@atlasauth/react 0.18.0 → 0.20.0

package/dist/compat-kinde.js

@@ -0,0 +1,184 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.kindeUserFrom = kindeUserFrom;
+exports.kindeSessionFrom = kindeSessionFrom;
+exports.useKindeAuthCompat = useKindeAuthCompat;
+exports.useKindeBrowserClientCompat = useKindeBrowserClientCompat;
+/**
+ * Drop-in helpers for apps moving to Atlas from Kinde (`@kinde-oss/kinde-auth-react`
+ * and the browser side of `@kinde-oss/kinde-auth-nextjs`).
+ *
+ * `atlas migrate code --from kinde` rewrites `useKindeAuth()` to
+ * {@link useKindeAuthCompat} and `useKindeBrowserClient()` to
+ * {@link useKindeBrowserClientCompat}, so call sites keep the Kinde shapes
+ * (`user.given_name`, `getPermission(key).isGranted`, `organization.orgCode`, …)
+ * and run on day one. Both are thin projections over the `<AtlasProvider>` state;
+ * move call sites to `useUser()` / `useAuth()` / `useOrganization()` at your own pace.
+ *
+ * What maps, and how:
+ *  - the user → Kinde's `{ id, email, given_name, family_name, picture, username, phone_number }`;
+ *  - permissions → the session's organization permissions plus its app-level
+ *    permissions (`org_permissions` / `app_permissions` claims);
+ *  - the organization → the active Atlas organization (`orgCode` is its id);
+ *  - `accessToken` / `getAccessToken()` → the decoded Atlas session claims, and the
+ *    raw token is the Atlas session JWT;
+ *  - feature flags have no Atlas counterpart: the flag getters always return the
+ *    default value you pass (the codemod marks every call site).
+ *
+ * Every getter works with or without `await`, so code written for either the
+ * synchronous (v4) or the asynchronous (v5) Kinde React API keeps working.
+ */
+const react_1 = require("react");
+const AtlasProvider_1 = require("./AtlasProvider");
+const components_shared_1 = require("./components-shared");
+/** Project an Atlas user onto Kinde's user shape. */
+function kindeUserFrom(user) {
+    if (!user)
+        return null;
+    const emails = user.email_addresses ?? [];
+    const email = emails.find((e) => e.primary) ?? emails.find((e) => e.verified) ?? emails[0];
+    const phones = user.phone_numbers ?? [];
+    const phone = phones.find((p) => p.primary) ?? phones[0];
+    return {
+        id: user.id,
+        email: email?.email_address ?? null,
+        given_name: user.first_name,
+        family_name: user.last_name,
+        picture: user.image_url,
+        username: user.username,
+        phone_number: phone?.phone_number ?? null,
+    };
+}
+/** Organization permissions plus app-level permissions, deduplicated. */
+function heldPermissions(claims) {
+    const out = new Set();
+    for (const list of [claims?.org_permissions, claims?.app_permissions]) {
+        if (!Array.isArray(list))
+            continue;
+        for (const p of list)
+            if (typeof p === 'string')
+                out.add(p);
+    }
+    return [...out];
+}
+function flagType(value) {
+    return typeof value === 'boolean' ? 'boolean' : typeof value === 'number' ? 'integer' : 'string';
+}
+/** The flag getters: Atlas has no feature flags, so each returns the default it is given. */
+function flagGetters() {
+    return {
+        getFlag(code, defaultValue, _type) {
+            return { code, type: flagType(defaultValue), value: defaultValue, is_default: true, defaultValue };
+        },
+        getBooleanFlag(_code, defaultValue) {
+            return defaultValue;
+        },
+        getStringFlag(_code, defaultValue) {
+            return defaultValue;
+        },
+        getIntegerFlag(_code, defaultValue) {
+            return defaultValue;
+        },
+    };
+}
+/**
+ * Pure projection of the provider state onto the members `useKindeAuth()` and
+ * `useKindeBrowserClient()` share. Exported for tests and custom wiring.
