tempest-react-sdk 0.81.0 → 0.83.0

package/bin/tempest-gen.test.mjs

@@ -186,3 +186,103 @@ describe("tempest gen api / gen icons — write containment (#484)", () => {
         expect(filesUnder(outside)).toEqual([]);
     });
 });
+
+describe("tempest gen api — spec text never drives the terminal (#533)", () => {
+    const TERMINAL_CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/;
+    const SGR = /\u001b\[\d+(?:;\d+)*m/g;
+    let cwd;
+
+    beforeEach(() => {
+        cwd = mkdtempSync(join(tmpdir(), "tempest-gen-tty-"));
+        mkdirSync(join(cwd, "src"));
+    });
+
+    afterEach(() => {
+        rmSync(cwd, { recursive: true, force: true });
+    });
+
+    /**
+     * Write `doc` as the project's spec and run `tempest gen api` on it.
+     *
+     * @param {object} doc - The OpenAPI document.
+     * @returns {{ status: number | null, out: string }} Exit code and the
+     *   combined output with the CLI's own color codes removed.
+     */
+    function genApi(doc) {
+        writeFileSync(join(cwd, "spec.json"), JSON.stringify(doc));
+        const result = spawnSync(process.execPath, [CLI, "gen", "api", "spec.json"], {
+            cwd,
+            encoding: "utf8",
+        });
+        return { status: result.status, out: (result.stdout + result.stderr).replace(SGR, "") };
+    }
+
+    it("a tag carrying OSC, CSI and carriage-return sequences prints without them", () => {
+        const tag = "users\u001b]0;PWNED\u0007\u001b]8;;https://evil/\u001b\\x\u009b2J\r";
+        const { status, out } = genApi({
+            ...SPEC,
+            paths: {
+                "/users": { get: { tags: [tag], responses: { 200: { description: "ok" } } } },
+            },
+        });
+
+        expect(status).toBe(0);
+        expect(out).not.toMatch(TERMINAL_CONTROL);
+        expect(out).not.toContain("\u001b]");
+        expect(out).toContain("users]0;PWNED]8;;https://evil/\\x2J");
+    });
+
+    it("the usage hint names the folder and class that were generated", () => {
+        const { out } = genApi({
+            ...SPEC,
+            paths: {
+                "/users": {
+                    get: { tags: ["User Profiles"], responses: { 200: { description: "ok" } } },
+                },
+            },
+        });
+
+        expect(out).toContain('import { UserProfilesService } from "@/api/user-profiles";');
+    });
+
+    it("a refusal that quotes a C1 control from the spec prints without it", () => {
+        const { status, out } = genApi({
+            ...SPEC,
+            paths: { "https://x\u009b2J/": { get: { responses: { 200: { description: "ok" } } } } },
+        });
+
+        expect(status).toBe(1);
+        expect(out).toMatch(/does not start with "\/"/);
+        expect(out).not.toMatch(TERMINAL_CONTROL);
+    });
+
+    it("a nested-quantifier pattern is printed as a warning and the files are still written", () => {
+        const { status, out } = genApi({
+            ...SPEC,
+            components: {
+                schemas: {
+                    Q: { type: "object", properties: { s: { type: "string", pattern: "(a+)+" } } },
+                },
+            },
+            paths: {
+                "/users": {
+                    post: {
+                        tags: ["users"],
+                        requestBody: {
+                            content: {
+                                "application/json": { schema: { $ref: "#/components/schemas/Q" } },
+                            },
+                        },
+                        responses: { 200: { description: "ok" } },
+                    },
+                },
+            },
+        });
+
+        expect(status).toBe(0);
+        expect(out).toMatch(
+            /! OpenAPI schema "Q" at properties\.s: pattern "\(a\+\)\+" repeats a group/,
+        );
+        expect(existsSync(join(cwd, "src", "api", "users", "schemas.ts"))).toBe(true);
+    });
+});

package/bin/tempest.mjs

@@ -27,7 +27,9 @@ import {
 } from "./lib/css/index.mjs";
 import { analyzeDesign } from "./lib/design/index.mjs";
 import { checkLucide } from "./lib/doctor/lucide.mjs";
+import { checkVitest, VITEST_CONFIG_FILES } from "./lib/doctor/vitest.mjs";
 import { generateRegistry, loadIconTables } from "./lib/icons/generate.mjs";
+import { terminalText } from "./lib/openapi/escape.mjs";
 import { generate } from "./lib/openapi/generate.mjs";
 import { loadSpec } from "./lib/openapi/load.mjs";
 
