: without\n     * it, a permission that resolves over the network flashes \"no access\" to\n     * someone who has it. `pending={null}` renders nothing until the answer\n     * lands; `pending={<Spinner />}` says why the screen is waiting.\n     */\n    pending?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed and `fallback` when it is denied. While an async check is\n * pending it renders `pending`, which defaults to `fallback`.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n *\n * @example\n * ```tsx\n * <Can\n *   action=\"read\"\n *   resource=\"finance\"\n *   fallback={<p>No access</p>}\n *   pending={<Spinner />}\n * >\n *   <FinancePanel />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback, pending }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{pending === undefined ? (fallback ?? null) : pending}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":"A,oEA6CA,SAAgBI,EAAI,CAAE,SAAQ,WAAU,SAAQ,WAAU,WAAU,WAAqB,CACrF,GAAM,CAAE,UAAS,aAAcJ,EAAAA,OAAO,CAAE,SAAQ,WAAU,QAAO,CAAC,EAElE,OADIK,GAAkB,EAAAF,EAAA,IAAA,CAAAF,EAAAA,SAAA,CAAA,SAAGK,IAAY,IAAA,GAAaC,GAAY,KAAQD,CAAU,CAAA,GACzE,EAAAH,EAAA,IAAA,CAAAF,EAAAA,SAAA,CAAA,SAAGO,EAAUC,EAAYF,GAAY,IAAQ,CAAA,CACxD,C"}

package/dist/access/Can.js.map

@@ -1 +1 @@
-{"version":3,"file":"Can.js","names":[],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n    /**\n     * Rendered while an async check is still in flight. Defaults to\n     * {@link fallback}, which keeps the pre-existing behaviour.\n     *\n     * Worth setting whenever `fallback` says something denial-shaped: without\n     * it, a permission that resolves over the network flashes \"no access\" to\n     * someone who has it. `pending={null}` renders nothing until the answer\n     * lands; `pending={<Spinner />}` says why the screen is waiting.\n     */\n    pending?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed and `fallback` when it is denied. While an async check is\n * pending it renders `pending`, which defaults to `fallback`.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n *\n * @example\n * ```tsx\n * <Can\n *   action=\"read\"\n *   resource=\"finance\"\n *   fallback={<p>No access</p>}\n *   pending={<Spinner />}\n * >\n *   <FinancePanel />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback, pending }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{pending === undefined ? (fallback ?? null) : pending}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":";;;AA6CA,SAAgB,EAAI,EAAE,WAAQ,aAAU,WAAQ,aAAU,aAAU,cAAqB;CACrF,IAAM,EAAE,YAAS,iBAAc,EAAO;EAAE;EAAQ;EAAU;CAAO,CAAC;CAElE,OADI,IAAkB,kBAAA,GAAA,EAAA,UAAG,MAAY,KAAA,IAAa,KAAY,OAAQ,EAAU,CAAA,IACzE,kBAAA,GAAA,EAAA,UAAG,IAAU,IAAY,KAAY,KAAQ,CAAA;AACxD"}
+{"version":3,"file":"Can.js","names":["_Fragment","Can","useCan","isLoading","Fragment","pending","fallback","allowed","children"],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n    /**\n     * Rendered while an async check is still in flight. Defaults to\n     * {@link fallback}, which keeps the pre-existing behaviour.\n     *\n     * Worth setting whenever `fallback` says something denial-shaped: without\n     * it, a permission that resolves over the network flashes \"no access\" to\n     * someone who has it. `pending={null}` renders nothing until the answer\n     * lands; `pending={<Spinner />}` says why the screen is waiting.\n     */\n    pending?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed and `fallback` when it is denied. While an async check is\n * pending it renders `pending`, which defaults to `fallback`.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n *\n * @example\n * ```tsx\n * <Can\n *   action=\"read\"\n *   resource=\"finance\"\n *   fallback={<p>No access</p>}\n *   pending={<Spinner />}\n * >\n *   <FinancePanel />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback, pending }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{pending === undefined ? (fallback ?? null) : pending}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":";;;AA6CA,SAAgBC,EAAI,EAAE,WAAQ,aAAU,WAAQ,aAAU,aAAU,cAAqB;CACrF,IAAM,EAAE,YAAS,iBAAcC,EAAO;EAAE;EAAQ;EAAU;CAAO,CAAC;CAElE,OADIC,IAAkB,kBAAAH,GAAA,EAAA,UAAGK,MAAY,KAAA,IAAaC,KAAY,OAAQD,EAAU,CAAA,IACzE,kBAAAL,GAAA,EAAA,UAAGO,IAAUC,IAAYF,KAAY,KAAQ,CAAA;AACxD"}

package/dist/access/access-control-context.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"access-control-context.cjs","names":[],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":"sDAIA,IAAM,GAAA,EAAuB,EAAA,cAAA,CAAoC,IAAI,EAmBrE,SAAgB,EAAsB,CAAE,UAAS,YAAwC,CACrF,OACI,EAAA,EAAA,IAAA,CAAC,EAAqB,SAAtB,CAA+B,MAAO,EAAU,UAAwC,CAAA,CAEhG,CAUA,SAAgB,GAAyC,CACrD,OAAA,EAAO,EAAA,WAAA,CAAW,CAAoB,CAC1C"}
+{"version":3,"file":"access-control-context.cjs","names":["createContext","useContext","react","react_jsx_runtime","AccessControlContext","AccessControlProvider","control","useAccessControl"],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":"A,sDAIA,IAAMI,GAAA,EAAuBJ,EAAAA,cAAAA,CAAoC,IAAI,EAmBrE,SAAgBK,EAAsB,CAAE,UAAS,YAAwC,CACrF,OACI,EAAAF,EAAA,IAAA,CAACC,EAAqB,SAAtB,CAA+B,MAAOE,EAAU,UAAwC,CAAA,CAEhG,CAUA,SAAgBC,GAAyC,CACrD,OAAA,EAAON,EAAAA,WAAAA,CAAWG,CAAoB,CAC1C,C"}

package/dist/access/access-control-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-control-context.js","names":[],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":";;;AAIA,IAAM,IAAuB,EAAoC,IAAI;AAmBrE,SAAgB,EAAsB,EAAE,YAAS,eAAwC;CACrF,OACI,kBAAC,EAAqB,UAAtB;EAA+B,OAAO;EAAU;CAAwC,CAAA;AAEhG;AAUA,SAAgB,IAAyC;CACrD,OAAO,EAAW,CAAoB;AAC1C"}
+{"version":3,"file":"access-control-context.js","names":["AccessControlContext","createContext","AccessControlProvider","control","useAccessControl","useContext"],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":";;;AAIA,IAAMA,IAAuBC,EAAoC,IAAI;AAmBrE,SAAgBC,EAAsB,EAAE,YAAS,eAAwC;CACrF,OACI,kBAACF,EAAqB,UAAtB;EAA+B,OAAOG;EAAU;CAAwC,CAAA;AAEhG;AAUA,SAAgBC,IAAyC;CACrD,OAAOC,EAAWL,CAAoB;AAC1C"}

package/dist/access/create-role-access-control.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"create-role-access-control.cjs","names":[],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":"AAWA,SAAS,EAAmB,EAA8C,CACtE,IAAM,EAAM,IAAI,IAAY,EAAO,aAAe,CAAC,CAAC,EAC9C,EAAQ,EAAO,KAAQ,MAAM,QAAQ,EAAO,IAAI,EAAI,EAAO,KAAO,CAAC,EAAO,IAAI,EAAK,CAAC,EAC1F,IAAK,IAAM,KAAQ,EACf,IAAK,IAAM,KAAQ,EAAO,QAAQ,IAAS,CAAC,EACxC,EAAI,IAAI,CAAI,EAGpB,OAAO,CACX,CAwBA,SAAgB,EAAwB,EAAgD,CACpF,IAAM,EAAU,EAAmB,CAAM,EAEzC,MAAO,CACH,IAAI,CAAE,SAAQ,YAAkC,CAO5C,OALI,EAAQ,IAAI,GAAG,GACd,IAAa,IAAA,KACT,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAK,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAQ,IACvE,IAAa,IAAA,IAAa,EAAQ,IAAI,CAAM,EAEhC,CAAE,IAAK,EAAK,EAAI,CAAE,IAAK,GAAO,OAAQ,oBAAqB,CAChF,CACJ,CACJ"}
+{"version":3,"file":"create-role-access-control.cjs","names":["resolvePermissions","set","config","roles","role","perm","createRoleAccessControl","granted","resource","action"],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":"AAWA,SAASA,EAAmB,EAA8C,CACtE,IAAMC,EAAM,IAAI,IAAYC,EAAO,aAAe,CAAC,CAAC,EAC9CC,EAAQD,EAAO,KAAQ,MAAM,QAAQA,EAAO,IAAI,EAAIA,EAAO,KAAO,CAACA,EAAO,IAAI,EAAK,CAAC,EAC1F,IAAK,IAAME,KAAQD,EACf,IAAK,IAAME,KAAQH,EAAO,QAAQE,IAAS,CAAC,EACxCH,EAAI,IAAII,CAAI,EAGpB,OAAOJ,CACX,CAwBA,SAAgBK,EAAwB,EAAgD,CACpF,IAAMC,EAAUP,EAAmBE,CAAM,EAEzC,MAAO,CACH,IAAI,CAAE,SAAQ,YAAkC,CAO5C,OALIK,EAAQ,IAAI,GAAG,GACdC,IAAa,IAAA,KACTD,EAAQ,IAAI,GAAGC,EAAS,GAAG,GAAKD,EAAQ,IAAI,GAAGC,EAAS,GAAGC,GAAQ,IACvED,IAAa,IAAA,IAAaD,EAAQ,IAAIE,CAAM,EAEhC,CAAE,IAAK,EAAK,EAAI,CAAE,IAAK,GAAO,OAAQ,oBAAqB,CAChF,CACJ,CACJ,C"}

