@ai-matrx/auth 0.1.4 → 0.2.1

package/dist/organizations.js

@@ -181,6 +181,209 @@ function onSessionChange(client, cb) {
   return () => data.subscription.unsubscribe();
 }
 
+// src/organization-gate.ts
+var ORGANIZATION_RESOLUTION_TIMEOUT_MS = 1e4;
+function createOrganizationBootstrapGate(defaultTimeoutMs = ORGANIZATION_RESOLUTION_TIMEOUT_MS) {
+  let settled = false;
+  let announce = null;
+  let resolution = new Promise((resolve) => {
+    announce = resolve;
+  });
+  return {
+    isResolved: () => settled,
+    markResolved() {
+      if (settled) return;
+      settled = true;
+      announce?.();
+    },
+    async whenResolved(timeoutMs = defaultTimeoutMs) {
+      if (settled) return;
+      let timer;
+      await Promise.race([
+        resolution,
+        new Promise((resolve) => {
+          timer = setTimeout(resolve, timeoutMs);
+        })
+      ]);
+      if (timer !== void 0) clearTimeout(timer);
+    },
+    reset() {
+      announce?.();
+      settled = false;
+      resolution = new Promise((resolve) => {
+        announce = resolve;
+      });
+    }
+  };
+}
+var NOT_A_MEMBER_CODES = /* @__PURE__ */ new Set(["organization_forbidden", "organization_not_member"]);
+function isNotAMemberRefusal(body) {
+  if (!body || typeof body !== "object") return false;
+  const record = body;
+  if (typeof record.code === "string" && NOT_A_MEMBER_CODES.has(record.code)) return true;
+  const detail = record.detail;
+  return !!detail && typeof detail === "object" && typeof detail.code === "string" && NOT_A_MEMBER_CODES.has(detail.code);
+}
+var NOT_A_MEMBER_RECHECK_GAP_MS = 3e4;
+function createNotAMemberRefusalNotice(recheck, gapMs = NOT_A_MEMBER_RECHECK_GAP_MS) {
+  let last = Number.NEGATIVE_INFINITY;
+  return {
+    notice(body, now = Date.now()) {
+      if (!isNotAMemberRefusal(body)) return false;
+      if (now - last < gapMs) return false;
+      last = now;
+      recheck();
+      return true;
+    },
+    reset() {
+      last = Number.NEGATIVE_INFINITY;
+    }
+  };
+}
+function resolveChildOrganizationId(parent, explicit, label = "child record", onDisagree = (m) => console.warn(m)) {
+  const parentOrg = typeof parent === "string" ? parent : parent?.organization_id ?? null;
+  if (parentOrg) {
+    if (explicit && explicit !== parentOrg) {
+      onDisagree(`[child org] ${label} filed in its parent's organization ${parentOrg}, not ${explicit} \u2014 a child belongs with its parent.`);
+    }
+    return parentOrg;
+  }
+  return explicit ?? null;
+}
+function resolveAdminSeat(input) {
+  if (!input || input.laneOpen !== true || !input.organizationId) return null;
+  return { id: input.organizationId, name: input.organizationName ?? null };
+}
+function adminSeatReplacesUserContext(input, personOrganizationId) {
+  const seat = resolveAdminSeat(input);
+  return seat !== null && seat.id !== (personOrganizationId ?? null);
+}
+
+// src/organization-link.ts
+import { isRfc4122Uuid } from "@ai-matrx/kit/uuid";
+var LINK_ORGANIZATION_QUERY_KEY = "org";
+var SLUG = /^[a-z0-9][a-z0-9-]{0,99}$/i;
+function classifyLinkOrganizationValue(raw) {
+  const value = raw.trim();
+  if (isRfc4122Uuid(value)) return { kind: "named", organizationId: value };
+  if (SLUG.test(value)) return { kind: "addressed", slug: value.toLowerCase() };
+  return { kind: "malformed", raw: value };
+}
+function readLinkOrganizationParam(source) {
+  if (source == null) return { kind: "absent" };
+  let params;
+  if (source instanceof URLSearchParams) {
+    params = source;
+  } else {
+    try {
+      const q = source.includes("?") ? source.slice(source.indexOf("?")) : source;