@@ -789,6 +791,18 @@ function doctor(args = []) {
                   ],
         );
     }
+    if (usesSdk) {
+        checks.push(
+            ...checkVitest({
+                vitestInstalled: Boolean(installedVersion("vitest")),
+                configs: Object.fromEntries(
+                    VITEST_CONFIG_FILES.filter((name) => existsSync(join(ROOT, name))).map(
+                        (name) => [name, readFileSync(join(ROOT, name), "utf8")],
+                    ),
+                ),
+            }),
+        );
+    }
     const entry = firstExisting(["src/main.tsx", "src/main.ts", "src/index.tsx", "src/index.ts"]);
     if (usesSdk) {
         // Without the stylesheet every component renders unstyled, so for an SDK
@@ -1330,7 +1344,7 @@ async function genApi(args) {
     }
     console.log(`${c.dim}→ loading ${source}${c.reset}`);
     const doc = await loadSpec(source);
-    const { files, tags } = generate(doc);
+    const { files, tags, services, warnings } = generate(doc);
 
     const targets = Object.entries(files).map(([rel, contents]) => ({
         dest: join(outDir, rel),
@@ -1349,8 +1363,11 @@ async function genApi(args) {
     }
 
     console.log(
-        `\n${c.green}✓ Generated${c.reset} ${Object.keys(files).length} files for ${tags.length} route group(s): ${c.bold}${tags.join(", ")}${c.reset}`,
+        `\n${c.green}✓ Generated${c.reset} ${Object.keys(files).length} files for ${tags.length} route group(s): ${c.bold}${terminalText(tags.join(", "))}${c.reset}`,
     );
+    for (const warning of warnings) {
+        console.log(`${c.yellow}! ${terminalText(warning)}${c.reset}`);
+    }
     console.log(`  ${c.dim}out: ${outDir}${c.reset}`);
     const prettier = localBin("prettier");
     if (prettier) {
@@ -1359,12 +1376,11 @@ async function genApi(args) {
     }
     console.log(`\n${c.dim}Inject an ApiClient into a service:${c.reset}`);
     console.log(`  import { createApiClient } from "tempest-react-sdk";`);
-    if (tags[0]) {
-        const cls = tags[0].replace(/[^a-zA-Z0-9]+(.)?/g, (_, ch) => (ch ? ch.toUpperCase() : ""));
-        const Cls = cls.charAt(0).toUpperCase() + cls.slice(1) + "Service";
-        console.log(`  import { ${Cls} } from "@/api/${tags[0].toLowerCase()}";`);
+    if (services[0]) {
+        const { slug, className } = services[0];
+        console.log(`  import { ${className} } from "@/api/${slug}";`);
         console.log(
-            `  const svc = new ${Cls}(createApiClient({ baseURL: import.meta.env.VITE_API_URL }));`,
+            `  const svc = new ${className}(createApiClient({ baseURL: import.meta.env.VITE_API_URL }));`,
         );
     }
     return 0;
@@ -1721,7 +1737,7 @@ if (result instanceof Promise) {
         .then((code) => process.exit(code))
         .catch((err) => {
             console.error(
-                `${c.red}✗ ${err instanceof Error ? err.message : String(err)}${c.reset}`,
+                `${c.red}✗ ${terminalText(err instanceof Error ? err.message : String(err))}${c.reset}`,
             );
             process.exit(1);
         });

package/dist/access/use-can.cjs

@@ -1,2 +1,2 @@
-const e=require("./access-control-context.cjs");let t=require("react");function n(e){return typeof e==`boolean`?{can:e}:e}function r(r){let i=e.useAccessControl(),a=JSON.stringify(r),[o,s]=(0,t.useState)(()=>i?{allowed:!1,isLoading:!0}:{allowed:!0,isLoading:!1});return(0,t.useEffect)(()=>{if(!i){s({allowed:!0,isLoading:!1});return}let e=!1;return s(e=>({...e,isLoading:!0})),Promise.resolve(i.can(r)).then(t=>{if(e)return;let r=n(t);s({allowed:r.can,isLoading:!1,reason:r.reason})}).catch(t=>{e||s({allowed:!1,isLoading:!1,reason:t instanceof Error?t.message:`access check failed`})}),()=>{e=!0}},[i,a]),o}exports.useCan=r;
+const e=require("./access-control-context.cjs");let t=require("react");var n={allowed:!1,isLoading:!0},r={allowed:!0,isLoading:!1};function i(e){return typeof e==`boolean`?{can:e}:e}function a(a){let o=e.useAccessControl(),s=JSON.stringify(a),[c,l]=(0,t.useState)(null);return(0,t.useEffect)(()=>{if(!o)return;let e=!1,t=t=>{e||l({control:o,key:s,result:t})};return Promise.resolve(o.can(a)).then(e=>{let n=i(e);t({allowed:n.can,isLoading:!1,reason:n.reason})}).catch(e=>{t({allowed:!1,isLoading:!1,reason:e instanceof Error?e.message:`access check failed`})}),()=>{e=!0}},[o,s]),o?c===null||c.control!==o||c.key!==s?n:c.result:r}exports.useCan=a;
 //# sourceMappingURL=use-can.cjs.map