package/dist/access/create-role-access-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-role-access-control.js","names":[],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":";AAWA,SAAS,EAAmB,GAA8C;CACtE,IAAM,IAAM,IAAI,IAAY,EAAO,eAAe,CAAC,CAAC,GAC9C,IAAQ,EAAO,OAAQ,MAAM,QAAQ,EAAO,IAAI,IAAI,EAAO,OAAO,CAAC,EAAO,IAAI,IAAK,CAAC;CAC1F,KAAK,IAAM,KAAQ,GACf,KAAK,IAAM,KAAQ,EAAO,QAAQ,MAAS,CAAC,GACxC,EAAI,IAAI,CAAI;CAGpB,OAAO;AACX;AAwBA,SAAgB,EAAwB,GAAgD;CACpF,IAAM,IAAU,EAAmB,CAAM;CAEzC,OAAO,EACH,IAAI,EAAE,WAAQ,eAAkC;EAO5C,OALI,EAAQ,IAAI,GAAG,KACd,MAAa,KAAA,MACT,EAAQ,IAAI,GAAG,EAAS,GAAG,KAAK,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAQ,MACvE,MAAa,KAAA,KAAa,EAAQ,IAAI,CAAM,IAEhC,EAAE,KAAK,GAAK,IAAI;GAAE,KAAK;GAAO,QAAQ;EAAqB;CAChF,EACJ;AACJ"}
+{"version":3,"file":"create-role-access-control.js","names":["resolvePermissions","set","config","roles","role","perm","createRoleAccessControl","granted","resource","action"],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":";AAWA,SAASA,EAAmB,GAA8C;CACtE,IAAMC,IAAM,IAAI,IAAYC,EAAO,eAAe,CAAC,CAAC,GAC9CC,IAAQD,EAAO,OAAQ,MAAM,QAAQA,EAAO,IAAI,IAAIA,EAAO,OAAO,CAACA,EAAO,IAAI,IAAK,CAAC;CAC1F,KAAK,IAAME,KAAQD,GACf,KAAK,IAAME,KAAQH,EAAO,QAAQE,MAAS,CAAC,GACxC,EAAI,IAAIC,CAAI;CAGpB,OAAOJ;AACX;AAwBA,SAAgBK,EAAwB,GAAgD;CACpF,IAAMC,IAAUP,EAAmBE,CAAM;CAEzC,OAAO,EACH,IAAI,EAAE,WAAQ,eAAkC;EAO5C,OALIK,EAAQ,IAAI,GAAG,KACdC,MAAa,KAAA,MACTD,EAAQ,IAAI,GAAGC,EAAS,GAAG,KAAKD,EAAQ,IAAI,GAAGC,EAAS,GAAGC,GAAQ,MACvED,MAAa,KAAA,KAAaD,EAAQ,IAAIE,CAAM,IAEhC,EAAE,KAAK,GAAK,IAAI;GAAE,KAAK;GAAO,QAAQ;EAAqB;CAChF,EACJ;AACJ"}

package/dist/access/permissions-from-token.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-from-token.cjs","names":[],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":"mCAOA,SAAS,EAAiB,EAA0B,CAQhD,OAPI,MAAM,QAAQ,CAAK,EACZ,EAAM,OAAQ,GAAyB,OAAO,GAAS,QAAQ,EAEtE,OAAO,GAAU,SAEV,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,EAErC,CAAC,CACZ,CAcA,SAAgB,EACZ,EACA,EACQ,CACR,GAAI,CACA,GAAM,CAAE,WAAY,EAAA,UAAU,CAAK,EAE7B,EAAU,EAAiB,EADnB,GAAS,OAAS,cACe,EAC/C,GAAI,EAAQ,OAAS,EAAG,OAAO,EAE/B,GAAI,GAAS,QAAU,IAAA,GAAW,CAC9B,IAAM,EAAS,EAAiB,EAAQ,MAAS,EAEjD,OADI,EAAO,OAAS,EAAU,EACvB,EAAiB,EAAQ,KAAQ,CAC5C,CACA,OAAO,CACX,MAAQ,CACJ,MAAO,CAAC,CACZ,CACJ"}
+{"version":3,"file":"permissions-from-token.cjs","names":["decodeJWT","require_jwt","toPermissionList","value","item","permissionsFromToken","token","primary","payload","options","scopes","\"scopes\"","\"scope\""],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":"A,mCAOA,SAASE,EAAiB,EAA0B,CAQhD,OAPI,MAAM,QAAQC,CAAK,EACZA,EAAM,OAAQ,GAAyB,OAAOC,GAAS,QAAQ,EAEtE,OAAOD,GAAU,SAEVA,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,EAErC,CAAC,CACZ,CAcA,SAAgBE,EACZ,EACA,EACQ,CACR,GAAI,CACA,GAAM,CAAE,WAAYL,EAAAA,UAAUM,CAAK,EAE7BC,EAAUL,EAAiBM,EADnBC,GAAS,OAAS,cACe,EAC/C,GAAIF,EAAQ,OAAS,EAAG,OAAOA,EAE/B,GAAIE,GAAS,QAAU,IAAA,GAAW,CAC9B,IAAMC,EAASR,EAAiBM,EAAQG,MAAS,EAEjD,OADID,EAAO,OAAS,EAAUA,EACvBR,EAAiBM,EAAQI,KAAQ,CAC5C,CACA,OAAOL,CACX,MAAQ,CACJ,MAAO,CAAC,CACZ,CACJ,C"}

package/dist/access/permissions-from-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-from-token.js","names":[],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":";;AAOA,SAAS,EAAiB,GAA0B;CAQhD,OAPI,MAAM,QAAQ,CAAK,IACZ,EAAM,QAAQ,MAAyB,OAAO,KAAS,QAAQ,IAEtE,OAAO,KAAU,WAEV,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,IAErC,CAAC;AACZ;AAcA,SAAgB,EACZ,GACA,GACQ;CACR,IAAI;EACA,IAAM,EAAE,eAAY,EAAU,CAAK,GAE7B,IAAU,EAAiB,EADnB,GAAS,SAAS,cACe;EAC/C,IAAI,EAAQ,SAAS,GAAG,OAAO;EAE/B,IAAI,GAAS,UAAU,KAAA,GAAW;GAC9B,IAAM,IAAS,EAAiB,EAAQ,MAAS;GAEjD,OADI,EAAO,SAAS,IAAU,IACvB,EAAiB,EAAQ,KAAQ;EAC5C;EACA,OAAO;CACX,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ"}
+{"version":3,"file":"permissions-from-token.js","names":["toPermissionList","value","item","permissionsFromToken","decodeJWT","token","primary","payload","options","scopes","\"scopes\"","\"scope\""],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":";;AAOA,SAASA,EAAiB,GAA0B;CAQhD,OAPI,MAAM,QAAQC,CAAK,IACZA,EAAM,QAAQ,MAAyB,OAAOC,KAAS,QAAQ,IAEtE,OAAOD,KAAU,WAEVA,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,IAErC,CAAC;AACZ;AAcA,SAAgBE,EACZ,GACA,GACQ;CACR,IAAI;EACA,IAAM,EAAE,eAAYC,EAAUC,CAAK,GAE7BC,IAAUN,EAAiBO,EADnBC,GAAS,SAAS,cACe;EAC/C,IAAIF,EAAQ,SAAS,GAAG,OAAOA;EAE/B,IAAIE,GAAS,UAAU,KAAA,GAAW;GAC9B,IAAMC,IAAST,EAAiBO,EAAQG,MAAS;GAEjD,OADID,EAAO,SAAS,IAAUA,IACvBT,EAAiBO,EAAQI,KAAQ;EAC5C;EACA,OAAOL;CACX,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ"}

package/dist/access/use-can.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-can.cjs","names":[],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":"uEAaA,SAAS,EAAU,EAAwC,CACvD,OAAO,OAAO,GAAW,UAAY,CAAE,IAAK,CAAO,EAAI,CAC3D,CAWA,SAAgB,EAAO,EAAiC,CACpD,IAAM,EAAU,EAAA,iBAAiB,EAC3B,EAAY,KAAK,UAAU,CAAM,EAEjC,CAAC,EAAO,IAAA,EAAY,EAAA,SAAA,KACtB,EAAU,CAAE,QAAS,GAAO,UAAW,EAAK,EAAI,CAAE,QAAS,GAAM,UAAW,EAAM,CACtF,EAiCA,OA/BA,EAAA,EAAA,UAAA,KAAgB,CACZ,GAAI,CAAC,EAAS,CACV,EAAS,CAAE,QAAS,GAAM,UAAW,EAAM,CAAC,EAC5C,MACJ,CAEA,IAAI,EAAY,GAkBhB,OAjBA,EAAU,IAAU,CAAE,GAAG,EAAM,UAAW,EAAK,EAAE,EAEjD,QAAQ,QAAQ,EAAQ,IAAI,CAAM,CAAC,CAAC,CAC/B,KAAM,GAAQ,CACX,GAAI,EAAW,OACf,IAAM,EAAS,EAAU,CAAG,EAC5B,EAAS,CAAE,QAAS,EAAO,IAAK,UAAW,GAAO,OAAQ,EAAO,MAAO,CAAC,CAC7E,CAAC,CAAC,CACD,MAAO,GAAmB,CACnB,GACJ,EAAS,CACL,QAAS,GACT,UAAW,GACX,OAAQ,aAAiB,MAAQ,EAAM,QAAU,qBACrD,CAAC,CACL,CAAC,MAEQ,CACT,EAAY,EAChB,CAGJ,EAAG,CAAC,EAAS,CAAS,CAAC,EAEhB,CACX"}
+{"version":3,"file":"use-can.cjs","names":["useAccessControl","useState","require_access_control_context","react","normalize","result","useCan","control","paramsKey","params","state","setState","cancelled","prev","raw","error"],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":"A,uEAaA,SAASI,EAAU,EAAwC,CACvD,OAAO,OAAOC,GAAW,UAAY,CAAE,IAAKA,CAAO,EAAIA,CAC3D,CAWA,SAAgBC,EAAO,EAAiC,CACpD,IAAMC,EAAUP,EAAAA,iBAAiB,EAC3BQ,EAAY,KAAK,UAAUC,CAAM,EAEjC,CAACC,EAAOC,IAAA,EAAYV,EAAAA,SAAAA,KACtBM,EAAU,CAAE,QAAS,GAAO,UAAW,EAAK,EAAI,CAAE,QAAS,GAAM,UAAW,EAAM,CACtF,EAiCA,OA/BA,EAAAJ,EAAA,UAAA,KAAgB,CACZ,GAAI,CAACI,EAAS,CACVI,EAAS,CAAE,QAAS,GAAM,UAAW,EAAM,CAAC,EAC5C,MACJ,CAEA,IAAIC,EAAY,GAkBhB,OAjBAD,EAAU,IAAU,CAAE,GAAGE,EAAM,UAAW,EAAK,EAAE,EAEjD,QAAQ,QAAQN,EAAQ,IAAIE,CAAM,CAAC,CAAC,CAC/B,KAAM,GAAQ,CACX,GAAIG,EAAW,OACf,IAAMP,EAASD,EAAUU,CAAG,EAC5BH,EAAS,CAAE,QAASN,EAAO,IAAK,UAAW,GAAO,OAAQA,EAAO,MAAO,CAAC,CAC7E,CAAC,CAAC,CACD,MAAO,GAAmB,CACnBO,GACJD,EAAS,CACL,QAAS,GACT,UAAW,GACX,OAAQI,aAAiB,MAAQA,EAAM,QAAU,qBACrD,CAAC,CACL,CAAC,MAEQ,CACT,EAAY,EAChB,CAGJ,EAAG,CAACR,EAASC,CAAS,CAAC,EAEhBE,CACX,C"}

package/dist/access/use-can.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-can.js","names":[],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":";;;AAaA,SAAS,EAAU,GAAwC;CACvD,OAAO,OAAO,KAAW,YAAY,EAAE,KAAK,EAAO,IAAI;AAC3D;AAWA,SAAgB,EAAO,GAAiC;CACpD,IAAM,IAAU,EAAiB,GAC3B,IAAY,KAAK,UAAU,CAAM,GAEjC,CAAC,GAAO,KAAY,QACtB,IAAU;EAAE,SAAS;EAAO,WAAW;CAAK,IAAI;EAAE,SAAS;EAAM,WAAW;CAAM,CACtF;CAiCA,OA/BA,QAAgB;EACZ,IAAI,CAAC,GAAS;GACV,EAAS;IAAE,SAAS;IAAM,WAAW;GAAM,CAAC;GAC5C;EACJ;EAEA,IAAI,IAAY;EAkBhB,OAjBA,GAAU,OAAU;GAAE,GAAG;GAAM,WAAW;EAAK,EAAE,GAEjD,QAAQ,QAAQ,EAAQ,IAAI,CAAM,CAAC,CAAC,CAC/B,MAAM,MAAQ;GACX,IAAI,GAAW;GACf,IAAM,IAAS,EAAU,CAAG;GAC5B,EAAS;IAAE,SAAS,EAAO;IAAK,WAAW;IAAO,QAAQ,EAAO;GAAO,CAAC;EAC7E,CAAC,CAAC,CACD,OAAO,MAAmB;GACnB,KACJ,EAAS;IACL,SAAS;IACT,WAAW;IACX,QAAQ,aAAiB,QAAQ,EAAM,UAAU;GACrD,CAAC;EACL,CAAC,SAEQ;GACT,IAAY;EAChB;CAGJ,GAAG,CAAC,GAAS,CAAS,CAAC,GAEhB;AACX"}