+      params = new URLSearchParams(q);
+    } catch {
+      return { kind: "absent" };
+    }
+  }
+  if (!params.has(LINK_ORGANIZATION_QUERY_KEY)) return { kind: "absent" };
+  return classifyLinkOrganizationValue(params.get(LINK_ORGANIZATION_QUERY_KEY) ?? "");
+}
+function linkOrganizationNotAMemberMessage(signedInAs) {
+  const account = signedInAs ? `You are signed in as ${signedInAs}.` : "Check which account you are signed in as.";
+  return `The link you followed is for an organization this account is not a member of, so nothing was opened and you were not moved. ${account} Sign in with the account the link was meant for, or ask whoever sent it to give this account access.`;
+}
+function linkOrganizationMalformedMessage(raw) {
+  const quoted = raw.length > 0 ? ` ("${raw}")` : "";
+  return `The link you followed names an organization we cannot read${quoted}, so nothing was switched and you were left where you were. Ask whoever sent it for the link again, or pick the organization you are working in from the avatar menu.`;
+}
+function linkOrganizationSwitchAnnouncement(toName, fromName) {
+  const from = fromName ? ` You were working in ${fromName}.` : "";
+  return `You are now working in ${toName} because the link you followed is filed under it.${from} Switch back any time from the avatar menu.`;
+}
+function linkOrganizationOfferMessage(toName, fromName) {
+  const where = fromName ? `, and you are working in ${fromName}` : "";
+  return `The link you followed is for ${toName}${where}. "Switch organization when a link asks" is turned off in your settings, so nothing changed \u2014 switch to ${toName} to open it.`;
+}
+function decideLinkOrganization(input) {
+  const { param, memberships, currentOrganizationId } = input;
+  const switchWhenALinkAsks = input.switchWhenALinkAsks ?? true;
+  const say = {
+    notAMember: linkOrganizationNotAMemberMessage,
+    malformed: linkOrganizationMalformedMessage,
+    switched: linkOrganizationSwitchAnnouncement,
+    offer: linkOrganizationOfferMessage,
+    offerAction: (name) => `Switch to ${name}`,
+    ...input.messages
+  };
+  if (param.kind === "absent") return { kind: "no-link" };
+  if (param.kind === "malformed") {
+    return {
+      kind: "refused",
+      reason: "malformed",
+      message: say.malformed(param.raw)
+    };
+  }
+  const match = param.kind === "named" ? memberships.find((o) => o.id === param.organizationId) : memberships.find((o) => o.slug?.trim().toLowerCase() === param.slug);
+  if (!match && param.kind === "named" && input.admittedByAShare) {
+    return { kind: "admitted", organizationId: param.organizationId };
+  }
+  if (!match) {
+    return {
+      kind: "refused",
+      reason: "not-a-member",
+      message: say.notAMember(input.signedInAs)
+    };
+  }
+  if (currentOrganizationId === match.id) {
+    return { kind: "already-current", organizationId: match.id };
+  }
+  const fromName = currentOrganizationId ? input.currentOrganizationName ?? memberships.find((o) => o.id === currentOrganizationId)?.name ?? null : null;
+  if (currentOrganizationId && !switchWhenALinkAsks) {
+    return {
+      kind: "offered",
+      organizationId: match.id,
+      organizationName: match.name,
+      message: say.offer(match.name, fromName),
+      actionLabel: say.offerAction(match.name)
+    };
+  }
+  return {
+    kind: "honoured",
+    organizationId: match.id,
+    organizationName: match.name,
+    // Nothing to announce on a cold arrival: they were working nowhere, so
+    // they were not moved. A move, however, is always announced.