package/dist/access/use-can.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-can.cjs","names":["useAccessControl","useState","require_access_control_context","react","normalize","result","useCan","control","paramsKey","params","state","setState","cancelled","prev","raw","error"],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":"A,uEAaA,SAASI,EAAU,EAAwC,CACvD,OAAO,OAAOC,GAAW,UAAY,CAAE,IAAKA,CAAO,EAAIA,CAC3D,CAWA,SAAgBC,EAAO,EAAiC,CACpD,IAAMC,EAAUP,EAAAA,iBAAiB,EAC3BQ,EAAY,KAAK,UAAUC,CAAM,EAEjC,CAACC,EAAOC,IAAA,EAAYV,EAAAA,SAAAA,KACtBM,EAAU,CAAE,QAAS,GAAO,UAAW,EAAK,EAAI,CAAE,QAAS,GAAM,UAAW,EAAM,CACtF,EAiCA,OA/BA,EAAAJ,EAAA,UAAA,KAAgB,CACZ,GAAI,CAACI,EAAS,CACVI,EAAS,CAAE,QAAS,GAAM,UAAW,EAAM,CAAC,EAC5C,MACJ,CAEA,IAAIC,EAAY,GAkBhB,OAjBAD,EAAU,IAAU,CAAE,GAAGE,EAAM,UAAW,EAAK,EAAE,EAEjD,QAAQ,QAAQN,EAAQ,IAAIE,CAAM,CAAC,CAAC,CAC/B,KAAM,GAAQ,CACX,GAAIG,EAAW,OACf,IAAMP,EAASD,EAAUU,CAAG,EAC5BH,EAAS,CAAE,QAASN,EAAO,IAAK,UAAW,GAAO,OAAQA,EAAO,MAAO,CAAC,CAC7E,CAAC,CAAC,CACD,MAAO,GAAmB,CACnBO,GACJD,EAAS,CACL,QAAS,GACT,UAAW,GACX,OAAQI,aAAiB,MAAQA,EAAM,QAAU,qBACrD,CAAC,CACL,CAAC,MAEQ,CACT,EAAY,EAChB,CAGJ,EAAG,CAACR,EAASC,CAAS,CAAC,EAEhBE,CACX,C"}
+{"version":3,"file":"use-can.cjs","names":["useAccessControl","useState","require_access_control_context","react","PENDING","ALLOW_ALL","normalize","result","useCan","control","paramsKey","params","resolved","setResolved","cancelled","settle","raw","error"],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\n/** The answer for a check that has not resolved yet. */\nconst PENDING: UseCanResult = { allowed: false, isLoading: true };\n\n/** The answer when no provider is mounted. */\nconst ALLOW_ALL: UseCanResult = { allowed: true, isLoading: false };\n\n/** A resolved answer together with the check it answers. */\ninterface ResolvedCheck {\n    control: AccessControl;\n    key: string;\n    result: UseCanResult;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change; they are compared by their\n * `JSON.stringify` form, so an inline object literal does not re-run it on\n * every render.\n *\n * A resolved answer is stored with the control and the params it answers, and\n * is only returned while both still match. Until 0.81.0 the previous answer was\n * returned with `isLoading: false` for the render between a params change and\n * the effect that re-ran the check, so `<Can>` showed the children for the new\n * resource for one frame on the strength of the old resource's permission. The\n * first render for new params now reads `{ allowed: false, isLoading: true }`.\n *\n * @param params - The action/resource being checked.\n * @returns The answer for exactly these params, or the pending state.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n    const [resolved, setResolved] = useState<ResolvedCheck | null>(null);\n\n    useEffect(() => {\n        if (!control) return;\n        let cancelled = false;\n        const settle = (result: UseCanResult): void => {\n            if (!cancelled) setResolved({ control, key: paramsKey, result });\n        };\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                const result = normalize(raw);\n                settle({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                settle({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    if (!control) return ALLOW_ALL;\n    if (resolved === null || resolved.control !== control || resolved.key !== paramsKey) {\n        return PENDING;\n    }\n    return resolved.result;\n}\n"],"mappings":"A,uEAcA,IAAMI,EAAwB,CAAE,QAAS,GAAO,UAAW,EAAK,EAG1DC,EAA0B,CAAE,QAAS,GAAM,UAAW,EAAM,EASlE,SAASC,EAAU,EAAwC,CACvD,OAAO,OAAOC,GAAW,UAAY,CAAE,IAAKA,CAAO,EAAIA,CAC3D,CAqBA,SAAgBC,EAAO,EAAiC,CACpD,IAAMC,EAAUT,EAAAA,iBAAiB,EAC3BU,EAAY,KAAK,UAAUC,CAAM,EACjC,CAACC,EAAUC,IAAA,EAAeZ,EAAAA,SAAAA,CAA+B,IAAI,EAgCnE,OA9BA,EAAAE,EAAA,UAAA,KAAgB,CACZ,GAAI,CAACM,EAAS,OACd,IAAIK,EAAY,GACVC,EAAU,GAA+B,CACtCD,GAAWD,EAAY,CAAE,UAAS,IAAKH,EAAW,QAAO,CAAC,CACnE,EAeA,OAbA,QAAQ,QAAQD,EAAQ,IAAIE,CAAM,CAAC,CAAC,CAC/B,KAAM,GAAQ,CACX,IAAMJ,EAASD,EAAUU,CAAG,EAC5BD,EAAO,CAAE,QAASR,EAAO,IAAK,UAAW,GAAO,OAAQA,EAAO,MAAO,CAAC,CAC3E,CAAC,CAAC,CACD,MAAO,GAAmB,CACvBQ,EAAO,CACH,QAAS,GACT,UAAW,GACX,OAAQE,aAAiB,MAAQA,EAAM,QAAU,qBACrD,CAAC,CACL,CAAC,MAEQ,CACT,EAAY,EAChB,CAEJ,EAAG,CAACR,EAASC,CAAS,CAAC,EAElBD,EACDG,IAAa,MAAQA,EAAS,UAAYH,GAAWG,EAAS,MAAQF,EAC/DN,EAEJQ,EAAS,OAJKP,CAKzB,C"}