+{"version":3,"file":"use-can.js","names":["normalize","result","useCan","control","useAccessControl","paramsKey","params","state","setState","useState","useEffect","cancelled","prev","raw","error"],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":";;;AAaA,SAASA,EAAU,GAAwC;CACvD,OAAO,OAAOC,KAAW,YAAY,EAAE,KAAKA,EAAO,IAAIA;AAC3D;AAWA,SAAgBC,EAAO,GAAiC;CACpD,IAAMC,IAAUC,EAAiB,GAC3BC,IAAY,KAAK,UAAUC,CAAM,GAEjC,CAACC,GAAOC,KAAYC,QACtBN,IAAU;EAAE,SAAS;EAAO,WAAW;CAAK,IAAI;EAAE,SAAS;EAAM,WAAW;CAAM,CACtF;CAiCA,OA/BAO,QAAgB;EACZ,IAAI,CAACP,GAAS;GACV,EAAS;IAAE,SAAS;IAAM,WAAW;GAAM,CAAC;GAC5C;EACJ;EAEA,IAAIQ,IAAY;EAkBhB,OAjBAH,GAAU,OAAU;GAAE,GAAGI;GAAM,WAAW;EAAK,EAAE,GAEjD,QAAQ,QAAQT,EAAQ,IAAIG,CAAM,CAAC,CAAC,CAC/B,MAAM,MAAQ;GACX,IAAIK,GAAW;GACf,IAAMV,IAASD,EAAUa,CAAG;GAC5B,EAAS;IAAE,SAASZ,EAAO;IAAK,WAAW;IAAO,QAAQA,EAAO;GAAO,CAAC;EAC7E,CAAC,CAAC,CACD,OAAO,MAAmB;GACvB,AAAIU,KACJH,EAAS;IACL,SAAS;IACT,WAAW;IACX,QAAQM,aAAiB,QAAQA,EAAM,UAAU;GACrD,CAAC;EACL,CAAC,SAEQ;GACT,IAAY;EAChB;CAGJ,GAAG,CAACX,GAASE,CAAS,CAAC,GAEhBE;AACX"}

package/dist/app/AppProviders.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AppProviders.cjs","names":[],"sources":["../../src/app/AppProviders.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { QueryProvider } from \"../query/QueryProvider\";\nimport type { QueryProviderProps } from \"../query/QueryProvider\";\nimport { ThemeProvider } from \"../theme/ThemeProvider\";\nimport type { ThemeProviderProps } from \"../theme/ThemeProvider\";\nimport { I18nProvider } from \"../i18n/I18nProvider\";\nimport type { I18nProviderProps } from \"../i18n/I18nProvider\";\nimport { ErrorBoundary } from \"../error-boundary/ErrorBoundary\";\nimport type { ErrorBoundaryProps } from \"../error-boundary/ErrorBoundary\";\n\nexport interface AppProvidersProps {\n    children: ReactNode;\n    /**\n     * TanStack Query config. Enabled by default with SDK defaults; pass `false`\n     * to opt out (e.g. the app already mounts its own `QueryProvider`).\n     */\n    query?: Omit<QueryProviderProps, \"children\"> | false;\n    /**\n     * Theme config. Enabled by default; pass `false` to opt out.\n     */\n    theme?: Omit<ThemeProviderProps, \"children\"> | false;\n    /**\n     * i18n config. Opt-in: provide `locale` + `messages` to mount the provider.\n     */\n    i18n?: Omit<I18nProviderProps, \"children\">;\n    /**\n     * Top-level error boundary. Opt-in: provide a `fallback` to wrap the tree.\n     */\n    errorBoundary?: Omit<ErrorBoundaryProps, \"children\">;\n}\n\n/**\n * Compose the Tempest app-wide providers in one place: error boundary →\n * TanStack Query → theme → i18n. Query and theme are on by default; i18n and\n * the error boundary mount only when configured. Each provider can be disabled\n * or tuned independently, so an app's `main.tsx` stays a single declarative\n * block instead of a hand-nested provider pyramid.\n *\n * @example\n * <AppProviders\n *     errorBoundary={{ fallback: <Crash /> }}\n *     i18n={{ locale: \"pt-BR\", messages }}\n * >\n *     <AppRouter routes={routes} />\n * </AppProviders>\n */\nexport function AppProviders({ children, query, theme, i18n, errorBoundary }: AppProvidersProps) {\n    let tree: ReactNode = children;\n\n    if (i18n) {\n        tree = <I18nProvider {...i18n}>{tree}</I18nProvider>;\n    }\n\n    if (theme !== false) {\n        tree = <ThemeProvider {...(theme || {})}>{tree}</ThemeProvider>;\n    }\n\n    if (query !== false) {\n        tree = <QueryProvider {...(query || {})}>{tree}</QueryProvider>;\n    }\n\n    if (errorBoundary) {\n        tree = <ErrorBoundary {...errorBoundary}>{tree}</ErrorBoundary>;\n    }\n\n    return <>{tree}</>;\n}\n"],"mappings":"gNA8CA,SAAgB,EAAa,CAAE,WAAU,QAAO,QAAO,OAAM,iBAAoC,CAC7F,IAAI,EAAkB,EAkBtB,OAhBI,IACA,GAAO,EAAA,EAAA,IAAA,CAAC,EAAA,aAAD,CAAc,GAAI,EAAO,SAAA,CAAmB,CAAA,GAGnD,IAAU,KACV,GAAO,EAAA,EAAA,IAAA,CAAC,EAAA,cAAD,CAAe,GAAK,GAAS,CAAC,EAAK,SAAA,CAAoB,CAAA,GAG9D,IAAU,KACV,GAAO,EAAA,EAAA,IAAA,CAAC,EAAA,cAAD,CAAe,GAAK,GAAS,CAAC,EAAK,SAAA,CAAoB,CAAA,GAG9D,IACA,GAAO,EAAA,EAAA,IAAA,CAAC,EAAA,cAAD,CAAe,GAAI,EAAgB,SAAA,CAAoB,CAAA,IAG3D,EAAA,EAAA,IAAA,CAAA,EAAA,SAAA,CAAA,SAAG,CAAO,CAAA,CACrB"}
+{"version":3,"file":"AppProviders.cjs","names":["I18nProvider","ThemeProvider","QueryProvider","ErrorBoundary","_Fragment","require_I18nProvider","require_QueryProvider","require_ThemeProvider","require_ErrorBoundary","react_jsx_runtime","AppProviders","tree","children","i18n","theme","query","errorBoundary"],"sources":["../../src/app/AppProviders.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { QueryProvider } from \"../query/QueryProvider\";\nimport type { QueryProviderProps } from \"../query/QueryProvider\";\nimport { ThemeProvider } from \"../theme/ThemeProvider\";\nimport type { ThemeProviderProps } from \"../theme/ThemeProvider\";\nimport { I18nProvider } from \"../i18n/I18nProvider\";\nimport type { I18nProviderProps } from \"../i18n/I18nProvider\";\nimport { ErrorBoundary } from \"../error-boundary/ErrorBoundary\";\nimport type { ErrorBoundaryProps } from \"../error-boundary/ErrorBoundary\";\n\nexport interface AppProvidersProps {\n    children: ReactNode;\n    /**\n     * TanStack Query config. Enabled by default with SDK defaults; pass `false`\n     * to opt out (e.g. the app already mounts its own `QueryProvider`).\n     */\n    query?: Omit<QueryProviderProps, \"children\"> | false;\n    /**\n     * Theme config. Enabled by default; pass `false` to opt out.\n     */\n    theme?: Omit<ThemeProviderProps, \"children\"> | false;\n    /**\n     * i18n config. Opt-in: provide `locale` + `messages` to mount the provider.\n     */\n    i18n?: Omit<I18nProviderProps, \"children\">;\n    /**\n     * Top-level error boundary. Opt-in: provide a `fallback` to wrap the tree.\n     */\n    errorBoundary?: Omit<ErrorBoundaryProps, \"children\">;\n}\n\n/**\n * Compose the Tempest app-wide providers in one place: error boundary →\n * TanStack Query → theme → i18n. Query and theme are on by default; i18n and\n * the error boundary mount only when configured. Each provider can be disabled\n * or tuned independently, so an app's `main.tsx` stays a single declarative\n * block instead of a hand-nested provider pyramid.\n *\n * @example\n * <AppProviders\n *     errorBoundary={{ fallback: <Crash /> }}\n *     i18n={{ locale: \"pt-BR\", messages }}\n * >\n *     <AppRouter routes={routes} />\n * </AppProviders>\n */\nexport function AppProviders({ children, query, theme, i18n, errorBoundary }: AppProvidersProps) {\n    let tree: ReactNode = children;\n\n    if (i18n) {\n        tree = <I18nProvider {...i18n}>{tree}</I18nProvider>;\n    }\n\n    if (theme !== false) {\n        tree = <ThemeProvider {...(theme || {})}>{tree}</ThemeProvider>;\n    }\n\n    if (query !== false) {\n        tree = <QueryProvider {...(query || {})}>{tree}</QueryProvider>;\n    }\n\n    if (errorBoundary) {\n        tree = <ErrorBoundary {...errorBoundary}>{tree}</ErrorBoundary>;\n    }\n\n    return <>{tree}</>;\n}\n"],"mappings":"A,gNA8CA,SAAgBU,EAAa,CAAE,WAAU,QAAO,QAAO,OAAM,iBAAoC,CAC7F,IAAIC,EAAkBC,EAkBtB,OAhBIC,IACA,GAAO,EAAAJ,EAAA,IAAA,CAACT,EAAAA,aAAD,CAAc,GAAIa,EAAO,SAAAF,CAAmB,CAAA,GAGnDG,IAAU,KACV,GAAO,EAAAL,EAAA,IAAA,CAACR,EAAAA,cAAD,CAAe,GAAKa,GAAS,CAAC,EAAK,SAAAH,CAAoB,CAAA,GAG9DI,IAAU,KACV,GAAO,EAAAN,EAAA,IAAA,CAACP,EAAAA,cAAD,CAAe,GAAKa,GAAS,CAAC,EAAK,SAAAJ,CAAoB,CAAA,GAG9DK,IACA,GAAO,EAAAP,EAAA,IAAA,CAACN,EAAAA,cAAD,CAAe,GAAIa,EAAgB,SAAAL,CAAoB,CAAA,IAG3D,EAAAF,EAAA,IAAA,CAAAL,EAAAA,SAAA,CAAA,SAAGO,CAAO,CAAA,CACrB,C"}