+ */
+function kindeSessionFrom(state) {
+    const signedIn = state.status === 'signed_in';
+    const claims = signedIn ? state.claims : null;
+    const orgCode = claims?.org_id ?? null;
+    const memberships = signedIn ? (state.memberships ?? []) : [];
+    const active = memberships.find((m) => m.organization.id === orgCode) ?? null;
+    const user = signedIn ? kindeUserFrom(state.user) : null;
+    const permissions = { permissions: heldPermissions(claims), orgCode };
+    const organization = orgCode
+        ? { orgCode, orgName: active?.organization.name ?? null }
+        : null;
+    const userOrganizations = signedIn
+        ? {
+            orgCodes: memberships.map((m) => m.organization.id),
+            orgs: memberships.map((m) => ({ code: m.organization.id, name: m.organization.name })),
+        }
+        : null;
+    return {
+        isLoading: state.status === 'loading',
+        isAuthenticated: signedIn,
+        user,
+        permissions,
+        organization,
+        userOrganizations,
+        /** The decoded Atlas session claims (Kinde's decoded access token). */
+        accessToken: claims,
+        getUser: () => user,
+        getPermission: (key) => ({
+            isGranted: permissions.permissions.includes(key),
+            orgCode,
+        }),
+        getPermissions: () => permissions,
+        getOrganization: () => organization,
+        getUserOrganizations: () => userOrganizations,
+        getAccessToken: () => claims,
+        /** A claim of the Atlas session token, as `{ name, value }`; null when signed out. */
+        getClaim: (name, _tokenType) => claims ? { name, value: claims[name] ?? null } : null,
+        ...flagGetters(),
+    };
+}
+function returnPath(options) {
+    return options.app_state?.redirectTo ?? options.redirectURL ?? options.post_login_redirect_url;
+}
+/**
+ * `useKindeAuth()` from `@kinde-oss/kinde-auth-react`, on Atlas. `login()` and
+ * `register()` open your Atlas sign-in / sign-up pages; `logout(url?)` signs out
+ * and goes to `url` (default `/`); `getToken()` resolves the Atlas session JWT.
+ */
+function useKindeAuthCompat() {
+    const atlas = (0, AtlasProvider_1.useAtlas)();
+    return {
+        ...kindeSessionFrom(atlas),
+        error: undefined,
+        login: async (options = {}) => (0, components_shared_1.navigateTo)((0, components_shared_1.withRedirect)(options.signInUrl ?? '/sign-in', returnPath(options))),
+        register: async (options = {}) => (0, components_shared_1.navigateTo)((0, components_shared_1.withRedirect)(options.signUpUrl ?? '/sign-up', returnPath(options))),
+        logout: async (options) => {
+            await atlas.signOut();
+            const to = typeof options === 'string' ? options : (options?.redirectUrl ?? options?.returnTo);
+            (0, components_shared_1.navigateTo)(to ?? '/');
+        },
+        getToken: async () => (await atlas.getToken()) ?? undefined,
+    };
+}
+/**
+ * `useKindeBrowserClient()` from `@kinde-oss/kinde-auth-nextjs`, on Atlas.
+ * `accessTokenRaw` / `getToken()` hold the latest Atlas session JWT (null until the
+ * first one is fetched); for a request, prefer `await useAuth().getToken()`, which
+ * is always fresh. `refreshData()` reloads the user and session.
+ */
+function useKindeBrowserClientCompat() {
+    const atlas = (0, AtlasProvider_1.useAtlas)();
+    const [token, setToken] = (0, react_1.useState)(null);
+    (0, react_1.useEffect)(() => {
+        if (atlas.status !== 'signed_in') {
+            setToken(null);
+            return;
+        }
+        let live = true;
+        void atlas.getToken().then((t) => live && setToken(t), () => live && setToken(null));
+        return () => {
+            live = false;
+        };
+    }, [atlas.status, atlas.claims]);
+    return {
+        ...kindeSessionFrom(atlas),
+        error: null,
+        accessTokenRaw: token,
+        accessTokenEncoded: token,
+        getAccessTokenRaw: () => token,
+        getToken: () => token,
+        refreshData: async () => {
+            await atlas.reload();
+        },
+    };
+}
+//# sourceMappingURL=compat-kinde.js.map