package/dist/access/use-can.js

@@ -1,49 +1,46 @@
 import { useAccessControl as e } from "./access-control-context.js";
 import { useEffect as t, useState as n } from "react";
 //#region src/access/use-can.ts
-function r(e) {
+var r = {
+	allowed: !1,
+	isLoading: !0
+}, i = {
+	allowed: !0,
+	isLoading: !1
+};
+function a(e) {
 	return typeof e == "boolean" ? { can: e } : e;
 }
-function i(i) {
-	let a = e(), o = JSON.stringify(i), [s, c] = n(() => a ? {
-		allowed: !1,
-		isLoading: !0
-	} : {
-		allowed: !0,
-		isLoading: !1
-	});
+function o(o) {
+	let s = e(), c = JSON.stringify(o), [l, u] = n(null);
 	return t(() => {
-		if (!a) {
-			c({
-				allowed: !0,
-				isLoading: !1
+		if (!s) return;
+		let e = !1, t = (t) => {
+			e || u({
+				control: s,
+				key: c,
+				result: t
 			});
-			return;
-		}
-		let e = !1;
-		return c((e) => ({
-			...e,
-			isLoading: !0
-		})), Promise.resolve(a.can(i)).then((t) => {
-			if (e) return;
-			let n = r(t);
-			c({
+		};
+		return Promise.resolve(s.can(o)).then((e) => {
+			let n = a(e);
+			t({
 				allowed: n.can,
 				isLoading: !1,
 				reason: n.reason
 			});
-		}).catch((t) => {
-			e || c({
+		}).catch((e) => {
+			t({
 				allowed: !1,
 				isLoading: !1,
-				reason: t instanceof Error ? t.message : "access check failed"
+				reason: e instanceof Error ? e.message : "access check failed"
 			});
 		}), () => {
 			e = !0;
 		};
-	}, [a, o]), s;
+	}, [s, c]), s ? l === null || l.control !== s || l.key !== c ? r : l.result : i;
 }
 //#endregion
-export { i as useCan };
+export { o as useCan };
 