package/dist/app/AppProviders.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppProviders.js","names":[],"sources":["../../src/app/AppProviders.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { QueryProvider } from \"../query/QueryProvider\";\nimport type { QueryProviderProps } from \"../query/QueryProvider\";\nimport { ThemeProvider } from \"../theme/ThemeProvider\";\nimport type { ThemeProviderProps } from \"../theme/ThemeProvider\";\nimport { I18nProvider } from \"../i18n/I18nProvider\";\nimport type { I18nProviderProps } from \"../i18n/I18nProvider\";\nimport { ErrorBoundary } from \"../error-boundary/ErrorBoundary\";\nimport type { ErrorBoundaryProps } from \"../error-boundary/ErrorBoundary\";\n\nexport interface AppProvidersProps {\n    children: ReactNode;\n    /**\n     * TanStack Query config. Enabled by default with SDK defaults; pass `false`\n     * to opt out (e.g. the app already mounts its own `QueryProvider`).\n     */\n    query?: Omit<QueryProviderProps, \"children\"> | false;\n    /**\n     * Theme config. Enabled by default; pass `false` to opt out.\n     */\n    theme?: Omit<ThemeProviderProps, \"children\"> | false;\n    /**\n     * i18n config. Opt-in: provide `locale` + `messages` to mount the provider.\n     */\n    i18n?: Omit<I18nProviderProps, \"children\">;\n    /**\n     * Top-level error boundary. Opt-in: provide a `fallback` to wrap the tree.\n     */\n    errorBoundary?: Omit<ErrorBoundaryProps, \"children\">;\n}\n\n/**\n * Compose the Tempest app-wide providers in one place: error boundary →\n * TanStack Query → theme → i18n. Query and theme are on by default; i18n and\n * the error boundary mount only when configured. Each provider can be disabled\n * or tuned independently, so an app's `main.tsx` stays a single declarative\n * block instead of a hand-nested provider pyramid.\n *\n * @example\n * <AppProviders\n *     errorBoundary={{ fallback: <Crash /> }}\n *     i18n={{ locale: \"pt-BR\", messages }}\n * >\n *     <AppRouter routes={routes} />\n * </AppProviders>\n */\nexport function AppProviders({ children, query, theme, i18n, errorBoundary }: AppProvidersProps) {\n    let tree: ReactNode = children;\n\n    if (i18n) {\n        tree = <I18nProvider {...i18n}>{tree}</I18nProvider>;\n    }\n\n    if (theme !== false) {\n        tree = <ThemeProvider {...(theme || {})}>{tree}</ThemeProvider>;\n    }\n\n    if (query !== false) {\n        tree = <QueryProvider {...(query || {})}>{tree}</QueryProvider>;\n    }\n\n    if (errorBoundary) {\n        tree = <ErrorBoundary {...errorBoundary}>{tree}</ErrorBoundary>;\n    }\n\n    return <>{tree}</>;\n}\n"],"mappings":";;;;;;AA8CA,SAAgB,EAAa,EAAE,aAAU,UAAO,UAAO,SAAM,oBAAoC;CAC7F,IAAI,IAAkB;CAkBtB,OAhBI,MACA,IAAO,kBAAC,GAAD;EAAc,GAAI;EAAO,UAAA;CAAmB,CAAA,IAGnD,MAAU,OACV,IAAO,kBAAC,GAAD;EAAe,GAAK,KAAS,CAAC;EAAK,UAAA;CAAoB,CAAA,IAG9D,MAAU,OACV,IAAO,kBAAC,GAAD;EAAe,GAAK,KAAS,CAAC;EAAK,UAAA;CAAoB,CAAA,IAG9D,MACA,IAAO,kBAAC,GAAD;EAAe,GAAI;EAAgB,UAAA;CAAoB,CAAA,IAG3D,kBAAA,GAAA,EAAA,UAAG,EAAO,CAAA;AACrB"}
+{"version":3,"file":"AppProviders.js","names":["_Fragment","AppProviders","tree","children","i18n","I18nProvider","theme","ThemeProvider","query","QueryProvider","errorBoundary","ErrorBoundary","Fragment"],"sources":["../../src/app/AppProviders.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { QueryProvider } from \"../query/QueryProvider\";\nimport type { QueryProviderProps } from \"../query/QueryProvider\";\nimport { ThemeProvider } from \"../theme/ThemeProvider\";\nimport type { ThemeProviderProps } from \"../theme/ThemeProvider\";\nimport { I18nProvider } from \"../i18n/I18nProvider\";\nimport type { I18nProviderProps } from \"../i18n/I18nProvider\";\nimport { ErrorBoundary } from \"../error-boundary/ErrorBoundary\";\nimport type { ErrorBoundaryProps } from \"../error-boundary/ErrorBoundary\";\n\nexport interface AppProvidersProps {\n    children: ReactNode;\n    /**\n     * TanStack Query config. Enabled by default with SDK defaults; pass `false`\n     * to opt out (e.g. the app already mounts its own `QueryProvider`).\n     */\n    query?: Omit<QueryProviderProps, \"children\"> | false;\n    /**\n     * Theme config. Enabled by default; pass `false` to opt out.\n     */\n    theme?: Omit<ThemeProviderProps, \"children\"> | false;\n    /**\n     * i18n config. Opt-in: provide `locale` + `messages` to mount the provider.\n     */\n    i18n?: Omit<I18nProviderProps, \"children\">;\n    /**\n     * Top-level error boundary. Opt-in: provide a `fallback` to wrap the tree.\n     */\n    errorBoundary?: Omit<ErrorBoundaryProps, \"children\">;\n}\n\n/**\n * Compose the Tempest app-wide providers in one place: error boundary →\n * TanStack Query → theme → i18n. Query and theme are on by default; i18n and\n * the error boundary mount only when configured. Each provider can be disabled\n * or tuned independently, so an app's `main.tsx` stays a single declarative\n * block instead of a hand-nested provider pyramid.\n *\n * @example\n * <AppProviders\n *     errorBoundary={{ fallback: <Crash /> }}\n *     i18n={{ locale: \"pt-BR\", messages }}\n * >\n *     <AppRouter routes={routes} />\n * </AppProviders>\n */\nexport function AppProviders({ children, query, theme, i18n, errorBoundary }: AppProvidersProps) {\n    let tree: ReactNode = children;\n\n    if (i18n) {\n        tree = <I18nProvider {...i18n}>{tree}</I18nProvider>;\n    }\n\n    if (theme !== false) {\n        tree = <ThemeProvider {...(theme || {})}>{tree}</ThemeProvider>;\n    }\n\n    if (query !== false) {\n        tree = <QueryProvider {...(query || {})}>{tree}</QueryProvider>;\n    }\n\n    if (errorBoundary) {\n        tree = <ErrorBoundary {...errorBoundary}>{tree}</ErrorBoundary>;\n    }\n\n    return <>{tree}</>;\n}\n"],"mappings":";;;;;;AA8CA,SAAgBC,EAAa,EAAE,aAAU,UAAO,UAAO,SAAM,oBAAoC;CAC7F,IAAIC,IAAkBC;CAkBtB,OAhBIC,MACA,IAAO,kBAACC,GAAD;EAAc,GAAID;EAAO,UAAAF;CAAmB,CAAA,IAGnDI,MAAU,OACV,IAAO,kBAACC,GAAD;EAAe,GAAKD,KAAS,CAAC;EAAK,UAAAJ;CAAoB,CAAA,IAG9DM,MAAU,OACV,IAAO,kBAACC,GAAD;EAAe,GAAKD,KAAS,CAAC;EAAK,UAAAN;CAAoB,CAAA,IAG9DQ,MACA,IAAO,kBAACC,GAAD;EAAe,GAAID;EAAgB,UAAAR;CAAoB,CAAA,IAG3D,kBAAAF,GAAA,EAAA,UAAGE,EAAO,CAAA;AACrB"}

package/dist/audio/audio-bus.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"audio-bus.cjs","names":[],"sources":["../../src/audio/audio-bus.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines — the mixing graph, the per-source handle and the\n * output route are one object's lifetime: the limiter only makes sense after the\n * sum, and the element that carries `setSinkId` is the same one the mix leaves\n * through. Splitting them would hand the caller two halves that are useless apart.\n */\nimport { isAudioOutputSelectionSupported, setAudioOutput } from \"./audio-output\";\n\n/** Default ceiling for a per-source or master gain, as a multiplier. */\nexport const DEFAULT_MAX_GAIN = 3;\n\n/** Shape of the master limiter. Matches `DynamicsCompressorNode`'s params. */\nexport interface LimiterSettings {\n    /** dBFS above which the compressor starts working. */\n    threshold: number;\n    /** dB range over which the curve bends. `0` is a hard knee. */\n    knee: number;\n    /** Input/output ratio above the threshold. 20 is limiting, not compression. */\n    ratio: number;\n    /** Seconds to clamp a peak. */\n    attack: number;\n    /** Seconds to let go. */\n    release: number;\n}\n\n/**\n * A limiter, not a compressor: a hard knee at a 20:1 ratio with a 3 ms attack\n * catches the sum before it clips without audibly ducking anything below it.\n */\nconst DEFAULT_LIMITER: LimiterSettings = {\n    threshold: -8,\n    knee: 0,\n    ratio: 20,\n    attack: 0.003,\n    release: 0.25,\n};\n\n/** Options for {@link createAudioBus}. */\nexport interface AudioBusOptions {\n    /** Ceiling for every gain on this bus. Default {@link DEFAULT_MAX_GAIN}. */\n    maxGain?: number;\n    /** Override the master limiter, or pass `false` to run without one. */\n    limiter?: Partial<LimiterSettings> | false;\n    /**\n     * Reuse an existing `AudioContext` instead of creating one.