+    announcement: currentOrganizationId ? say.switched(match.name, fromName) : null
+  };
+}
+async function resolveOrganizationWithLink(input) {
+  const ladder = await resolveActiveOrganizationLazily({
+    memberships: input.memberships,
+    held: input.held ?? null,
+    readAccount: input.readAccount,
+    ...input.first ? { first: input.first } : {}
+  });
+  if (!ladder) return null;
+  const param = typeof input.link === "string" ? input.link.includes("=") ? readLinkOrganizationParam(input.link) : classifyLinkOrganizationValue(input.link) : readLinkOrganizationParam(input.link ?? null);
+  const decisionInput = {
+    param,
+    memberships: input.memberships.map((o) => ({ id: o.id, name: o.name, slug: o.slug ?? null })),
+    currentOrganizationId: ladder.organization.id,
+    currentOrganizationName: ladder.organization.name,
+    ...input.switchWhenALinkAsks === void 0 ? {} : { switchWhenALinkAsks: input.switchWhenALinkAsks },
+    ...input.signedInAs === void 0 ? {} : { signedInAs: input.signedInAs },
+    ...input.messages ? { messages: input.messages } : {}
+  };
+  let link = decideLinkOrganization(decisionInput);
+  if (link.kind === "refused" && link.reason === "not-a-member" && param.kind === "named" && input.admittedByAShare) {
+    if (await input.admittedByAShare(param.organizationId)) {
+      link = decideLinkOrganization({ ...decisionInput, admittedByAShare: true });
+    }
+  }
+  if (link.kind === "honoured") {
+    const organization = input.memberships.find((m) => m.id === link.organizationId);
+    if (organization) return { organization, rung: "link", link };
+  }
+  return { organization: ladder.organization, rung: ladder.rung, link };
+}
+
 // src/active-organization.ts
 var NoActiveOrganizationError = class extends Error {
   constructor(reason, detail) {
@@ -258,6 +461,7 @@ function createActiveOrganization(options) {
   const publish = (next) => {
     current = Object.freeze(next);
     if (current.status !== "resolving" && current.status !== "idle") {
+      options.bootstrapGate?.markResolved();
       const ready = waiters;
       waiters = [];
       for (const w of ready) w();
@@ -275,19 +479,38 @@ function createActiveOrganization(options) {
       }
       const memberships = await readMemberships(client, person.id);
       if (gen !== generation) return current;
-      const linked = options.linked?.() ?? null;
-      const heldId = (linked && memberships.some((m) => m.id === linked) ? linked : null) ?? await held.read(person.id);
-      const resolved = await resolveActiveOrganizationLazily({
-        memberships,
-        held: heldId,
-        readAccount: () => readAccountOrganizationChoices(client, person.id)
-      });
+      const linkOptions = options.link;
+      let resolved;
+      let linkDecision = null;
+      if (linkOptions) {
+        const r = await resolveOrganizationWithLink({
+          memberships,
+          held: await held.read(person.id),
+          readAccount: () => readAccountOrganizationChoices(client, person.id),
+          link: linkOptions.source() ?? null,
+          switchWhenALinkAsks: linkOptions.switchWhenALinkAsks?.(),
+          signedInAs: linkOptions.signedInAs?.(),
+          messages: linkOptions.messages,
+          admittedByAShare: linkOptions.admittedByAShare
+        });
+        resolved = r;
+        linkDecision = r?.link ?? null;
+      } else {
+        const linked = options.linked?.() ?? null;
+        const heldId = (linked && memberships.some((m) => m.id === linked) ? linked : null) ?? await held.read(person.id);
+        resolved = await resolveActiveOrganizationLazily({
+          memberships,
+          held: heldId,
+          readAccount: () => readAccountOrganizationChoices(client, person.id)
+        });
+      }
       if (gen !== generation) return current;
       if (!resolved) {
