@atlasauth/svelte 0.1.0

package/dist/context.d.ts

@@ -0,0 +1,105 @@
+import { type Readable } from 'svelte/store';
+import { type ProviderToken } from '@atlasauth/js';
+import { type Catalog } from './i18n';
+import type { Appearance } from './appearance';
+import type { AtlasOrganizationMembership, AtlasSession, AtlasUser, SessionClaims } from './types';
+/**
+ * §10.1 the Svelte peer of React's `<AtlasProvider>`.
+ *
+ * React installs the auth engine through a context provider component and hands
+ * state out via hooks. The Svelte idiom is the same shape turned inside out: the
+ * engine is a plain controller whose reactive state is exposed as Svelte
+ * **stores**, installed into component context by {@link initAtlas} so the
+ * accessors ({@link useAtlas}, {@link getUser}, …) can `getContext` it back.
+ *
+ * It holds exactly one thing that matters: the token, in memory. Not
+ * localStorage, not a cookie this code writes — the refresh token is HttpOnly so
+ * browser script never touches it, and the short-lived JWT lives only as long as
+ * the tab. Persisting either would survive the tab and become the thing an XSS
+ * reads first.
+ */
+export type AuthStatus = 'loading' | 'signed_in' | 'signed_out';
+/** The context key. A `Symbol` so it cannot collide with an app's own context. */
+export declare const ATLAS_KEY: unique symbol;
+export interface AtlasInitOptions {
+    publishableKey: string;
+    /** The instance's FAPI origin. Empty for same-origin. */
+    frontendApi?: string;
+    appearance?: Appearance;
+    localization?: Catalog;
+    fetchImpl?: typeof fetch;
+    /**
+     * Skip the automatic browser boot (redirect handling + `/v1/client` load).
+     * Useful in tests, or when the caller wants to drive `boot()` by hand.
+     */
+    manualBoot?: boolean;
+}
+/**
+ * The reactive surface. Every field is a Svelte store, so `$user`, `$session`,
+ * `$isSignedIn` work in a `.svelte` template and `get(user)` works in plain TS.
+ */
+export interface AtlasStores {
+    /** `'loading' | 'signed_in' | 'signed_out'`. */
+    status: Readable<AuthStatus>;
+    user: Readable<AtlasUser | null>;
+    session: Readable<AtlasSession | null>;
+    claims: Readable<SessionClaims | null>;
+    memberships: Readable<AtlasOrganizationMembership[]>;
+    /** `status === 'signed_in'`. */
+    isSignedIn: Readable<boolean>;
+    /** `status !== 'loading'` — the guard against a flash of signed-out content. */
+    isLoaded: Readable<boolean>;
+}
+export interface AtlasClient extends AtlasStores {
+    publishableKey: string;
+    frontendApi: string;
+    appearance?: Appearance;
+    catalog: Catalog;
+    /**
+     * §5.3: a sign-in attempt handed back by an OAuth redirect that still needs a
+     * second factor (no session was issued). Null in the ordinary case. `<SignIn>`
+     * seeds itself from this so the user resumes at the 2FA step.
+     */
+    pendingAttempt: {
+        id: string;
+        status: string;
+    } | null;
+    getToken(): Promise<string | null>;
+    /**
+     * §6.6 the signed-in user's OWN live token at a connected provider (Google,
+     * GitHub, …). Null when there is no usable token. The refresh token is never
+     * exposed; the server refreshes a stale token on read.
+     */
+    getProviderToken(provider: string): Promise<ProviderToken | null>;
+    signOut(): Promise<void>;
+    setActiveOrganization(organizationId: string | null): Promise<void>;
+    reload(): Promise<void>;
+    /**
+     * Redirect handling + the first `/v1/client` load. Runs once, in the browser
+     * only. {@link initAtlas} calls it automatically unless `manualBoot` is set;
+     * `<AtlasProvider>` also calls it in `onMount`, and a second call is a no-op.
+     */
+    boot(): Promise<void>;
+    /** Cancel the scheduled refresh — call from a component's `onDestroy`. */
+    destroy(): void;
+}
+/**
+ * Build the auth controller. Framework-agnostic aside from the Svelte stores it
+ * exposes; {@link initAtlas} is the thin wrapper that also `setContext`s it.
+ */
+export declare function createAtlasClient(options: AtlasInitOptions): AtlasClient;
+/**
+ * Install the Atlas client into Svelte component context and return it.
+ *
+ * Call from the `<script>` of a top-level component (or `<AtlasProvider>`), the
+ * peer of mounting React's `<AtlasProvider>`. Everything below in the tree can
+ * then reach the stores and actions through {@link useAtlas} and friends.
+ */
+export declare function initAtlas(options: AtlasInitOptions): AtlasClient;
+/**
+ * The installed client, from any descendant of a component that called
+ * {@link initAtlas}. Throws rather than returning a null-ish default: a store of
+ * `null` outside the provider is indistinguishable from a signed-out user, and
+ * the developer spends an afternoon on it.
+ */
+export declare function useAtlas(): AtlasClient;