\n     *\n     * Browsers cap the number of live contexts (Chrome allows around six), so a\n     * page that already has one — a level meter, a player — should hand it over\n     * rather than open a second.\n     */\n    context?: AudioContext;\n}\n\n/** One source attached to the bus. */\nexport interface AudioBusHandle {\n    /**\n     * Set this source's gain, where `1` is the level it arrived at.\n     *\n     * Values above `1` are the point of the whole graph: `element.volume` is\n     * clamped at `1`, so a quiet talker could only ever be attenuated — the one\n     * correction nobody needs.\n     */\n    setGain: (gain: number) => void;\n    /** Current gain, after clamping. */\n    readonly gain: number;\n    /** Detach this source and release its nodes. The bus stays up. */\n    stop: () => void;\n}\n\n/** A running mix. */\nexport interface AudioBus {\n    /**\n     * Play a stream through the shared mix.\n     *\n     * @param stream - The stream to play. Only its first audio track is used.\n     * @param options - `gain` is the initial multiplier, default `1`.\n     * @returns A handle to adjust or detach this source.\n     */\n    attach: (stream: MediaStream, options?: { gain?: number }) => AudioBusHandle;\n    /** Scale every source, on top of its own gain. */\n    setMasterGain: (gain: number) => void;\n    /** Current master gain, after clamping. */\n    readonly masterGain: number;\n    /**\n     * Route the whole mix to one output device.\n     *\n     * @param deviceId - Device id from `useMediaDevices().audioOutputs`, or `\"\"`\n     *   for the system default.\n     * @returns `false` when the engine cannot route audio, or the device is gone.\n     */\n    setOutputDevice: (deviceId: string) => Promise<boolean>;\n    /** Device id the mix is routed to. `\"\"` is the system default. */\n    readonly outputDevice: string;\n    /**\n     * Resume a context the browser started suspended.\n     *\n     * Autoplay policy suspends a context created outside a user gesture, and a\n     * suspended context is silent with no error anywhere. Call this from the\n     * click that starts playback.\n     */\n    resume: () => Promise<void>;\n    /**\n     * Detach everything and close the context this bus created.\n     *\n     * Idempotent, and the bus stays callable afterwards: `attach` hands back an\n     * inert handle instead of throwing. That is not politeness — creating a node\n     * on a closed `AudioContext` throws `InvalidStateError`, and the stream that\n     * arrives late is the normal case (a WebRTC `ontrack` firing after the\n     * component that owned the bus went away).\n     */\n    close: () => void;\n    /** Whether this browser gave us a Web Audio graph at all. */\n    readonly supported: boolean;\n    /** Whether this browser can route the mix to a chosen output device. */\n    readonly canSelectOutput: boolean;\n}\n\n/**\n * Clamp a gain into `0..max`, treating a non-finite value as unity.\n *\n * `NaN` reaches here from an empty input or a failed parse, and assigning it to\n * an `AudioParam` throws — losing the audio for a typo in a number field.\n */\nfunction clampGain(gain: number, max: number): number {\n    if (!Number.isFinite(gain)) return 1;\n    return Math.min(max, Math.max(0, gain));\n}\n\n/** The `AudioContext` constructor this engine exposes, prefixed or not. */\nfunction audioContextConstructor(): typeof AudioContext | undefined {\n    if (typeof AudioContext !== \"undefined\") return AudioContext;\n    return (globalThis as { webkitAudioContext?: typeof AudioContext }).webkitAudioContext;\n}\n\n/** A media element that may support output routing. */\ntype SinkCapableElement = HTMLAudioElement & { setSinkId?: (sinkId: string) => Promise<void> };\n\n/**\n * The stream to feed the graph: just the audio track, when this engine can build\n * one.\n *\n * Isolating the track keeps a camera's video out of the source node. `MediaStream`\n * is missing outside a browser (jsdom, a worker), and there the original stream is\n * the right answer anyway — `createMediaStreamSource` reads its first audio track.\n */\nfunction audioOnly(stream: MediaStream, track: MediaStreamTrack): MediaStream {\n    if (typeof MediaStream === \"undefined\") return stream;\n    return new MediaStream([track]);\n}\n\n/** Start playback without letting an environment that has no media pipeline throw. */\nfunction playQuietly(element: HTMLAudioElement): void {\n    try {\n        void element.play?.()?.catch(() => undefined);\n    } catch {\n        /* jsdom and any engine without a media pipeline — nothing to play anyway */\n    }\n}\n\n/**\n * Mix several streams into one output, with gain above 100% and a master limiter.\n *\n * Three things make this a graph instead of a few `<audio>` elements:\n *\n * 1. **`element.volume` is clamped at `1`.** A participant who speaks too quietly\n *    can only be turned *down* — the one correction nobody needs. A `GainNode`\n *    has no ceiling, so this bus takes one (`maxGain`, default 3).\n * 2. **Clipping is a property of the sum.** Three sources at 200% each are clean\n *    alone and distort the instant they play together. A per-source limiter\n *    cannot see that; the one after the mix can, which is where this puts it.\n * 3. **`setSinkId` lives on the element, not on the context.** Sending the mix to\n *    a headset while the rest of the system keeps the speakers is only reachable\n *    by leaving through a `MediaStreamAudioDestinationNode` into a real\n *    `<audio>`. `AudioContext.setSinkId` has far thinner support.\n *\n * @param options - See {@link AudioBusOptions}.\n * @returns The bus. On an engine with no Web Audio it is inert but callable, and\n *   `supported` is `false` — a page without sound beats a page that throws.\n *\n * @example\n * const bus = createAudioBus({ maxGain: 3 });\n * const handle = bus.attach(remoteStream, { gain: 1 });\n * handle.setGain(2.4);              // above 1 — the point of the whole thing\n * await bus.setOutputDevice(headsetId);\n */\nexport function createAudioBus({\n    maxGain = DEFAULT_MAX_GAIN,\n    limiter: limiterOptions,\n    context: injectedContext,\n}: AudioBusOptions = {}): AudioBus {\n    const Ctor = audioContextConstructor();\n    const context = injectedContext ?? (Ctor ? new Ctor() : null);\n\n    if (!context) {\n        return {\n            attach: () => ({ setGain: () => undefined, gain: 1, stop: () => undefined }),\n            setMasterGain: () => undefined,\n            masterGain: 1,\n            setOutputDevice: async () => false,\n            outputDevice: \"\",\n            resume: async () => undefined,\n            close: () => undefined,\n            supported: false,\n            canSelectOutput: false,\n        };\n    }\n\n    const graph = context;\n    const ownsContext = !injectedContext;\n    const master = graph.createGain();\n    const destination = graph.createMediaStreamDestination();\n\n    let limiterNode: DynamicsCompressorNode | null = null;\n    if (limiterOptions === false) {\n        master.connect(destination);\n    } else {\n        const limiter = graph.createDynamicsCompressor();\n        limiterNode = limiter;\n        const settings = { ...DEFAULT_LIMITER, ...limiterOptions };\n        limiter.threshold.value = settings.threshold;\n        limiter.knee.value = settings.knee;\n        limiter.ratio.value = settings.ratio;\n        limiter.attack.value = settings.attack;\n        limiter.release.value = settings.release;\n        master.connect(limiter);\n        limiter.connect(destination);\n    }\n\n    const element = new Audio();\n    element.autoplay = true;\n    element.srcObject = destination.stream;\n    playQuietly(element);\n\n    let sinkId = \"\";\n    let masterGain = 1;\n    let closed = false;\n    const handles = new Set<AudioBusHandle>();\n\n    /** The handle a bus hands out when there is nothing to play through. */\n    function inertHandle(): AudioBusHandle {\n        return { setGain: () => undefined, gain: 1, stop: () => undefined };\n    }\n\n    /**\n     * Play one stream through the mix.