         publish({ ...IDLE, status: "none", userId: person.id, error: "no-memberships" });
         return current;
       }
       await held.write(person.id, resolved.organization.id);
+      if (linkDecision && linkDecision.kind !== "no-link") options.link?.onDecision?.(linkDecision);
       publish({
         status: "ready",
         userId: person.id,
@@ -323,6 +546,11 @@ function createActiveOrganization(options) {
     const userId = session.user?.id ?? null;
     if (event === "SIGNED_IN" && userId !== current.userId) void load();
   });
+  const seatFor = (snap) => {
+    const seat = resolveAdminSeat(options.adminSeat?.());
+    return seat && snap.memberships.some((m) => m.id === seat.id) ? seat.id : null;
+  };
+  let lastNotAMemberRecheck = Number.NEGATIVE_INFINITY;
   const settled = async () => {
     if (current.status === "idle") return load();
     if (current.status === "resolving") {
@@ -339,11 +567,11 @@ function createActiveOrganization(options) {
       };
     },
     load,
-    current: () => current.status === "ready" ? current.organizationId : null,
+    current: () => current.status === "ready" ? seatFor(current) ?? current.organizationId : null,
     async ensureOrgId(recordOrganizationId) {
       if (recordOrganizationId) return recordOrganizationId;
       const snap = await settled();
-      if (snap.status === "ready" && snap.organizationId) return snap.organizationId;
+      if (snap.status === "ready" && snap.organizationId) return seatFor(snap) ?? snap.organizationId;
       if (snap.status === "error") throw new NoActiveOrganizationError("unreadable", snap.error ?? void 0);
       throw new NoActiveOrganizationError(snap.error === "signed-out" ? "signed-out" : "no-memberships");
     },
@@ -358,7 +586,16 @@ function createActiveOrganization(options) {
       await writeLastActiveOrganization(client, organizationId);
     },
     async handleRefusal(status, body) {
-      const kind = classifyOrganizationRefusal(status, body);
+      let kind = classifyOrganizationRefusal(status, body);
+      if (kind === null && isNotAMemberRefusal(body)) {
+        const now = Date.now();
+        if (now - lastNotAMemberRecheck >= (options.refusalRecheckGapMs ?? NOT_A_MEMBER_RECHECK_GAP_MS)) {
+          lastNotAMemberRecheck = now;
+          kind = "lapsed";
+        } else {
+          return null;
+        }
+      }
       if (kind === "lapsed") {
         if (current.userId) await held.clear();
         await load();
@@ -378,21 +615,132 @@ function createActiveOrganization(options) {
   if (options.autoLoad ?? true) void load();
   return api;
 }
+
+// src/organization-required.ts
+var ORGANIZATION_REQUIRED_CODE = "organization_required";
+var ORGANIZATION_REQUIRED_WIRE_CODE = ORGANIZATION_REQUIRED_CODE;
+var ORGANIZATION_CONTEXT_REQUIRED_CODE = "organization_context_required";
+var MEMBERSHIPS_URL = "/auth/organizations";
+function isOrganizationRequiredError(err) {
+  if (!(err instanceof Error)) return false;
+  const code = err.code;
+  return code === ORGANIZATION_CONTEXT_REQUIRED_CODE || code === ORGANIZATION_REQUIRED_CODE;
+}
+function isOrganizationRequiredEnvelope(body) {
+  return typeof body === "object" && body !== null && body.code === ORGANIZATION_REQUIRED_CODE;
+}
+function extractOrganizationHoldMemberships(err) {
+  if (!err || typeof err !== "object") return null;
+  if (err.code !== ORGANIZATION_REQUIRED_CODE) return null;
+  const container = err;
+  return readOrganizationsField(container.details) ?? readOrganizationsField(container.serverDetail);
+}
+function readOrganizationsField(details) {
+  if (!details || typeof details !== "object") return null;
+  const organizations = details.organizations;
+  if (!Array.isArray(organizations)) return null;
+  return organizations.filter(
+    (org) => !!org && typeof org === "object" && typeof org.id === "string" && typeof org.name === "string"
+  );