 //# sourceMappingURL=use-can.js.map

package/dist/access/use-can.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-can.js","names":["normalize","result","useCan","control","useAccessControl","paramsKey","params","state","setState","useState","useEffect","cancelled","prev","raw","error"],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":";;;AAaA,SAASA,EAAU,GAAwC;CACvD,OAAO,OAAOC,KAAW,YAAY,EAAE,KAAKA,EAAO,IAAIA;AAC3D;AAWA,SAAgBC,EAAO,GAAiC;CACpD,IAAMC,IAAUC,EAAiB,GAC3BC,IAAY,KAAK,UAAUC,CAAM,GAEjC,CAACC,GAAOC,KAAYC,QACtBN,IAAU;EAAE,SAAS;EAAO,WAAW;CAAK,IAAI;EAAE,SAAS;EAAM,WAAW;CAAM,CACtF;CAiCA,OA/BAO,QAAgB;EACZ,IAAI,CAACP,GAAS;GACV,EAAS;IAAE,SAAS;IAAM,WAAW;GAAM,CAAC;GAC5C;EACJ;EAEA,IAAIQ,IAAY;EAkBhB,OAjBAH,GAAU,OAAU;GAAE,GAAGI;GAAM,WAAW;EAAK,EAAE,GAEjD,QAAQ,QAAQT,EAAQ,IAAIG,CAAM,CAAC,CAAC,CAC/B,MAAM,MAAQ;GACX,IAAIK,GAAW;GACf,IAAMV,IAASD,EAAUa,CAAG;GAC5B,EAAS;IAAE,SAASZ,EAAO;IAAK,WAAW;IAAO,QAAQA,EAAO;GAAO,CAAC;EAC7E,CAAC,CAAC,CACD,OAAO,MAAmB;GACvB,AAAIU,KACJH,EAAS;IACL,SAAS;IACT,WAAW;IACX,QAAQM,aAAiB,QAAQA,EAAM,UAAU;GACrD,CAAC;EACL,CAAC,SAEQ;GACT,IAAY;EAChB;CAGJ,GAAG,CAACX,GAASE,CAAS,CAAC,GAEhBE;AACX"}
+{"version":3,"file":"use-can.js","names":["PENDING","ALLOW_ALL","normalize","result","useCan","control","useAccessControl","paramsKey","params","resolved","setResolved","useState","useEffect","cancelled","settle","raw","error"],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\n/** The answer for a check that has not resolved yet. */\nconst PENDING: UseCanResult = { allowed: false, isLoading: true };\n\n/** The answer when no provider is mounted. */\nconst ALLOW_ALL: UseCanResult = { allowed: true, isLoading: false };\n\n/** A resolved answer together with the check it answers. */\ninterface ResolvedCheck {\n    control: AccessControl;\n    key: string;\n    result: UseCanResult;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change; they are compared by their\n * `JSON.stringify` form, so an inline object literal does not re-run it on\n * every render.\n *\n * A resolved answer is stored with the control and the params it answers, and\n * is only returned while both still match. Until 0.81.0 the previous answer was\n * returned with `isLoading: false` for the render between a params change and\n * the effect that re-ran the check, so `<Can>` showed the children for the new\n * resource for one frame on the strength of the old resource's permission. The\n * first render for new params now reads `{ allowed: false, isLoading: true }`.\n *\n * @param params - The action/resource being checked.\n * @returns The answer for exactly these params, or the pending state.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n    const [resolved, setResolved] = useState<ResolvedCheck | null>(null);\n\n    useEffect(() => {\n        if (!control) return;\n        let cancelled = false;\n        const settle = (result: UseCanResult): void => {\n            if (!cancelled) setResolved({ control, key: paramsKey, result });\n        };\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                const result = normalize(raw);\n                settle({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                settle({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    if (!control) return ALLOW_ALL;\n    if (resolved === null || resolved.control !== control || resolved.key !== paramsKey) {\n        return PENDING;\n    }\n    return resolved.result;\n}\n"],"mappings":";;;AAcA,IAAMA,IAAwB;CAAE,SAAS;CAAO,WAAW;AAAK,GAG1DC,IAA0B;CAAE,SAAS;CAAM,WAAW;AAAM;AASlE,SAASC,EAAU,GAAwC;CACvD,OAAO,OAAOC,KAAW,YAAY,EAAE,KAAKA,EAAO,IAAIA;AAC3D;AAqBA,SAAgBC,EAAO,GAAiC;CACpD,IAAMC,IAAUC,EAAiB,GAC3BC,IAAY,KAAK,UAAUC,CAAM,GACjC,CAACC,GAAUC,KAAeC,EAA+B,IAAI;CAgCnE,OA9BAC,QAAgB;EACZ,IAAI,CAACP,GAAS;EACd,IAAIQ,IAAY,IACVC,KAAU,MAA+B;GAC3C,AAAKD,KAAWH,EAAY;IAAE;IAAS,KAAKH;IAAW;GAAO,CAAC;EACnE;EAeA,OAbA,QAAQ,QAAQF,EAAQ,IAAIG,CAAM,CAAC,CAAC,CAC/B,MAAM,MAAQ;GACX,IAAML,IAASD,EAAUa,CAAG;GAC5B,EAAO;IAAE,SAASZ,EAAO;IAAK,WAAW;IAAO,QAAQA,EAAO;GAAO,CAAC;EAC3E,CAAC,CAAC,CACD,OAAO,MAAmB;GACvB,EAAO;IACH,SAAS;IACT,WAAW;IACX,QAAQa,aAAiB,QAAQA,EAAM,UAAU;GACrD,CAAC;EACL,CAAC,SAEQ;GACT,IAAY;EAChB;CAEJ,GAAG,CAACX,GAASE,CAAS,CAAC,GAElBF,IACDI,MAAa,QAAQA,EAAS,YAAYJ,KAAWI,EAAS,QAAQF,IAC/DP,IAEJS,EAAS,SAJKR;AAKzB"}