package/dist/compat-kinde.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-kinde.js","sourceRoot":"","sources":["../src/compat-kinde.ts"],"names":[],"mappings":";AAAA,YAAY,CAAC;;AA2Fb,sCAeC;AAsCD,4CAwCC;AAuBD,gDAgBC;AAQD,kEA4BC;AAjQD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,iCAA4C;AAC5C,mDAA2C;AAC3C,2DAA+D;AA8D/D,qDAAqD;AACrD,SAAgB,aAAa,CAAC,IAAsB;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,SAAS;QAC3B,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,KAAK,EAAE,YAAY,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,MAA4B;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnG,CAAC;AAED,6FAA6F;AAC7F,SAAS,WAAW;IAClB,OAAO;QACL,OAAO,CAAI,IAAY,EAAE,YAAe,EAAE,KAAc;YACtD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACrG,CAAC;QACD,cAAc,CAAC,KAAa,EAAE,YAAsB;YAClD,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,aAAa,CAAC,KAAa,EAAE,YAAqB;YAChD,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,cAAc,CAAC,KAAa,EAAE,YAAqB;YACjD,OAAO,YAAY,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,KAAuB;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IACvC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;IAC9E,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,WAAW,GAA2B,EAAE,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IAC9F,MAAM,YAAY,GAAmC,OAAO;QAC1D,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,IAAI,IAAI,EAAE;QACzD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,iBAAiB,GAAwC,QAAQ;QACrE,CAAC,CAAC;YACE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;SACvF;QACH,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;QACrC,eAAe,EAAE,QAAQ;QACzB,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,iBAAiB;QACjB,uEAAuE;QACvE,WAAW,EAAE,MAAM;QACnB,OAAO,EAAE,GAA2B,EAAE,CAAC,IAAI;QAC3C,aAAa,EAAE,CAAC,GAAW,EAAyB,EAAE,CAAC,CAAC;YACtD,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChD,OAAO;SACR,CAAC;QACF,cAAc,EAAE,GAA2B,EAAE,CAAC,WAAW;QACzD,eAAe,EAAE,GAAmC,EAAE,CAAC,YAAY;QACnE,oBAAoB,EAAE,GAAwC,EAAE,CAAC,iBAAiB;QAClF,cAAc,EAAE,GAAyB,EAAE,CAAC,MAAM;QAClD,sFAAsF;QACtF,QAAQ,EAAE,CAAC,IAAY,EAAE,UAAmB,EAA2B,EAAE,CACvE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;QACvD,GAAG,WAAW,EAAE;KACjB,CAAC;AACJ,CAAC;AAcD,SAAS,UAAU,CAAC,OAAgC;IAClD,OAAO,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,uBAAuB,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB;IAChC,MAAM,KAAK,GAAG,IAAA,wBAAQ,GAAE,CAAC;IACzB,OAAO;QACL,GAAG,gBAAgB,CAAC,KAAK,CAAC;QAC1B,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,KAAK,EAAE,UAAmC,EAAE,EAAiB,EAAE,CACpE,IAAA,8BAAU,EAAC,IAAA,gCAAY,EAAC,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,QAAQ,EAAE,KAAK,EAAE,UAAmC,EAAE,EAAiB,EAAE,CACvE,IAAA,8BAAU,EAAC,IAAA,gCAAY,EAAC,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,MAAM,EAAE,KAAK,EAAE,OAA8D,EAAiB,EAAE;YAC9F,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/F,IAAA,8BAAU,EAAC,EAAE,IAAI,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,QAAQ,EAAE,KAAK,IAAiC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,SAAS;KACzF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B;IACzC,MAAM,KAAK,GAAG,IAAA,wBAAQ,GAAE,CAAC;IACzB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAgB,IAAI,CAAC,CAAC;IACxD,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,EAC1B,GAAG,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,EAAE;YACV,IAAI,GAAG,KAAK,CAAC;QACf,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,OAAO;QACL,GAAG,gBAAgB,CAAC,KAAK,CAAC;QAC1B,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,KAAK;QACrB,kBAAkB,EAAE,KAAK;QACzB,iBAAiB,EAAE,GAAkB,EAAE,CAAC,KAAK;QAC7C,QAAQ,EAAE,GAAkB,EAAE,CAAC,KAAK;QACpC,WAAW,EAAE,KAAK,IAAmB,EAAE;YACrC,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/compat-okta.d.ts

@@ -0,0 +1,102 @@
+import type { AtlasUser, SessionClaims } from './types';
+import { type ActiveAtlas } from './active-atlas';
+/** The OIDC user claims okta-auth-js's `getUser()` / `token.getUserInfo()` resolve to. */
+export interface OktaCompatUserClaims {
+    sub: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    preferred_username?: string;
+    email?: string;
+    email_verified?: boolean;
+    picture?: string;
+    [claim: string]: unknown;
+}
+/** okta-auth-js's `AuthState`: `null` while loading, then signed in or not. */
+export interface OktaCompatAuthState {
+    isAuthenticated: boolean;
+    /** The Atlas session token, with the user's profile claims merged into its claims. */
+    idToken?: {
+        idToken: string;
+        claims: OktaCompatUserClaims & SessionClaims;
+    };
+    /** The Atlas session token and its claims. */
+    accessToken?: {
+        accessToken: string;