+}
+var OrganizationRequiredServerError = class extends Error {
+  name = "OrganizationRequiredServerError";
+  code = ORGANIZATION_REQUIRED_CODE;
+  /** `null` only when the list could not be read ("could not ask"), distinct from `[]`. */
+  memberships;
+  constructor(message, memberships = null) {
+    super(message);
+    this.memberships = memberships;
+  }
+};
+function isOrganizationRequiredServerError(error) {
+  return error instanceof OrganizationRequiredServerError || error instanceof Error && error.name === "OrganizationRequiredServerError";
+}
+async function readCallerMemberships(client) {
+  try {
+    const { data: claims } = await client.auth.getClaims();
+    const userId = claims?.claims?.sub;
+    if (typeof userId !== "string" || !userId) return null;
+    const query = client.schema("iam").from("memberships").select("organization_id, organizations:organization_id(id,name,abbreviation)");
+    const { data, error } = await query.eq("user_id", userId).eq("container_type", "organization").eq("status", "active").is("deleted_at", null);
+    if (error || !Array.isArray(data)) return null;
+    const rows = data;
+    return rows.map((row) => ({
+      id: row.organizations?.id ?? row.organization_id,
+      name: row.organizations?.name ?? "Untitled organization",
+      ...row.organizations?.abbreviation ? { abbreviation: row.organizations.abbreviation } : {}
+    })).sort((a, b) => a.name.localeCompare(b.name));
+  } catch {
+    return null;
+  }
+}
+async function organizationRequired(client, message) {
+  throw new OrganizationRequiredServerError(message, await readCallerMemberships(client));
+}
+function organizationRequiredEnvelope(error, setOn = "request") {
+  return {
+    error: ORGANIZATION_REQUIRED_CODE,
+    code: ORGANIZATION_REQUIRED_CODE,
+    message: error.message,
+    user_message: "Choose the organization you're working in, then try again.",
+    details: {
+      hold: ORGANIZATION_REQUIRED_CODE,
+      can_choose: true,
+      set_on: setOn,
+      remedy: "Choose the organization you're working in and send it with the request (the X-Organization-Id header), then try again.",
+      organizations: error.memberships,
+      memberships_url: MEMBERSHIPS_URL
+    }
+  };
+}
+function organizationRequiredResponse(error) {
+  return Response.json(organizationRequiredEnvelope(error), { status: 400 });
+}
 export {
+  LINK_ORGANIZATION_QUERY_KEY,
+  MEMBERSHIPS_URL,
+  NOT_A_MEMBER_RECHECK_GAP_MS,
   NoActiveOrganizationError,
   NotAMemberError,
+  ORGANIZATION_CONTEXT_REQUIRED_CODE,
   ORGANIZATION_ENTITY_TYPE,
+  ORGANIZATION_REQUIRED_CODE,
+  ORGANIZATION_REQUIRED_WIRE_CODE,
+  ORGANIZATION_RESOLUTION_TIMEOUT_MS,
+  OrganizationRequiredServerError,
+  adminSeatReplacesUserContext,
+  classifyLinkOrganizationValue,
   classifyOrganizationRefusal,
   createActiveOrganization,
+  createNotAMemberRefusalNotice,
+  createOrganizationBootstrapGate,
+  decideLinkOrganization,
+  extractOrganizationHoldMemberships,
+  isNotAMemberRefusal,
+  isOrganizationRequiredEnvelope,
+  isOrganizationRequiredError,
+  isOrganizationRequiredServerError,
+  linkOrganizationMalformedMessage,
+  linkOrganizationNotAMemberMessage,
+  linkOrganizationOfferMessage,
+  linkOrganizationSwitchAnnouncement,
   memoryHeldOrganization,
   oldestMembership,
   orderOrganizations,
   organizationMatches,
+  organizationRequired,
+  organizationRequiredEnvelope,
+  organizationRequiredResponse,
   readAccountOrganizationChoices,
+  readCallerMemberships,
+  readLinkOrganizationParam,
   readMemberships,
   readOrganizationFavourites,
   resolveActiveOrganization,
   resolveActiveOrganizationLazily,
+  resolveAdminSeat,
+  resolveChildOrganizationId,
+  resolveOrganizationWithLink,
   setOrganizationFavourite,
   storageHeldOrganization,
   toAccountOrganizationChoices,

package/dist/react.d.cts