package/dist/auth/create-tempest-auth.cjs

@@ -1,2 +1,2 @@
-const e=require("../utils/dev-mode.cjs"),t=require("../http/errors.cjs"),n=require("../http/api-client.cjs"),r=require("./create-auth-store.cjs"),i=require("./refresh-queue.cjs");var a=1e4;function o(e,t){return e.length===0?Promise.resolve():new Promise(n=>{let r=setTimeout(n,t);Promise.allSettled(e).then(()=>{clearTimeout(r),n()})})}function s(e){let t=e??{};return{token:t.access_token,refreshToken:t.refresh_token}}function c(c){let{baseURL:l,prefix:u,loginPath:d=`/api/auth/login`,refreshPath:ee=`/api/auth/refresh`,logoutPath:f,onLogoutError:te,mePath:p,storeName:m=`tempest-auth`,storage:h=`local`,withCredentials:g=!1,csrf:_,fetcher:v,parseTokens:y=s,parseUser:ne,refreshBody:b=e=>e?{refresh_token:e}:void 0,retry:re,redirectTo:x,onSessionEnd:S}=c,C=r.createAuthStore({name:m,storage:h}),w=`${m}-refresh`;function T(){return typeof window>`u`?null:h===`session`?window.sessionStorage:window.localStorage}function E(){return T()?.getItem(w)??null}let D=E();function O(e){D=e;let t=T();t&&(e?t.setItem(w,e):t.removeItem(w))}let k=()=>C.getState(),A=()=>k().token;async function ie(){if(!p)return k().user;let e=j,n;try{n=await Z.get(p,{skipAuthRetry:!0})}catch(n){throw j===e?n:new t.SessionSupersededError}if(j!==e)throw new t.SessionSupersededError;return k().setUser(n),n}let j=0,M=Promise.resolve(),N=0,P=new Set,F=new Set,I=new Set,L=new Set;function R(e){let t=e.then(()=>void 0,()=>void 0);return I.add(t),t.then(()=>I.delete(t)),e}function ae(t){e.isDevBuild()&&console.warn(`[tempest-react-sdk] createTempestAuth: logoutPath revocation failed`,t);try{te?.(t)}catch{return}}function z(e){let t=(async()=>{try{await e()}catch(e){ae(e)}})();return F.add(t),t.then(()=>F.delete(t)),t}function B(e,t){f&&!g&&t&&z(()=>V(e).post(f,{body:b(t)}))}function V(e){return n.createApiClient({baseURL:l,prefix:u,withCredentials:g,csrf:_,fetcher:v,getToken:()=>e})}function H(){j+=1,W=i.createRefreshQueue(U)}async function U(){let e=A();if(!X().continues)throw new t.SessionSupersededError;if(A()!==e)return;let n=j;L.add(n);try{let e;try{e=await R(Z.post(ee,{body:b(E()),skipAuth:!0}))}catch(e){throw j===n?e:new t.SessionSupersededError}let{token:r,refreshToken:i}=y(e);if(j!==n||!X().continues)throw B(r??null,i),new t.SessionSupersededError;k().setToken(r),i&&O(i)}finally{L.delete(n)}}let W=i.createRefreshQueue(U);function G(e){let t=A();return t===null?!1:e.token===null||e.token!==t}function K(){return A()===null&&E()===null}async function q(){if(!(P.size>0&&N===0&&(await Promise.allSettled([...P]),A()!==null)))throw Error(`anonymous 401 with no session`)}async function oe(e){if(e.epoch!==null&&e.epoch!==j)throw new t.SessionSupersededError;if(G(e)){if(e.token===null)throw Error(`anonymous 401 under a live session`)}else return e.token===null&&K()?L.has(j)?W():q():W()}async function se(e,n){if(n.epoch!==null&&n.epoch!==j||!X().continues)throw new t.SessionSupersededError;G(n)||n.token===null&&K()||await pe()}async function ce(e){F.size>0&&await o([...F],a);let t=le(e);P.add(t);try{return await t}finally{P.delete(t)}}async function le(e){let n=j,r=await R(Z.post(d,{body:e,skipAuth:!0})),{token:i,refreshToken:a}=y(r);if(j!==n)throw B(i??null,a),new t.SessionSupersededError;let{done:o}=J(`switch`),s=j;if(await o.catch(()=>void 0),j!==s)throw new t.SessionSupersededError;k().setToken(i),O(a??null);let c=ne?.(r);return c==null?ie():(k().setUser(c),c)}function J(e){let{user:t,token:n}=k(),r=n!==null||t!==null||E()!==null;return(r||e!==`expired`)&&H(),k().logout(),O(null),r?{live:r,done:Y({reason:e,user:t,token:n,elsewhere:!1})}:{live:r,done:e===`switch`||N===0?M:Promise.resolve()}}function Y(e){if(!S)return Promise.resolve();let t=V(e.token);N+=1;let n=(async()=>{try{await S({...e,api:t})}finally{--N}})();return M=n.then(()=>void 0,()=>void 0),n.then(()=>void 0)}function ue(){let e=T();if(!e)return null;let t=e.getItem(w),n=e.getItem(m);if(!n)return{user:null,token:null,refreshToken:t};try{let e=JSON.parse(n);return{user:e.state?.user??null,token:e.state?.token??null,refreshToken:t}}catch{return{user:null,token:null,refreshToken:t}}}function X(){let e=ue(),{user:t,token:n}=k();if(e===null)return{continues:!0,done:Promise.resolve()};let r=JSON.stringify(e.user)===JSON.stringify(t);if(e.token===n&&e.refreshToken===D&&r)return{continues:!0,done:Promise.resolve()};let i=e.token!