\n     *\n     * The muted `<audio>` anchor is not dead weight, and deleting it as unused is\n     * the mistake this comment exists to prevent: Chrome will not pull samples\n     * from a `MediaStreamAudioSourceNode` built over a **remote** WebRTC stream\n     * unless that same stream is also attached to a media element\n     * (crbug.com/687574). Without it the graph is visibly correct and completely\n     * silent — a day of debugging for anyone who does not know the bug. It is\n     * muted because the audible copy is the one leaving the bus.\n     */\n    function attach(stream: MediaStream, { gain = 1 }: { gain?: number } = {}): AudioBusHandle {\n        const track = stream.getAudioTracks()[0];\n        if (closed || !track) return inertHandle();\n\n        const anchor = new Audio();\n        anchor.muted = true;\n        anchor.autoplay = true;\n        anchor.srcObject = stream;\n        playQuietly(anchor);\n\n        const source = graph.createMediaStreamSource(audioOnly(stream, track));\n        const node = graph.createGain();\n        let current = clampGain(gain, maxGain);\n        node.gain.value = current;\n        source.connect(node);\n        node.connect(master);\n\n        const handle: AudioBusHandle = {\n            setGain(next: number): void {\n                current = clampGain(next, maxGain);\n                node.gain.value = current;\n            },\n            get gain(): number {\n                return current;\n            },\n            stop(): void {\n                if (!handles.has(handle)) return;\n                handles.delete(handle);\n                source.disconnect();\n                node.disconnect();\n                anchor.srcObject = null;\n                anchor.pause();\n            },\n        };\n        handles.add(handle);\n        return handle;\n    }\n\n    return {\n        attach,\n        setMasterGain(gain: number): void {\n            if (closed) return;\n            masterGain = clampGain(gain, maxGain);\n            master.gain.value = masterGain;\n        },\n        get masterGain(): number {\n            return masterGain;\n        },\n        async setOutputDevice(deviceId: string): Promise<boolean> {\n            const applied = await setAudioOutput(element as SinkCapableElement, deviceId);\n            if (applied) sinkId = deviceId;\n            return applied;\n        },\n        get outputDevice(): string {\n            return sinkId;\n        },\n        async resume(): Promise<void> {\n            await graph.resume?.().catch(() => undefined);\n        },\n        close(): void {\n            if (closed) return;\n            closed = true;\n            for (const handle of [...handles]) handle.stop();\n            element.srcObject = null;\n            element.pause();\n            master.disconnect();\n            limiterNode?.disconnect();\n            if (ownsContext) void graph.close().catch(() => undefined);\n        },\n        supported: true,\n        get canSelectOutput(): boolean {\n            return isAudioOutputSelectionSupported();\n        },\n    };\n}\n"],"mappings":"sCASA,IAAa,EAAmB,EAoB1B,EAAmC,CACrC,UAAW,GACX,KAAM,EACN,MAAO,GACP,OAAQ,KACR,QAAS,GACb,EAwFA,SAAS,EAAU,EAAc,EAAqB,CAElD,OADK,OAAO,SAAS,CAAI,EAClB,KAAK,IAAI,EAAK,KAAK,IAAI,EAAG,CAAI,CAAC,EADH,CAEvC,CAGA,SAAS,GAA2D,CAEhE,OADI,OAAO,aAAiB,IAAoB,aACxC,WAA4D,kBACxE,CAaA,SAAS,EAAU,EAAqB,EAAsC,CAE1E,OADI,OAAO,YAAgB,IAAoB,EACxC,IAAI,YAAY,CAAC,CAAK,CAAC,CAClC,CAGA,SAAS,EAAY,EAAiC,CAClD,GAAI,CACA,EAAa,OAAO,CAAC,EAAE,UAAY,IAAA,EAAS,CAChD,MAAQ,CAER,CACJ,CA4BA,SAAgB,EAAe,CAC3B,UAAA,EACA,QAAS,EACT,QAAS,GACQ,CAAC,EAAa,CAC/B,IAAM,EAAO,EAAwB,EAC/B,EAAU,IAAoB,EAAO,IAAI,EAAS,MAExD,GAAI,CAAC,EACD,MAAO,CACH,YAAe,CAAE,YAAe,IAAA,GAAW,KAAM,EAAG,SAAY,IAAA,EAAU,GAC1E,kBAAqB,IAAA,GACrB,WAAY,EACZ,gBAAiB,SAAY,GAC7B,aAAc,GACd,OAAQ,SAAY,IAAA,GACpB,UAAa,IAAA,GACb,UAAW,GACX,gBAAiB,EACrB,EAGJ,IAAM,EAAQ,EACR,EAAc,CAAC,EACf,EAAS,EAAM,WAAW,EAC1B,EAAc,EAAM,6BAA6B,EAEnD,EAA6C,KACjD,GAAI,IAAmB,GACnB,EAAO,QAAQ,CAAW,MACvB,CACH,IAAM,EAAU,EAAM,yBAAyB,EAC/C,EAAc,EACd,IAAM,EAAW,CAAE,GAAG,EAAiB,GAAG,CAAe,EACzD,EAAQ,UAAU,MAAQ,EAAS,UACnC,EAAQ,KAAK,MAAQ,EAAS,KAC9B,EAAQ,MAAM,MAAQ,EAAS,MAC/B,EAAQ,OAAO,MAAQ,EAAS,OAChC,EAAQ,QAAQ,MAAQ,EAAS,QACjC,EAAO,QAAQ,CAAO,EACtB,EAAQ,QAAQ,CAAW,CAC/B,CAEA,IAAM,EAAU,IAAI,MACpB,EAAQ,SAAW,GACnB,EAAQ,UAAY,EAAY,OAChC,EAAY,CAAO,EAEnB,IAAI,EAAS,GACT,EAAa,EACb,EAAS,GACP,EAAU,IAAI,IAGpB,SAAS,GAA8B,CACnC,MAAO,CAAE,YAAe,IAAA,GAAW,KAAM,EAAG,SAAY,IAAA,EAAU,CACtE,CAaA,SAAS,EAAO,EAAqB,CAAE,OAAO,GAAyB,CAAC,EAAmB,CACvF,IAAM,EAAQ,EAAO,eAAe,CAAC,CAAC,GACtC,GAAI,GAAU,CAAC,EAAO,OAAO,EAAY,EAEzC,IAAM,EAAS,IAAI,MACnB,EAAO,MAAQ,GACf,EAAO,SAAW,GAClB,EAAO,UAAY,EACnB,EAAY,CAAM,EAElB,IAAM,EAAS,EAAM,wBAAwB,EAAU,EAAQ,CAAK,CAAC,EAC/D,EAAO,EAAM,WAAW,EAC1B,EAAU,EAAU,EAAM,CAAO,EACrC,EAAK,KAAK,MAAQ,EAClB,EAAO,QAAQ,CAAI,EACnB,EAAK,QAAQ,CAAM,EAEnB,IAAM,EAAyB,CAC3B,QAAQ,EAAoB,CACxB,EAAU,EAAU,EAAM,CAAO,EACjC,EAAK,KAAK,MAAQ,CACtB,EACA,IAAI,MAAe,CACf,OAAO,CACX,EACA,MAAa,CACJ,EAAQ,IAAI,CAAM,IACvB,EAAQ,OAAO,CAAM,EACrB,EAAO,WAAW,EAClB,EAAK,WAAW,EAChB,EAAO,UAAY,KACnB,EAAO,MAAM,EACjB,CACJ,EAEA,OADA,EAAQ,IAAI,CAAM,EACX,CACX,CAEA,MAAO,CACH,SACA,cAAc,EAAoB,CAC1B,IACJ,EAAa,EAAU,EAAM,CAAO,EACpC,EAAO,KAAK,MAAQ,EACxB,EACA,IAAI,YAAqB,CACrB,OAAO,CACX,EACA,MAAM,gBAAgB,EAAoC,CACtD,IAAM,EAAU,MAAM,EAAA,eAAe,EAA+B,CAAQ,EAE5E,OADI,IAAS,EAAS,GACf,CACX,EACA,IAAI,cAAuB,CACvB,OAAO,CACX,EACA,MAAM,QAAwB,CAC1B,MAAM,EAAM,SAAS,CAAC,CAAC,UAAY,IAAA,EAAS,CAChD,EACA,OAAc,CACN,MACJ,GAAS,GACT,IAAK,IAAM,IAAU,CAAC,GAAG,CAAO,EAAG,EAAO,KAAK,EAC/C,EAAQ,UAAY,KACpB,EAAQ,MAAM,EACd,EAAO,WAAW,EAClB,GAAa,WAAW,EACpB,GAAa,EAAW,MAAM,CAAC,CAAC,UAAY,IAAA,EAAS,CANhD,CAOb,EACA,UAAW,GACX,IAAI,iBAA2B,CAC3B,OAAO,EAAA,gCAAgC,CAC3C,CACJ,CACJ"}
+{"version":3,"file":"audio-bus.cjs","names":["setAudioOutput","isAudioOutputSelectionSupported","require_audio_output","DEFAULT_MAX_GAIN","DEFAULT_LIMITER","clampGain","gain","max","audioContextConstructor","audioOnly","stream","track","playQuietly","element","createAudioBus","limiterOptions","injectedContext","Ctor","context","graph","ownsContext","master","destination","limiterNode","limiter","settings","sinkId","masterGain","closed","handles","inertHandle","attach","anchor","source","node","current","maxGain","handle","next","applied","deviceId"],"sources":["../../src/audio/audio-bus.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines — the mixing graph, the per-source handle and the\n * output route are one object's lifetime: the limiter only makes sense after the\n * sum, and the element that carries `setSinkId` is the same one the mix leaves\n * through. Splitting them would hand the caller two halves that are useless apart.