+        claims: SessionClaims;
+    };
+}
+export interface OktaAuthCompatOptions {
+    /** Where your Atlas sign-in page lives (default `/sign-in`). */
+    signInUrl?: string;
+    /** Where `signOut()` goes when the call does not say (okta-auth-js's option of the same name). Default `/`. */
+    postLogoutRedirectUri?: string;
+    /** okta-auth-js options (`issuer`, `clientId`, `redirectUri`, `scopes`, `pkce`, …) are accepted and ignored. */
+    [option: string]: unknown;
+}
+export interface OktaCompatSignInOptions {
+    /** Where to land after sign-in (sent to the sign-in page as `redirect_url`). */
+    originalUri?: string;
+    [option: string]: unknown;
+}
+export interface OktaCompatSignOutOptions {
+    postLogoutRedirectUri?: string;
+    [option: string]: unknown;
+}
+/** okta-auth-js's `AuthSdkError`, thrown when a call needs a signed-in user. */
+export declare class OktaCompatAuthSdkError extends Error {
+    readonly errorCode = "INTERNAL";
+    readonly errorSummary: string;
+    constructor(message: string);
+}
+/** Project an Atlas user onto the OIDC user claims Okta returns. */
+export declare function oktaUserFrom(user: AtlasUser | null): OktaCompatUserClaims | null;
+/**
+ * Pure projection of the provider state onto okta-auth-js's `AuthState`.
+ * `token` is the session token: `undefined` while it is being read (the state
+ * is then `null`, as Okta's is before its first evaluation), `null` when there
+ * is none.
+ */
+export declare function oktaAuthStateFrom(state: Pick<ActiveAtlas, 'status' | 'user' | 'claims'>, token: string | null | undefined): OktaCompatAuthState | null;
+/** okta-auth-js's `toRelativeUrl(path, baseUrl)`: an absolute URL loses its `baseUrl` prefix. */
+export declare function toRelativeUrlCompat(path?: string, baseUrl?: string): string;
+/**
+ * `new OktaAuth(config)` from `@okta/okta-auth-js`, on Atlas, for a React app
+ * that renders `<AtlasProvider>`. The config is accepted and ignored apart from
+ * `signInUrl` and `postLogoutRedirectUri`: sign-in runs on your Atlas pages and
+ * the provider holds the session.
+ */
+export declare class OktaAuthCompat {
+    readonly options: OktaAuthCompatOptions;
+    /** okta-auth-js's `oktaAuth.token` namespace (`getUserInfo` only). */
+    readonly token: {
+        getUserInfo(): Promise<OktaCompatUserClaims>;
+    };
+    private readonly atlas;
+    private cached;
+    private pending;
+    /**
+     * @param atlas Where the provider state comes from. Internal: the hook passes
+     * its own; by default the `<AtlasProvider>` mounted on the page.
+     */
+    constructor(options?: OktaAuthCompatOptions, atlas?: () => ActiveAtlas);
+    /** Open your Atlas sign-in page, coming back to `originalUri` afterwards. */
+    signInWithRedirect(options?: OktaCompatSignInOptions): Promise<void>;
+    /** Sign out, then go to `postLogoutRedirectUri` (default `/`). */
+    signOut(options?: OktaCompatSignOutOptions): Promise<void>;
+    isAuthenticated(): Promise<boolean>;
+    /** The signed-in user's claims; throws `AuthSdkError` when nobody is signed in, like Okta. */
+    getUser(): Promise<OktaCompatUserClaims>;
+    /** The session token on hand (synchronous, like okta-auth-js), refreshed in the background. */
+    getAccessToken(): string | undefined;
+    /** Atlas has one session token: the same value as `getAccessToken()`. */
+    getIdToken(): string | undefined;
+    /** Read a fresh session token now (the async form of `getAccessToken()`). */
+    getFreshAccessToken(): Promise<string | undefined>;
+    private current;
+}
+/** `useOktaAuth()` from `@okta/okta-react`, on Atlas: `{ oktaAuth, authState }`. */
+export declare function useOktaAuthCompat(): {
+    oktaAuth: OktaAuthCompat;
+    authState: OktaCompatAuthState | null;
+};

package/dist/compat-okta.js

@@ -0,0 +1,240 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OktaAuthCompat = exports.OktaCompatAuthSdkError = void 0;
+exports.oktaUserFrom = oktaUserFrom;
+exports.oktaAuthStateFrom = oktaAuthStateFrom;
+exports.toRelativeUrlCompat = toRelativeUrlCompat;
+exports.useOktaAuthCompat = useOktaAuthCompat;
+/**
+ * Drop-in compatibility helpers for React apps moving to Atlas from Okta
+ * (`@okta/okta-react` + `@okta/okta-auth-js`): what `atlas migrate code --from okta`
+ * rewrites `useOktaAuth()`, `new OktaAuth(config)` and `toRelativeUrl` onto.