==null&&(e.token===n||n!==null&&r),a=n!==null||t!==null||D!==null;if(i||H(),D=e.refreshToken,C.setState({user:e.user,token:e.token,isAuthenticated:e.token!==null}),i||!a)return{continues:i,done:Promise.resolve()};let o=Y({reason:e.token===null?`logout`:`switch`,user:t,token:n,elsewhere:!0});return o.catch(()=>void 0),{continues:i,done:o}}function de(){if(!f)return null;let e=f,{token:t,user:n}=k(),r=E();if(!g&&t===null&&n===null&&r===null)return null;let i=g?[...I]:[];return z(async()=>(await o(i,a),V(t).post(e,{body:b(r)})))}function fe(){let e=X();if(!e.continues)return e.done;let t=de(),{done:n}=J(`logout`);return t?Promise.all([t,n]).then(()=>void 0):n}async function pe(){let{live:e,done:t}=J(`expired`);await t.catch(()=>void 0),e&&x&&typeof window<`u`&&window.location.assign(x)}let Z=n.createApiClient({baseURL:l,prefix:u,withCredentials:g,csrf:_,fetcher:v,getToken:A,getSessionEpoch:()=>j,refresh:oe,retry:re,onUnauthorized:se}),me=()=>W();function Q(e){e.storageArea===T()&&(e.key===null||e.key===m||e.key===w)&&X()}let $=typeof window>`u`?null:window;return $?.addEventListener(`storage`,Q),{useAuthStore:C,api:Z,login:ce,logout:fe,refresh:me,getToken:A,dispose:()=>$?.removeEventListener(`storage`,Q)}}exports.createTempestAuth=c;
+const e=require("../utils/dev-mode.cjs"),t=require("../http/errors.cjs"),n=require("../http/api-client.cjs"),r=require("./session-identity.cjs"),i=require("./create-auth-store.cjs"),a=require("./refresh-queue.cjs");var o=1e4,s=1e4;function c(e,t){return e.length===0?Promise.resolve():new Promise(n=>{let r=setTimeout(n,t);Promise.allSettled(e).then(()=>{clearTimeout(r),n()})})}function l(){let e=globalThis.crypto;return typeof e?.randomUUID==`function`?e.randomUUID():`${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`}var u=new Set;function ee(t){e.isDevBuild()&&!u.has(t)&&(u.add(t),console.warn(`[tempest-react-sdk] createTempestAuth: withCredentials is set without logoutPath. logout() cannot clear the HttpOnly refresh cookie, so the next refresh() — the boot restore — signs the same account back in. Pass logoutPath (the backend's cookie logout route) so the server revokes it.`))}function te(e){let t=e??{};return{token:t.access_token,refreshToken:t.refresh_token}}function d(u){let{baseURL:d,prefix:f,loginPath:ne=`/api/auth/login`,refreshPath:re=`/api/auth/refresh`,logoutPath:p,onLogoutError:ie,mePath:m,storeName:h=`tempest-auth`,storage:g=`local`,withCredentials:_=!1,csrf:ae,fetcher:v,parseTokens:y=te,parseUser:oe,refreshBody:b=e=>e?{refresh_token:e}:void 0,retry:se,redirectTo:x,onSessionEnd:S}=u;_&&!p&&ee(h);let C=i.createAuthStore({name:h,storage:g}),w=`${h}-refresh`;function T(){return typeof window>`u`?null:g===`session`?window.sessionStorage:window.localStorage}function E(){return T()?.getItem(w)??null}let D=E();function O(e){D=e;let t=T();t&&(e?t.setItem(w,e):t.removeItem(w))}let k=`${h}-lineage`,ce=`tempest-react-sdk:${h}:refresh`,A=T()?.getItem(k)??null;function j(e){A=e;let t=T();t&&(e?t.setItem(k,e):t.removeItem(k))}let M=()=>C.getState(),N=()=>M().token;async function le(){if(!m)return M().user;let e=P,n;try{n=await Q.get(m,{skipAuthRetry:!0})}catch(n){throw P===e?n:new t.SessionSupersededError}if(P!==e||!Z().continues)throw new t.SessionSupersededError;return M().setUser(n),n}let P=0,ue=Promise.resolve(),F=0,I=new Set,L=new Set,R=new Set,z=new Set;function B(e){let t=e.then(()=>void 0,()=>void 0);return R.add(t),t.then(()=>R.delete(t)),e}function de(t){e.isDevBuild()&&console.warn(`[tempest-react-sdk] createTempestAuth: logoutPath revocation failed`,t);try{ie?.(t)}catch{return}}function V(e){let t=(async()=>{try{await e()}catch(e){de(e)}})();return L.add(t),t.then(()=>L.delete(t)),t}function H(e,t){p&&!_&&t&&V(()=>U(e).post(p,{body:b(t)}))}function U(e){return n.createApiClient({baseURL:d,prefix:f,withCredentials:_,csrf:ae,fetcher:v,getToken:()=>e})}function W(){P+=1,K=a.createRefreshQueue(G)}async function G(){let e=N(),t=P;z.add(t);try{await fe(()=>pe(e))}finally{z.delete(t)}}async function fe(e){let t=g===`local`&&typeof navigator<`u`?navigator.locks:void 0;if(!t)return e();let n=new AbortController,r=setTimeout(()=>n.abort(),s),i=!1;try{await t.request(ce,{signal:n.signal},async()=>{i=!0,clearTimeout(r),await e()})}catch(t){if(i)throw t;clearTimeout(r),await e()}}async function pe(e){let n=e!