\n */\nimport { isAudioOutputSelectionSupported, setAudioOutput } from \"./audio-output\";\n\n/** Default ceiling for a per-source or master gain, as a multiplier. */\nexport const DEFAULT_MAX_GAIN = 3;\n\n/** Shape of the master limiter. Matches `DynamicsCompressorNode`'s params. */\nexport interface LimiterSettings {\n    /** dBFS above which the compressor starts working. */\n    threshold: number;\n    /** dB range over which the curve bends. `0` is a hard knee. */\n    knee: number;\n    /** Input/output ratio above the threshold. 20 is limiting, not compression. */\n    ratio: number;\n    /** Seconds to clamp a peak. */\n    attack: number;\n    /** Seconds to let go. */\n    release: number;\n}\n\n/**\n * A limiter, not a compressor: a hard knee at a 20:1 ratio with a 3 ms attack\n * catches the sum before it clips without audibly ducking anything below it.\n */\nconst DEFAULT_LIMITER: LimiterSettings = {\n    threshold: -8,\n    knee: 0,\n    ratio: 20,\n    attack: 0.003,\n    release: 0.25,\n};\n\n/** Options for {@link createAudioBus}. */\nexport interface AudioBusOptions {\n    /** Ceiling for every gain on this bus. Default {@link DEFAULT_MAX_GAIN}. */\n    maxGain?: number;\n    /** Override the master limiter, or pass `false` to run without one. */\n    limiter?: Partial<LimiterSettings> | false;\n    /**\n     * Reuse an existing `AudioContext` instead of creating one.\n     *\n     * Browsers cap the number of live contexts (Chrome allows around six), so a\n     * page that already has one — a level meter, a player — should hand it over\n     * rather than open a second.\n     */\n    context?: AudioContext;\n}\n\n/** One source attached to the bus. */\nexport interface AudioBusHandle {\n    /**\n     * Set this source's gain, where `1` is the level it arrived at.\n     *\n     * Values above `1` are the point of the whole graph: `element.volume` is\n     * clamped at `1`, so a quiet talker could only ever be attenuated — the one\n     * correction nobody needs.\n     */\n    setGain: (gain: number) => void;\n    /** Current gain, after clamping. */\n    readonly gain: number;\n    /** Detach this source and release its nodes. The bus stays up. */\n    stop: () => void;\n}\n\n/** A running mix. */\nexport interface AudioBus {\n    /**\n     * Play a stream through the shared mix.\n     *\n     * @param stream - The stream to play. Only its first audio track is used.\n     * @param options - `gain` is the initial multiplier, default `1`.\n     * @returns A handle to adjust or detach this source.\n     */\n    attach: (stream: MediaStream, options?: { gain?: number }) => AudioBusHandle;\n    /** Scale every source, on top of its own gain. */\n    setMasterGain: (gain: number) => void;\n    /** Current master gain, after clamping. */\n    readonly masterGain: number;\n    /**\n     * Route the whole mix to one output device.\n     *\n     * @param deviceId - Device id from `useMediaDevices().audioOutputs`, or `\"\"`\n     *   for the system default.\n     * @returns `false` when the engine cannot route audio, or the device is gone.\n     */\n    setOutputDevice: (deviceId: string) => Promise<boolean>;\n    /** Device id the mix is routed to. `\"\"` is the system default. */\n    readonly outputDevice: string;\n    /**\n     * Resume a context the browser started suspended.\n     *\n     * Autoplay policy suspends a context created outside a user gesture, and a\n     * suspended context is silent with no error anywhere. Call this from the\n     * click that starts playback.\n     */\n    resume: () => Promise<void>;\n    /**\n     * Detach everything and close the context this bus created.\n     *\n     * Idempotent, and the bus stays callable afterwards: `attach` hands back an\n     * inert handle instead of throwing. That is not politeness — creating a node\n     * on a closed `AudioContext` throws `InvalidStateError`, and the stream that\n     * arrives late is the normal case (a WebRTC `ontrack` firing after the\n     * component that owned the bus went away).\n     */\n    close: () => void;\n    /** Whether this browser gave us a Web Audio graph at all. */\n    readonly supported: boolean;\n    /** Whether this browser can route the mix to a chosen output device. */\n    readonly canSelectOutput: boolean;\n}\n\n/**\n * Clamp a gain into `0..max`, treating a non-finite value as unity.\n *\n * `NaN` reaches here from an empty input or a failed parse, and assigning it to\n * an `AudioParam` throws — losing the audio for a typo in a number field.\n */\nfunction clampGain(gain: number, max: number): number {\n    if (!Number.isFinite(gain)) return 1;\n    return Math.min(max, Math.max(0, gain));\n}\n\n/** The `AudioContext` constructor this engine exposes, prefixed or not. */\nfunction audioContextConstructor(): typeof AudioContext | undefined {\n    if (typeof AudioContext !== \"undefined\") return AudioContext;\n    return (globalThis as { webkitAudioContext?: typeof AudioContext }).webkitAudioContext;\n}\n\n/** A media element that may support output routing. */\ntype SinkCapableElement = HTMLAudioElement & { setSinkId?: (sinkId: string) => Promise<void> };\n\n/**\n * The stream to feed the graph: just the audio track, when this engine can build\n * one.\n *\n * Isolating the track keeps a camera's video out of the source node. `MediaStream`\n * is missing outside a browser (jsdom, a worker), and there the original stream is\n * the right answer anyway — `createMediaStreamSource` reads its first audio track.\n */\nfunction audioOnly(stream: MediaStream, track: MediaStreamTrack): MediaStream {\n    if (typeof MediaStream === \"undefined\") return stream;\n    return new MediaStream([track]);\n}\n\n/** Start playback without letting an environment that has no media pipeline throw. */\nfunction playQuietly(element: HTMLAudioElement): void {\n    try {\n        void element.play?.()?.catch(() => undefined);\n    } catch {\n        /* jsdom and any engine without a media pipeline — nothing to play anyway */\n    }\n}\n\n/**\n * Mix several streams into one output, with gain above 100% and a master limiter.\n *\n * Three things make this a graph instead of a few `<audio>` elements:\n *\n * 1. **`element.volume` is clamped at `1`.** A participant who speaks too quietly\n *    can only be turned *down* — the one correction nobody needs. A `GainNode`\n *    has no ceiling, so this bus takes one (`maxGain`, default 3).\n * 2. **Clipping is a property of the sum.** Three sources at 200% each are clean\n *    alone and distort the instant they play together. A per-source limiter\n *    cannot see that; the one after the mix can, which is where this puts it.\n * 3. **`setSinkId` lives on the element, not on the context.** Sending the mix to\n *    a headset while the rest of the system keeps the speakers is only reachable\n *    by leaving through a `MediaStreamAudioDestinationNode` into a real\n *    `<audio>`. `AudioContext.setSinkId` has far thinner support.\n *\n * @param options - See {@link AudioBusOptions}.\n * @returns The bus. On an engine with no Web Audio it is inert but callable, and\n *   `supported` is `false` — a page without sound beats a page that throws.