+ *
+ * `useOktaAuthCompat()` keeps okta-react's `{ oktaAuth, authState }` shape, and
+ * `OktaAuthCompat` the okta-auth-js methods apps call most (`signInWithRedirect`,
+ * `signOut`, `isAuthenticated`, `getUser`, `getAccessToken`, `getIdToken`,
+ * `token.getUserInfo`), on top of the mounted `<AtlasProvider>`:
+ *
+ *  - sign-in opens your Atlas sign-in page and comes back to `originalUri`, so
+ *    okta-react's `restoreOriginalUri` and `<LoginCallback>` are no longer needed;
+ *  - the "access token" and the "ID token" are both the Atlas session token:
+ *    verify it on your server with `AtlasBackend` from `@atlasauth/backend`. Its
+ *    `sub` is the Atlas user id (an Okta access token carried the login there,
+ *    and the user id in `uid`);
+ *  - `getAccessToken()` / `getIdToken()` stay synchronous, as in okta-auth-js:
+ *    they return the freshest unexpired token on hand and refresh it in the
+ *    background (`await getFreshAccessToken()` when you can wait).
+ *
+ * Calling a method with no provider mounted throws a clear error, except the
+ * synchronous token getters, which return `undefined` like a signed-out Okta app.
+ */
+const react_1 = require("react");
+const AtlasProvider_1 = require("./AtlasProvider");
+const components_shared_1 = require("./components-shared");
+const active_atlas_1 = require("./active-atlas");
+/** okta-auth-js's `AuthSdkError`, thrown when a call needs a signed-in user. */
+class OktaCompatAuthSdkError extends Error {
+    errorCode = 'INTERNAL';
+    errorSummary;
+    constructor(message) {
+        super(message);
+        this.name = 'AuthSdkError';
+        this.errorSummary = message;
+    }
+}
+exports.OktaCompatAuthSdkError = OktaCompatAuthSdkError;
+/** Project an Atlas user onto the OIDC user claims Okta returns. */
+function oktaUserFrom(user) {
+    if (!user)
+        return null;
+    const list = user.email_addresses ?? [];
+    const email = list.find((e) => e.primary) ?? list.find((e) => e.verified) ?? list[0];
+    const out = { sub: user.id };
+    const name = [user.first_name, user.last_name].filter(Boolean).join(' ').trim();
+    if (name)
+        out.name = name;
+    if (user.first_name)
+        out.given_name = user.first_name;
+    if (user.last_name)
+        out.family_name = user.last_name;
+    // Okta's preferred_username is the login: the username here, else the email.
+    const login = user.username ?? email?.email_address;
+    if (login)
+        out.preferred_username = login;
+    if (email) {
+        out.email = email.email_address;
+        out.email_verified = email.verified;
+    }
+    if (user.image_url)
+        out.picture = user.image_url;
+    return out;
+}
+/**
+ * Pure projection of the provider state onto okta-auth-js's `AuthState`.
+ * `token` is the session token: `undefined` while it is being read (the state
+ * is then `null`, as Okta's is before its first evaluation), `null` when there
+ * is none.