==null||M().user!==null||D!==null,r=Z();if(!n&&N()!==null)return;if(!r.continues)throw new t.SessionSupersededError;if(N()!==e)return;let i=P,a;try{a=await B(Q.post(re,{body:b(E()),skipAuth:!0}))}catch(e){throw P===i?e:new t.SessionSupersededError}let{token:o,refreshToken:s}=y(a);if(P!==i||!Z().continues)throw H(o??null,s),new t.SessionSupersededError;n||j(l()),M().setToken(o),s&&O(s)}let K=a.createRefreshQueue(G);function q(e){let t=N();return t===null?!1:e.token===null||e.token!==t}function J(){return N()===null&&E()===null}async function me(){if(!(I.size>0&&F===0&&(await Promise.allSettled([...I]),N()!==null)))throw Error(`anonymous 401 with no session`)}async function he(e){if(e.epoch!==null&&e.epoch!==P)throw new t.SessionSupersededError;if(q(e)){if(e.token===null)throw Error(`anonymous 401 under a live session`)}else return e.token===null&&J()?z.has(P)?K():me():K()}async function ge(e,n){if(n.epoch!==null&&n.epoch!==P||!Z().continues)throw new t.SessionSupersededError;q(n)||n.token===null&&J()||await Se()}async function _e(e){L.size>0&&await c([...L],o);let t=ve(e);I.add(t);try{return await t}finally{I.delete(t)}}async function ve(e){let n=P,r=await B(Q.post(ne,{body:e,skipAuth:!0})),{token:i,refreshToken:a}=y(r);if(P!==n)throw H(i??null,a),new t.SessionSupersededError;H(N(),E()??void 0);let{done:o}=Y(`switch`),s=P;if(await o.catch(()=>void 0),P!==s)throw new t.SessionSupersededError;j(l()),M().setToken(i),O(a??null);let c=oe?.(r);return c==null?le():(M().setUser(c),c)}function Y(e){let{user:t,token:n}=M(),r=n!==null||t!==null||E()!==null;return(r||e!==`expired`)&&W(),M().logout(),O(null),j(null),r?{live:r,done:X({reason:e,user:t,token:n,elsewhere:!1})}:{live:r,done:e===`switch`||F===0?ue:Promise.resolve()}}function X(e){if(!S)return Promise.resolve();let t=U(e.token);F+=1;let n=(async()=>{try{await S({...e,api:t})}finally{--F}})();return ue=n.then(()=>void 0,()=>void 0),n.then(()=>void 0)}function ye(){let e=T();if(!e)return null;let t=e.getItem(w),n=e.getItem(k),r=e.getItem(h);if(!r)return{user:null,token:null,refreshToken:t,lineage:n};try{let e=JSON.parse(r);return{user:e.state?.user??null,token:e.state?.token??null,refreshToken:t,lineage:n}}catch{return{user:null,token:null,refreshToken:t,lineage:n}}}function Z(){let e=ye(),{user:t,token:n}=M();if(e===null)return{continues:!0,done:Promise.resolve()};let r=JSON.stringify(e.user)===JSON.stringify(t);if(e.token===n&&e.refreshToken===D&&e.lineage===A&&r)return{continues:!0,done:Promise.resolve()};let i=e.lineage!==null||A!==null?e.lineage===A:e.token===n||n!==null&&r,a=e.token!==null&&i,o=n!==null||t!==null||D!==null;if(a||W(),D=e.refreshToken,A=e.lineage,C.setState({user:e.user,token:e.token,isAuthenticated:e.token!==null}),a||!o)return{continues:a,done:Promise.resolve()};let s=X({reason:e.token===null?`logout`:`switch`,user:t,token:n,elsewhere:!0});return s.catch(()=>void 0),{continues:a,done:s}}function be(){if(!p)return null;let e=p,{token:t,user:n}=M(),r=E();if(!_&&t===null&&n===null&&r===null)return null;let i=_?[...R]:[];return V(async()=>(await c(i,o),U(t).post(e,{body:b(r)})))}function xe(){let e=Z();if(!e.continues)return e.done;let t=be(),{done:n}=Y(`logout`);return t?Promise.all([t,n]).then(()=>void 0):n}async function Se(){let{live:e,done:t}=Y(`expired`);await t.catch(()=>void 0),e&&x&&typeof window<`u`&&window.location.assign(x)}let Q=n.createApiClient({baseURL:d,prefix:f,withCredentials:_,csrf:ae,fetcher:v,getToken:N,getSessionEpoch:()=>P,refresh:he,retry:se,onUnauthorized:ge}),Ce=()=>K(),$=null,we=()=>N()===null?null:A===null?($?.epoch!==P&&($={epoch:P,key:l()}),$.key):A,Te={current:we,subscribe:e=>C.subscribe(e)};r.bindSessionIdentity(Q,Te),r.bindSessionIdentity(N,Te);function Ee(e){e.storageArea===T()&&(e.key===null||e.key===h||e.key===w||e.key===k)&&Z()}let De=typeof window>`u`?null:window;return De?.addEventListener(`storage`,Ee),{useAuthStore:C,api:Q,login:_e,logout:xe,refresh:Ce,getToken:N,sessionKey:we,dispose:()=>De?.removeEventListener(`storage`,Ee)}}exports.createTempestAuth=d;
 //# sourceMappingURL=create-tempest-auth.cjs.map