\n *\n * @example\n * const bus = createAudioBus({ maxGain: 3 });\n * const handle = bus.attach(remoteStream, { gain: 1 });\n * handle.setGain(2.4);              // above 1 — the point of the whole thing\n * await bus.setOutputDevice(headsetId);\n */\nexport function createAudioBus({\n    maxGain = DEFAULT_MAX_GAIN,\n    limiter: limiterOptions,\n    context: injectedContext,\n}: AudioBusOptions = {}): AudioBus {\n    const Ctor = audioContextConstructor();\n    const context = injectedContext ?? (Ctor ? new Ctor() : null);\n\n    if (!context) {\n        return {\n            attach: () => ({ setGain: () => undefined, gain: 1, stop: () => undefined }),\n            setMasterGain: () => undefined,\n            masterGain: 1,\n            setOutputDevice: async () => false,\n            outputDevice: \"\",\n            resume: async () => undefined,\n            close: () => undefined,\n            supported: false,\n            canSelectOutput: false,\n        };\n    }\n\n    const graph = context;\n    const ownsContext = !injectedContext;\n    const master = graph.createGain();\n    const destination = graph.createMediaStreamDestination();\n\n    let limiterNode: DynamicsCompressorNode | null = null;\n    if (limiterOptions === false) {\n        master.connect(destination);\n    } else {\n        const limiter = graph.createDynamicsCompressor();\n        limiterNode = limiter;\n        const settings = { ...DEFAULT_LIMITER, ...limiterOptions };\n        limiter.threshold.value = settings.threshold;\n        limiter.knee.value = settings.knee;\n        limiter.ratio.value = settings.ratio;\n        limiter.attack.value = settings.attack;\n        limiter.release.value = settings.release;\n        master.connect(limiter);\n        limiter.connect(destination);\n    }\n\n    const element = new Audio();\n    element.autoplay = true;\n    element.srcObject = destination.stream;\n    playQuietly(element);\n\n    let sinkId = \"\";\n    let masterGain = 1;\n    let closed = false;\n    const handles = new Set<AudioBusHandle>();\n\n    /** The handle a bus hands out when there is nothing to play through. */\n    function inertHandle(): AudioBusHandle {\n        return { setGain: () => undefined, gain: 1, stop: () => undefined };\n    }\n\n    /**\n     * Play one stream through the mix.\n     *\n     * The muted `<audio>` anchor is not dead weight, and deleting it as unused is\n     * the mistake this comment exists to prevent: Chrome will not pull samples\n     * from a `MediaStreamAudioSourceNode` built over a **remote** WebRTC stream\n     * unless that same stream is also attached to a media element\n     * (crbug.com/687574). Without it the graph is visibly correct and completely\n     * silent — a day of debugging for anyone who does not know the bug. It is\n     * muted because the audible copy is the one leaving the bus.\n     */\n    function attach(stream: MediaStream, { gain = 1 }: { gain?: number } = {}): AudioBusHandle {\n        const track = stream.getAudioTracks()[0];\n        if (closed || !track) return inertHandle();\n\n        const anchor = new Audio();\n        anchor.muted = true;\n        anchor.autoplay = true;\n        anchor.srcObject = stream;\n        playQuietly(anchor);\n\n        const source = graph.createMediaStreamSource(audioOnly(stream, track));\n        const node = graph.createGain();\n        let current = clampGain(gain, maxGain);\n        node.gain.value = current;\n        source.connect(node);\n        node.connect(master);\n\n        const handle: AudioBusHandle = {\n            setGain(next: number): void {\n                current = clampGain(next, maxGain);\n                node.gain.value = current;\n            },\n            get gain(): number {\n                return current;\n            },\n            stop(): void {\n                if (!handles.has(handle)) return;\n                handles.delete(handle);\n                source.disconnect();\n                node.disconnect();\n                anchor.srcObject = null;\n                anchor.pause();\n            },\n        };\n        handles.add(handle);\n        return handle;\n    }\n\n    return {\n        attach,\n        setMasterGain(gain: number): void {\n            if (closed) return;\n            masterGain = clampGain(gain, maxGain);\n            master.gain.value = masterGain;\n        },\n        get masterGain(): number {\n            return masterGain;\n        },\n        async setOutputDevice(deviceId: string): Promise<boolean> {\n            const applied = await setAudioOutput(element as SinkCapableElement, deviceId);\n            if (applied) sinkId = deviceId;\n            return applied;\n        },\n        get outputDevice(): string {\n            return sinkId;\n        },\n        async resume(): Promise<void> {\n            await graph.resume?.().catch(() => undefined);\n        },\n        close(): void {\n            if (closed) return;\n            closed = true;\n            for (const handle of [...handles]) handle.stop();\n            element.srcObject = null;\n            element.pause();\n            master.disconnect();\n            limiterNode?.disconnect();\n            if (ownsContext) void graph.close().catch(() => undefined);\n        },\n        supported: true,\n        get canSelectOutput(): boolean {\n            return isAudioOutputSelectionSupported();\n        },\n    };\n}\n"],"mappings":"A,sCASA,IAAaG,EAAmB,EAoB1BC,EAAmC,CACrC,UAAW,GACX,KAAM,EACN,MAAO,GACP,OAAQ,KACR,QAAS,GACb,EAwFA,SAASC,EAAU,EAAc,EAAqB,CAElD,OADK,OAAO,SAASC,CAAI,EAClB,KAAK,IAAIC,EAAK,KAAK,IAAI,EAAGD,CAAI,CAAC,EADH,CAEvC,CAGA,SAASE,GAA2D,CAEhE,OADI,OAAO,aAAiB,IAAoB,aACxC,WAA4D,kBACxE,CAaA,SAASC,EAAU,EAAqB,EAAsC,CAE1E,OADI,OAAO,YAAgB,IAAoBC,EACxC,IAAI,YAAY,CAACC,CAAK,CAAC,CAClC,CAGA,SAASC,EAAY,EAAiC,CAClD,GAAI,CACAC,EAAa,OAAO,CAAC,EAAE,UAAY,IAAA,EAAS,CAChD,MAAQ,CAER,CACJ,CA4BA,SAAgBC,EAAe,CAC3B,UAAA,EACA,QAASC,EACT,QAASC,GACQ,CAAC,EAAa,CAC/B,IAAMC,EAAOT,EAAwB,EAC/BU,EAAUF,IAAoBC,EAAO,IAAIA,EAAS,MAExD,GAAI,CAACC,EACD,MAAO,CACH,YAAe,CAAE,YAAe,IAAA,GAAW,KAAM,EAAG,SAAY,IAAA,EAAU,GAC1E,kBAAqB,IAAA,GACrB,WAAY,EACZ,gBAAiB,SAAY,GAC7B,aAAc,GACd,OAAQ,SAAY,IAAA,GACpB,UAAa,IAAA,GACb,UAAW,GACX,gBAAiB,EACrB,EAGJ,IAAMC,EAAQD,EACRE,EAAc,CAACJ,EACfK,EAASF,EAAM,WAAW,EAC1BG,EAAcH,EAAM,6BAA6B,EAEnDI,EAA6C,KACjD,GAAIR,IAAmB,GACnBM,EAAO,QAAQC,CAAW,MACvB,CACH,IAAME,EAAUL,EAAM,yBAAyB,EAC/C,EAAcK,EACd,IAAMC,EAAW,CAAE,GAAGrB,EAAiB,GAAGW,CAAe,EACzD,EAAQ,UAAU,MAAQU,EAAS,UACnC,EAAQ,KAAK,MAAQA,EAAS,KAC9B,EAAQ,MAAM,MAAQA,EAAS,MAC/B,EAAQ,OAAO,MAAQA,EAAS,OAChC,EAAQ,QAAQ,MAAQA,EAAS,QACjCJ,EAAO,QAAQG,CAAO,EACtBA,EAAQ,QAAQF,CAAW,CAC/B,CAEA,IAAMT,EAAU,IAAI,MACpB,EAAQ,SAAW,GACnB,EAAQ,UAAYS,EAAY,OAChCV,EAAYC,CAAO,EAEnB,IAAIa,EAAS,GACTC,EAAa,EACbC,EAAS,GACPC,EAAU,IAAI,IAGpB,SAASC,GAA8B,CACnC,MAAO,CAAE,YAAe,IAAA,GAAW,KAAM,EAAG,SAAY,IAAA,EAAU,CACtE,CAaA,SAASC,EAAO,EAAqB,CAAE,OAAO,GAAyB,CAAC,EAAmB,CACvF,IAAMpB,EAAQD,EAAO,eAAe,CAAC,CAAC,GACtC,GAAIkB,GAAU,CAACjB,EAAO,OAAOmB,EAAY,EAEzC,IAAME,EAAS,IAAI,MACnB,EAAO,MAAQ,GACf,EAAO,SAAW,GAClB,EAAO,UAAYtB,EACnBE,EAAYoB,CAAM,EAElB,IAAMC,EAASd,EAAM,wBAAwBV,EAAUC,EAAQC,CAAK,CAAC,EAC/DuB,EAAOf,EAAM,WAAW,EAC1BgB,EAAU9B,EAAUC,EAAM8B,CAAO,EACrC,EAAK,KAAK,MAAQD,EAClBF,EAAO,QAAQC,CAAI,EACnBA,EAAK,QAAQb,CAAM,EAEnB,IAAMgB,EAAyB,CAC3B,QAAQ,EAAoB,CACxB,EAAUhC,EAAUiC,EAAMF,CAAO,EACjC,EAAK,KAAK,MAAQD,CACtB,EACA,IAAI,MAAe,CACf,OAAOA,CACX,EACA,MAAa,CACJN,EAAQ,IAAIQ,CAAM,IACvBR,EAAQ,OAAOQ,CAAM,EACrBJ,EAAO,WAAW,EAClBC,EAAK,WAAW,EAChB,EAAO,UAAY,KACnBF,EAAO,MAAM,EACjB,CACJ,EAEA,OADAH,EAAQ,IAAIQ,CAAM,EACXA,CACX,CAEA,MAAO,CACH,SACA,cAAc,EAAoB,CAC1BT,IACJ,EAAavB,EAAUC,EAAM8B,CAAO,EACpC,EAAO,KAAK,MAAQT,EACxB,EACA,IAAI,YAAqB,CACrB,OAAOA,CACX,EACA,MAAM,gBAAgB,EAAoC,CACtD,IAAMY,EAAU,MAAMvC,EAAAA,eAAea,EAA+B2B,CAAQ,EAE5E,OADID,IAAS,EAASC,GACfD,CACX,EACA,IAAI,cAAuB,CACvB,OAAOb,CACX,EACA,MAAM,QAAwB,CAC1B,MAAMP,EAAM,SAAS,CAAC,CAAC,UAAY,IAAA,EAAS,CAChD,EACA,OAAc,CACV,GAAI,GACJ,GAAS,GACT,IAAK,IAAMkB,IAAU,CAAC,GAAGR,CAAO,EAAGQ,EAAO,KAAK,EAC/C,EAAQ,UAAY,KACpBxB,EAAQ,MAAM,EACdQ,EAAO,WAAW,EAClBE,GAAa,WAAW,EACpBH,GAAaD,EAAW,MAAM,CAAC,CAAC,UAAY,IAAA,EAAS,CANhD,CAOb,EACA,UAAW,GACX,IAAI,iBAA2B,CAC3B,OAAOlB,EAAAA,gCAAgC,CAC3C,CACJ,CACJ,C"}