+ */
+function oktaAuthStateFrom(state, token) {
+    if (state.status === 'loading')
+        return null;
+    if (state.status !== 'signed_in')
+        return { isAuthenticated: false };
+    if (token === undefined)
+        return null;
+    if (token === null || !state.claims)
+        return { isAuthenticated: true };
+    const profile = oktaUserFrom(state.user);
+    return {
+        isAuthenticated: true,
+        idToken: { idToken: token, claims: { ...state.claims, ...profile, sub: state.claims.sub } },
+        accessToken: { accessToken: token, claims: state.claims },
+    };
+}
+/** okta-auth-js's `toRelativeUrl(path, baseUrl)`: an absolute URL loses its `baseUrl` prefix. */
+function toRelativeUrlCompat(path = '', baseUrl = '') {
+    let out = path;
+    if (/^[a-z][a-z0-9+.-]*:/i.test(out))
+        out = out.substring(baseUrl.length);
+    return out.charAt(0) === '/' ? out : `/${out}`;
+}
+/** When a JWT expires (ms since epoch); unknown expiry counts as not expiring. */
+function expiresAt(token) {
+    try {
+        const part = (token.split('.')[1] ?? '').replace(/-/g, '+').replace(/_/g, '/');
+        const exp = JSON.parse(atob(part.padEnd(Math.ceil(part.length / 4) * 4, '='))).exp;
+        return typeof exp === 'number' ? exp * 1000 : Number.POSITIVE_INFINITY;
+    }
+    catch {
+        return Number.POSITIVE_INFINITY;
+    }
+}
+/** Like okta-auth-js's `expireEarlySeconds`: a token this close to expiry is not handed out. */
+const EXPIRE_EARLY_MS = 10_000;
+/**
+ * `new OktaAuth(config)` from `@okta/okta-auth-js`, on Atlas, for a React app
+ * that renders `<AtlasProvider>`. The config is accepted and ignored apart from
+ * `signInUrl` and `postLogoutRedirectUri`: sign-in runs on your Atlas pages and
+ * the provider holds the session.
+ */
+class OktaAuthCompat {
+    options;
+    /** okta-auth-js's `oktaAuth.token` namespace (`getUserInfo` only). */
+    token;
+    atlas;
+    cached = null;
+    pending = null;
+    /**
+     * @param atlas Where the provider state comes from. Internal: the hook passes
+     * its own; by default the `<AtlasProvider>` mounted on the page.
+     */
+    constructor(options = {}, atlas) {
+        this.options = options;
+        this.token = { getUserInfo: () => this.getUser() };
+        if (atlas) {
+            this.atlas = atlas;
+            return;
+        }
+        this.atlas = () => (0, active_atlas_1.requireActive)('OktaAuthCompat');
+        // Keep a token on hand for the synchronous getters, as Okta's token manager does.
+        const prefetch = (state) => {
+            if (state?.status === 'signed_in')
+                void this.getFreshAccessToken().catch(() => undefined);
+        };
+        (0, active_atlas_1.onActiveAtlasChange)(prefetch);
+        prefetch((0, active_atlas_1.getActiveAtlas)());
+    }
+    /** Open your Atlas sign-in page, coming back to `originalUri` afterwards. */
+    async signInWithRedirect(options = {}) {
+        (0, components_shared_1.navigateTo)((0, components_shared_1.withRedirect)(this.options.signInUrl ?? '/sign-in', options.originalUri));
+    }
+    /** Sign out, then go to `postLogoutRedirectUri` (default `/`). */
+    async signOut(options = {}) {
+        await this.atlas().signOut();
+        this.cached = null;
+        (0, components_shared_1.navigateTo)(options.postLogoutRedirectUri ?? this.options.postLogoutRedirectUri ?? '/');
+    }
+    async isAuthenticated() {
+        return this.atlas().status === 'signed_in';
+    }
+    /** The signed-in user's claims; throws `AuthSdkError` when nobody is signed in, like Okta. */
+    async getUser() {
+        const atlas = this.atlas();
+        const user = atlas.status === 'signed_in' ? oktaUserFrom(atlas.user) : null;
+        if (!user)
+            throw new OktaCompatAuthSdkError('getUser: no user is signed in');
+        return user;
+    }
+    /** The session token on hand (synchronous, like okta-auth-js), refreshed in the background. */
+    getAccessToken() {
+        void this.getFreshAccessToken().catch(() => undefined);
+        return this.current();
+    }
+    /** Atlas has one session token: the same value as `getAccessToken()`. */
+    getIdToken() {
+        return this.getAccessToken();
+    }
+    /** Read a fresh session token now (the async form of `getAccessToken()`). */
+    getFreshAccessToken() {
+        if (!this.pending) {
+            this.pending = (async () => {
+                const atlas = this.atlas();
+                const sub = atlas.claims?.sub;
+                if (atlas.status !== 'signed_in' || !sub) {
+                    this.cached = null;
+                    return undefined;
+                }
+                const token = await atlas.getToken();
+                this.cached = token ? { token, sub, expiresAt: expiresAt(token) } : null;
+                return token ?? undefined;
+            })().finally(() => {
+                this.pending = null;
+            });
+        }
+        return this.pending;
+    }
+    current() {
+        let atlas;
+        try {
+            atlas = this.atlas();
+        }
+        catch {
+            return undefined;
+        }
+        const c = this.cached;
+        // Never hand one user's token to another, nor a token about to expire.