@@ -96,7 +96,7 @@ interface ActiveOrganizationSnapshot {
     readonly organization: OrganizationMembership | null;
     readonly memberships: readonly OrganizationMembership[];
     /** Which ladder rung answered (or "switched" after a person's click). */
-    readonly rung: OrganizationRung | "switched" | null;
+    readonly rung: OrganizationRung | "switched" | "link" | null;
     readonly error: string | null;
 }
 interface ActiveOrganization {

package/dist/react.d.ts

@@ -96,7 +96,7 @@ interface ActiveOrganizationSnapshot {
     readonly organization: OrganizationMembership | null;
     readonly memberships: readonly OrganizationMembership[];
     /** Which ladder rung answered (or "switched" after a person's click). */
-    readonly rung: OrganizationRung | "switched" | null;
+    readonly rung: OrganizationRung | "switched" | "link" | null;
     readonly error: string | null;
 }
 interface ActiveOrganization {

package/dist/storage-Dqnye4KF.d.cts

@@ -0,0 +1,51 @@
+/**
+ * Session storage per platform — where a Supabase session lives between runs.
+ *
+ * supabase-js takes any `{ getItem, setItem, removeItem }` (sync or async). These are the ones
+ * every Matrx client needs, written once:
+ *
+ *   browser   — `browserStorage("local")` (supabase-js's own default; `"session"` = this tab only)
+ *   Next.js   — the cookie-backed clients in `@ai-matrx/auth/next` (the domain-wide auth cookie)
+ *   extension — `extensionStorage()` over `chrome.storage.local` (shared by popup, side panel and
+ *               service worker; `localStorage` does not exist in a service worker)
+ *   desktop   — `keyValueStorage({ get, set, remove })` over the host's store (Tauri store, keychain)
+ *   Node      — `fileStorage(path)` in `@ai-matrx/auth/node`, or `memoryStorage()` for a one-shot run
+ *
+ * None of these is ever silently swapped for another: a storage the platform does not have throws
+ * a named error at creation, never a quiet in-memory fallback that signs the person out on reload.
+ */
+/** The storage contract supabase-js reads (sync or async methods). */
+interface SessionStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+declare class StorageUnavailableError extends Error {
+    readonly storage: string;
+    constructor(storage: string, reason: string);
+}
+/** In memory only: the session ends with the process (one-shot scripts, tests, server renders). */
+declare function memoryStorage(): SessionStorage & {
+    readonly size: () => number;
+};
+/** The browser's `localStorage` (shared by every tab of the origin) or `sessionStorage` (this tab). */
+declare function browserStorage(kind?: "local" | "session"): SessionStorage;
+/** The structural slice of `chrome.storage.<area>` read here (MV3 promise API). */
+interface ChromeStorageAreaLike {
+    get(keys: string): Promise<Record<string, unknown>>;
+    set(items: Record<string, unknown>): Promise<void>;
+    remove(keys: string): Promise<void>;
+}
+/**
+ * A browser extension's `chrome.storage` area (default `local`): one session for the popup, side
+ * panel, content scripts' relay and the service worker. Pass `area` to inject one (tests, Firefox).
+ */
+declare function extensionStorage(area?: ChromeStorageAreaLike): SessionStorage;
+/** Any async key-value store the host owns (a desktop app's Tauri store or keychain). */
+declare function keyValueStorage(store: {
+    get(key: string): Promise<string | null | undefined>;
+    set(key: string, value: string): Promise<void>;
+    remove(key: string): Promise<void>;
+}): SessionStorage;
+
+export { type ChromeStorageAreaLike as C, type SessionStorage as S, StorageUnavailableError as a, browserStorage as b, extensionStorage as e, keyValueStorage as k, memoryStorage as m };

package/dist/storage-Dqnye4KF.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Session storage per platform — where a Supabase session lives between runs.
