@appshell/react 1.0.0-alpha.44 → 1.0.0-alpha.46

package/dist/types/runtime/src/identity.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Who is looking at the page, as the registry was told by the gateway.
+ *
+ * Unlike vars this is not scope-specific — there is one visitor per page, not one
+ * per package — so it lives in the main entry rather than needing the subpath
+ * trick `@appshell/runtime/vars` uses to get a per-package scope substituted.
+ *
+ * It is also not delivered through the vars store, and that is a constraint rather
+ * than a preference: `setVars` freezes on first write and throws on replacement,
+ * which is what stops one package overwriting another's configuration. Identity
+ * changes — sign-in, sign-out, token refresh — so it cannot live behind a
+ * write-once door without either breaking that guarantee or never updating.
+ */
+/**
+ * A discriminated union rather than an optional user, so `username` cannot be read
+ * without the anonymous case having been handled. The compiler enforces what a
+ * convention would only ask for.
+ */
+export type Identity = {
+    authenticated: false;
+} | {
+    authenticated: true;
+    subject: string;
+    username: string;
+    roles: string[];
+};
+export declare const ANONYMOUS: Identity;
+declare global {
+    interface Window {
+        __appshell_identity__?: unknown;
+    }
+}
+/**
+ * The visitor, or the anonymous identity when there is none.
+ *
+ * Never throws and never returns undefined — an absent or malformed value is
+ * anonymous, which is a state every caller already has to handle. That is the
+ * opposite of `readVars`, which throws when a scope is missing, and the difference
+ * is deliberate: a package with no configuration cannot do its job, while a package
+ * with no signed-in user usually can and simply renders differently.
+ *
+ * This is a typed accessor, not a boundary. The value is inlined into the document
+ * and any script on the page can read it directly, exactly as with vars. Treat it
+ * as what the server said about the visitor, never as proof of anything: it carries
+ * no token and grants nothing. Anything that matters is re-checked server-side.
+ */
+export declare const getIdentity: () => Identity;

package/dist/types/runtime/src/index.d.ts

@@ -1,4 +1,6 @@
 export { MissingScopeError, MissingVarsError, VarsConflictError } from './errors';
+export { ANONYMOUS, getIdentity } from './identity';
+export type { Identity } from './identity';
 export { hasVars, readVars, resetVars, setVars } from './store';
 export type { Vars } from './types';
 export type { AppshellIndex, AppshellRemote, Metadata } from './wire';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appshell/react",
-  "version": "1.0.0-alpha.44",
+  "version": "1.0.0-alpha.46",
   "description": "React utilities for building micro-frontends with Appshell and Module Federation",
   "main": "dist/main.js",
   "types": "dist/types/react/src/index.d.ts",
@@ -33,8 +33,8 @@
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
-  "gitHead": "814f81383214fa613c4d92a05236f53fcc1921bb",
+  "gitHead": "8ef63d50e61a09ee1205cac64548b5331e7b8472",
   "dependencies": {
-    "@appshell/runtime": "^1.0.0-alpha.44"
+    "@appshell/runtime": "^1.0.0-alpha.46"
   }
 }