+        if (atlas.status !== 'signed_in' || !c || c.sub !== atlas.claims?.sub)
+            return undefined;
+        return c.expiresAt - EXPIRE_EARLY_MS > Date.now() ? c.token : undefined;
+    }
+}
+exports.OktaAuthCompat = OktaAuthCompat;
+/** `useOktaAuth()` from `@okta/okta-react`, on Atlas: `{ oktaAuth, authState }`. */
+function useOktaAuthCompat() {
+    const atlas = (0, AtlasProvider_1.useAtlas)();
+    const latest = (0, react_1.useRef)(atlas);
+    latest.current = atlas;
+    // One stable object, like okta-react's: effects that depend on it do not re-run.
+    const oktaAuth = (0, react_1.useMemo)(() => new OktaAuthCompat({}, () => latest.current), []);
+    const sub = atlas.status === 'signed_in' ? (atlas.claims?.sub ?? null) : null;
+    const [token, setToken] = (0, react_1.useState)(null);
+    (0, react_1.useEffect)(() => {
+        if (!sub)
+            return;
+        let live = true;
+        oktaAuth.getFreshAccessToken().then((value) => {
+            if (live)
+                setToken({ sub, value: value ?? null });
+        }, () => {
+            if (live)
+                setToken({ sub, value: null });
+        });
+        return () => {
+            live = false;
+        };
+        // New claims mean a refreshed session token: read it again.
+    }, [oktaAuth, sub, atlas.claims]);
+    return { oktaAuth, authState: oktaAuthStateFrom(atlas, token && token.sub === sub ? token.value : undefined) };
+}
+//# sourceMappingURL=compat-okta.js.map

package/dist/compat-okta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-okta.js","sourceRoot":"","sources":["../src/compat-okta.ts"],"names":[],"mappings":";AAAA,YAAY,CAAC;;;AAqFb,oCAkBC;AAQD,8CAcC;AAGD,kDAIC;AAwHD,8CAyBC;AAnRD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,iCAA6D;AAC7D,mDAA2C;AAC3C,2DAA+D;AAE/D,iDAAsG;AA4CtG,gFAAgF;AAChF,MAAa,sBAAuB,SAAQ,KAAK;IACtC,SAAS,GAAG,UAAU,CAAC;IACvB,YAAY,CAAS;IAC9B,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;IAC9B,CAAC;CACF;AARD,wDAQC;AAED,oEAAoE;AACpE,SAAgB,YAAY,CAAC,IAAsB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAyB,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChF,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACtD,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;IACrD,6EAA6E;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,aAAa,CAAC;IACpD,IAAI,KAAK;QAAE,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAC1C,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC;QAChC,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,KAAsD,EACtD,KAAgC;IAEhC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACpE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE;QAC3F,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAgB,mBAAmB,CAAC,IAAI,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE;IACzD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAuB,CAAC,GAAG,CAAC;QAC1G,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAClC,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;;GAKG;AACH,MAAa,cAAc;IAChB,OAAO,CAAwB;IACxC,sEAAsE;IAC7D,KAAK,CAAmD;IAChD,KAAK,CAAoB;IAClC,MAAM,GAA6D,IAAI,CAAC;IACxE,OAAO,GAAuC,IAAI,CAAC;IAE3D;;;OAGG;IACH,YAAY,UAAiC,EAAE,EAAE,KAAyB;QACxE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,IAAA,4BAAa,EAAC,gBAAgB,CAAC,CAAC;QACnD,kFAAkF;QAClF,MAAM,QAAQ,GAAG,CAAC,KAAyB,EAAE,EAAE;YAC7C,IAAI,KAAK,EAAE,MAAM,KAAK,WAAW;gBAAE,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5F,CAAC,CAAC;QACF,IAAA,kCAAmB,EAAC,QAAQ,CAAC,CAAC;QAC9B,QAAQ,CAAC,IAAA,6BAAc,GAAE,CAAC,CAAC;IAC7B,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,kBAAkB,CAAC,UAAmC,EAAE;QAC5D,IAAA,8BAAU,EAAC,IAAA,gCAAY,EAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,OAAO,CAAC,UAAoC,EAAE;QAClD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAA,8BAAU,EAAC,OAAO,CAAC,qBAAqB,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC;IAC7C,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,OAAO;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,sBAAsB,CAAC,+BAA+B,