+ *
+ * supabase-js takes any `{ getItem, setItem, removeItem }` (sync or async). These are the ones
+ * every Matrx client needs, written once:
+ *
+ *   browser   — `browserStorage("local")` (supabase-js's own default; `"session"` = this tab only)
+ *   Next.js   — the cookie-backed clients in `@ai-matrx/auth/next` (the domain-wide auth cookie)
+ *   extension — `extensionStorage()` over `chrome.storage.local` (shared by popup, side panel and
+ *               service worker; `localStorage` does not exist in a service worker)
+ *   desktop   — `keyValueStorage({ get, set, remove })` over the host's store (Tauri store, keychain)
+ *   Node      — `fileStorage(path)` in `@ai-matrx/auth/node`, or `memoryStorage()` for a one-shot run
+ *
+ * None of these is ever silently swapped for another: a storage the platform does not have throws
+ * a named error at creation, never a quiet in-memory fallback that signs the person out on reload.
+ */
+/** The storage contract supabase-js reads (sync or async methods). */
+interface SessionStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+declare class StorageUnavailableError extends Error {
+    readonly storage: string;
+    constructor(storage: string, reason: string);
+}
+/** In memory only: the session ends with the process (one-shot scripts, tests, server renders). */
+declare function memoryStorage(): SessionStorage & {
+    readonly size: () => number;
+};
+/** The browser's `localStorage` (shared by every tab of the origin) or `sessionStorage` (this tab). */
+declare function browserStorage(kind?: "local" | "session"): SessionStorage;
+/** The structural slice of `chrome.storage.<area>` read here (MV3 promise API). */
+interface ChromeStorageAreaLike {
+    get(keys: string): Promise<Record<string, unknown>>;
+    set(items: Record<string, unknown>): Promise<void>;
+    remove(keys: string): Promise<void>;
+}
+/**
+ * A browser extension's `chrome.storage` area (default `local`): one session for the popup, side
+ * panel, content scripts' relay and the service worker. Pass `area` to inject one (tests, Firefox).
+ */
+declare function extensionStorage(area?: ChromeStorageAreaLike): SessionStorage;
+/** Any async key-value store the host owns (a desktop app's Tauri store or keychain). */
+declare function keyValueStorage(store: {
+    get(key: string): Promise<string | null | undefined>;
+    set(key: string, value: string): Promise<void>;
+    remove(key: string): Promise<void>;
+}): SessionStorage;
+
+export { type ChromeStorageAreaLike as C, type SessionStorage as S, StorageUnavailableError as a, browserStorage as b, extensionStorage as e, keyValueStorage as k, memoryStorage as m };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-matrx/auth",
-  "version": "0.1.4",
+  "version": "0.2.1",
   "description": "AI Matrx sign-in, session and organizations for every app: sign in/out, session storage and refresh per platform (browser, Next.js, extension, desktop, Node), the current person, their organizations and favourites, the one active organization (held requests, never a list filter), and the credentials @ai-matrx/data and @ai-matrx/api read.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -122,6 +122,16 @@
         "default": "./dist/testing.cjs"
       }
     },
+    "./matrx-oauth": {
+      "import": {
+        "types": "./dist/matrx-oauth.d.ts",
+        "default": "./dist/matrx-oauth.js"
+      },
+      "require": {
+        "types": "./dist/matrx-oauth.d.cts",
+        "default": "./dist/matrx-oauth.cjs"
+      }
+    },
     "./package.json": "./package.json"
   },
   "devDependencies": {
@@ -191,5 +201,5 @@
     "test": "vitest run",
     "verify:tarball": "node ./scripts/verify-tarball.mjs"
   },
-  "gitHead": "9c8f9e35b1fe67f38dcc59ed4a2becb9cc7e79cf"
+  "gitHead": "51416dab018cb60548d2baeed471c4b27a0cb44b"
 }