{"version":3,"sources":["../src/auth.ts"],"sourcesContent":["import { createPushChannel } from './pushChannel';\nimport { AUTH_STATE, REQUEST_AUTH_STATE } from './generated/protocol';\n\n/**\n * Login / account state of the immediately.run user, mirrored from the host\n * window into the sandbox.\n *\n * `status` is `'unknown'` until the host has reported a value (use it to\n * distinguish \"still loading\" from a confirmed signed-out session).\n */\nexport type AuthStatus = 'unknown' | 'signed-in' | 'signed-out';\n\n/**\n * The signed-in immediately.run user, as seen by the sandbox (no token, ever).\n *\n * Identity is gated by the `auth:identity` capability (elevated): the host\n * redacts `user` to `null` for any frame not holding it, while the baseline\n * `auth:status` still reports whether *a* session exists. A stage app therefore\n * sees `{ status: 'signed-in', user: null }` unless it declares `auth:identity`\n * under `immediately.run.capabilities` in its `package.json` and the user\n * consents once (a durable per-(app, user) grant). First-party / elevated\n * frames receive it via their region binding.\n */\nexport interface SandboxUser {\n  /** GitHub login (handle) of the signed-in user. */\n  login: string;\n}\n\n/**\n * The user's login / account state: a `status` plus the `user` when signed in.\n *\n * `user` is `null` for any frame not granted `auth:identity` — even when\n * `status` is `'signed-in'`. See {@link SandboxUser} for how an app earns it.\n */\nexport interface AuthState {\n  status: AuthStatus;\n  user: SandboxUser | null;\n}\n\nconst isAuthState = (v: unknown): v is AuthState => {\n  const s = v as Partial<AuthState> | null;\n  return (\n    !!s &&\n    (s.status === 'unknown' || s.status === 'signed-in' || s.status === 'signed-out') &&\n    (s.user === null || (typeof s.user === 'object' && typeof (s.user as SandboxUser).login === 'string'))\n  );\n};\n\n// Read over the transport (SDK_PACKAGING_SPEC §4): the host pushes `auth-state`\n// and answers `request-auth-state` (wire format: site-main channelBridge.ts).\nconst channel = createPushChannel<AuthState>({\n  pushType: AUTH_STATE,\n  requestType: REQUEST_AUTH_STATE,\n  initial: { status: 'unknown', user: null },\n  parse: (msg) => (isAuthState(msg.state) ? (msg.state as AuthState) : undefined),\n});\n\n/**\n * Returns the current login / account state. Poll this whenever you need a\n * one-off read; use {@link onAuthChange} or {@link useAuth} to react to changes.\n *\n * `user` is `null` unless this frame holds `auth:identity` (see\n * {@link SandboxUser}); `status` alone is baseline and always available.\n *\n * Off-host (plain `vite dev` — no host to report a session) `status` stays\n * `'unknown'` FOREVER — it never settles to `'signed-out'`. Code that waits for a\n * settled status before proceeding (e.g. attributing authorship) hangs locally:\n * gate such flows on `status === 'signed-in'` combined with a timeout or an\n * explicit local fallback, never on \"status is no longer 'unknown'\".\n */\nexport const getAuthState = (): AuthState => channel.get();\n\n/**\n * Subscribe to login / logout changes. The listener is invoked immediately with\n * the current state, then again on every change. Returns an unsubscribe fn.\n */\nexport const onAuthChange = (listener: (state: AuthState) => void): (() => void) => channel.onChange(listener);\n\n/**\n * React hook returning the current login / account state, re-rendering on\n * login / logout.\n *\n * `user` is `null` unless this frame holds `auth:identity` (see\n * {@link SandboxUser}); `status` alone is baseline and always available.\n *\n * Off-host (plain `vite dev`) `status` stays `'unknown'` forever — see\n * {@link getAuthState} for why \"wait until it settles\" hangs locally and how to\n * gate on it safely (signed-in check plus a timeout/fallback).\n */\nexport const useAuth = (): AuthState => channel.use();\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAkC;AAClC,sBAA+C;AAsC/C,MAAM,cAAc,CAAC,MAA+B;AAClD,QAAM,IAAI;AACV,SACE,CAAC,CAAC,MACD,EAAE,WAAW,aAAa,EAAE,WAAW,eAAe,EAAE,WAAW,kBACnE,EAAE,SAAS,QAAS,OAAO,EAAE,SAAS,YAAY,OAAQ,EAAE,KAAqB,UAAU;AAEhG;AAIA,MAAM,cAAU,sCAA6B;AAAA,EAC3C,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,EAAE,QAAQ,WAAW,MAAM,KAAK;AAAA,EACzC,OAAO,CAAC,QAAS,YAAY,IAAI,KAAK,IAAK,IAAI,QAAsB;AACvE,CAAC;AAeM,MAAM,eAAe,MAAiB,QAAQ,IAAI;AAMlD,MAAM,eAAe,CAAC,aAAuD,QAAQ,SAAS,QAAQ;AAatG,MAAM,UAAU,MAAiB,QAAQ,IAAI;","names":[]}