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+FAA+F;IAC/F,cAAc;QACZ,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,yEAAyE;IACzE,UAAU;QACR,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;gBAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC;oBACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;oBACnB,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzE,OAAO,KAAK,IAAI,SAAS,CAAC;YAC5B,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACtB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,OAAO;QACb,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,uEAAuE;QACvE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,EAAE,GAAG;YAAE,OAAO,SAAS,CAAC;QACxF,OAAO,CAAC,CAAC,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;CACF;AA/FD,wCA+FC;AAED,oFAAoF;AACpF,SAAgB,iBAAiB;IAC/B,MAAM,KAAK,GAAG,IAAA,wBAAQ,GAAE,CAAC;IACzB,MAAM,MAAM,GAAG,IAAA,cAAM,EAAc,KAAK,CAAC,CAAC;IAC1C,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;IACvB,iFAAiF;IACjF,MAAM,QAAQ,GAAG,IAAA,eAAO,EAAC,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAA+C,IAAI,CAAC,CAAC;IACvF,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,QAAQ,CAAC,mBAAmB,EAAE,CAAC,IAAI,CACjC,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,IAAI;gBAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC,EACD,GAAG,EAAE;YACH,IAAI,IAAI;gBAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC,CACF,CAAC;QACF,OAAO,GAAG,EAAE;YACV,IAAI,GAAG,KAAK,CAAC;QACf,CAAC,CAAC;QACF,4DAA4D;IAC9D,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;AACjH,CAAC"}

package/dist/compat.d.ts

@@ -1,6 +1,7 @@
 /**
  * Drop-in compatibility helpers for apps moving to Atlas from Auth.js (NextAuth),
- * Auth0 (auth0-react / nextjs-auth0), Supabase Auth and Better Auth.
+ * Auth0 (auth0-react / nextjs-auth0), Supabase Auth, Better Auth, Okta (okta-react /
+ * okta-auth-js), Kinde and Descope.
  *
  * `atlas migrate code --from <vendor>` rewrites an app's imports onto these, so
  * the migrated code keeps the shapes it was written against (`{ data, status }`
@@ -16,6 +17,9 @@ import { type ComponentType, type ReactNode } from 'react';
 import type { AtlasUser, SessionClaims } from './types';
 import { type ActiveAtlas, type GetTokenOptions } from './active-atlas';
 export { getActiveAtlas, type ActiveAtlas } from './active-atlas';
+export * from './compat-okta';
+export * from './compat-kinde';
+export * from './compat-descope';
 /** The primary email address, else the first verified one, else any. */
 export declare function primaryEmail(user: AtlasUser | null): {
     address: string;

package/dist/compat.js

@@ -1,5 +1,19 @@
 "use strict";
 'use client';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LoginRequiredError = exports.getActiveAtlas = void 0;
 exports.primaryEmail = primaryEmail;
@@ -26,7 +40,8 @@ exports.betterAuthSessionFrom = betterAuthSessionFrom;
 exports.createBetterAuthCompatClient = createBetterAuthCompatClient;
 /**
  * Drop-in compatibility helpers for apps moving to Atlas from Auth.js (NextAuth),
- * Auth0 (auth0-react / nextjs-auth0), Supabase Auth and Better Auth.
+ * Auth0 (auth0-react / nextjs-auth0), Supabase Auth, Better Auth, Okta (okta-react /
+ * okta-auth-js), Kinde and Descope.
  *
  * `atlas migrate code --from <vendor>` rewrites an app's imports onto these, so
  * the migrated code keeps the shapes it was written against (`{ data, status }`
@@ -44,6 +59,9 @@ const components_shared_1 = require("./components-shared");
 const active_atlas_1 = require("./active-atlas");
 var active_atlas_2 = require("./active-atlas");
 Object.defineProperty(exports, "getActiveAtlas", { enumerable: true, get: function () { return active_atlas_2.getActiveAtlas; } });
+__exportStar(require("./compat-okta"), exports);
+__exportStar(require("./compat-kinde"), exports);
+__exportStar(require("./compat-descope"), exports);
 // ---- shared user projection --------------------------------------------------
 /** The primary email address, else the first verified one, else any. */
 function primaryEmail(user) {