package/dist/context.js

@@ -0,0 +1,258 @@
+import { getContext, setContext } from 'svelte';
+import { derived, get, writable } from 'svelte/store';
+import { FapiClient, TokenCache, getProviderToken as fetchProviderToken, msUntilRefresh, readExpiry, readRedirectResult, stripRedirectParams, } from '@atlasauth/js';
+import { EN_US, withFallback } from './i18n';
+/** The context key. A `Symbol` so it cannot collide with an app's own context. */
+export const ATLAS_KEY = Symbol('atlas');
+function decodeClaims(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        return JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build the auth controller. Framework-agnostic aside from the Svelte stores it
+ * exposes; {@link initAtlas} is the thin wrapper that also `setContext`s it.
+ */
+export function createAtlasClient(options) {
+    const { publishableKey } = options;
+    const baseUrl = options.frontendApi ?? '';
+    const doFetch = options.fetchImpl ?? (typeof fetch !== 'undefined' ? fetch : undefined);
+    const catalog = options.localization ? withFallback(options.localization) : EN_US;
+    const status = writable('loading');
+    const user = writable(null);
+    const session = writable(null);
+    const claims = writable(null);
+    const memberships = writable([]);
+    const cache = new TokenCache();
+    let timer = null;
+    let booted = false;
+    /**
+     * Captured synchronously at construction (not after boot) so it is in context
+     * before `<SignIn>` reads it — a needs_second_factor redirect carries a status
+     * but no ticket, and that is what the 2FA resume seeds from.
+     */
+    const pendingAttempt = (() => {
+        if (typeof window === 'undefined')
+            return null;
+        const result = readRedirectResult(window.location.search);
+        return result?.status && !result.ticket
+            ? { id: result.attemptId, status: result.status }
+            : null;
+    })();
+    async function call(path, init) {
+        if (!doFetch)
+            throw new Error('No fetch implementation available.');
+        return doFetch(`${baseUrl}${path}`, {
+            ...init,
+            // Cookies carry the session; a fetch without this looks identical to being
+            // signed out.
+            credentials: 'include',
+            headers: {
+                'x-publishable-key': publishableKey,
+                ...(init?.body ? { 'content-type': 'application/json' } : {}),
+                ...init?.headers,
+            },
+        });
+    }
+    function applyToken(jwt, sessionId) {
+        const expiresAt = readExpiry(jwt);
+        if (!expiresAt)
+            return;
+        cache.set({ jwt, expiresAt, sessionId });
+        claims.set(decodeClaims(jwt));
+    }
+    function clearSession() {
+        cache.clear();
+        status.set('signed_out');
+        user.set(null);
+        session.set(null);
+        claims.set(null);
+        memberships.set([]);
+    }
+    function scheduleRefresh() {
+        if (timer)
+            clearTimeout(timer);
+        timer = null;
+        if (get(status) !== 'signed_in')
+            return;
+        const token = cache.peek();
+        if (!token)
+            return;
+        // §7.4: proactive, jittered refresh scheduled from the token's own expiry.
+        const delay = msUntilRefresh({ token, now: Date.now() });
+        timer = setTimeout(() => void refresh(), delay);
+    }
+    async function reload() {
+        try {
+            const response = await call('/v1/client');
+            if (!response.ok)
+                throw new Error('boot failed');
+            const body = (await response.json());
+            if (!body.session || !body.user) {
+                clearSession();
+                return;
+            }
+            user.set(body.user);
+            session.set(body.session);
+            memberships.set(body.organization_memberships ?? []);
+            if (body.jwt)
+                applyToken(body.jwt, body.session.id);
+            status.set('signed_in');
+            scheduleRefresh();
+        }
+        catch {
+            /**
+             * A failed boot is NOT signed-out. Rendering a sign-in form because the
+             * network hiccuped throws away a perfectly good session and makes the user
+             * re-authenticate for no reason.
+             */
+            status.update((current) => (current === 'loading' ? 'signed_out' : current));
+        }
+    }
+    async function refresh() {
+        const current = cache.peek();
+        if (!current)
+            return;
+        try {
+            const response = await call(`/v1/client/sessions/${current.sessionId}/tokens`, {
+                method: 'POST',
+            });
+            if (!response.ok)
+                throw new Error('refresh failed');
+            const body = (await response.json());
+            applyToken(body.jwt, body.session_id);
+            scheduleRefresh();
+        }
+        catch {
+            // The session may genuinely be gone. Re-boot rather than guess.
+            await reload();
+        }
+    }
+    async function getToken() {
+        // A 5s skew so a token that would die inside the caller's request is
+        // refreshed first rather than handed over.
+        const usable = cache.get(5_000);
+        if (usable)
+            return usable.jwt;
+        await refresh();
+        return cache.get(5_000)?.jwt ?? null;
+    }
+    const fapiClient = new FapiClient({ publishableKey, baseUrl, fetchImpl: doFetch });
+    function getProviderToken(provider) {
+        return fetchProviderToken(fapiClient, provider);
+    }
+    async function signOut() {
+        const current = cache.peek();
+        if (current) {
+            await call(`/v1/client/sessions/${current.sessionId}/revoke`, { method: 'POST' }).catch(() => undefined);
+        }
+        if (timer)
+            clearTimeout(timer);
+        timer = null;
+        clearSession();
+    }
+    async function setActiveOrganization(organizationId) {
+        const current = cache.peek();
+        if (!current)
+            return;
+        const response = await call(`/v1/client/sessions/${current.sessionId}/touch`, {
+            method: 'POST',
+            body: JSON.stringify({ active_organization_id: organizationId }),
+        });
+        if (!response.ok)
+            return;
+        const body = (await response.json());
+        // The new token carries the new org claims; re-boot would work too but costs
+        // a round trip for information already in hand.
+        applyToken(body.jwt, current.sessionId);
+        await reload();
+    }
+    async function boot() {
+        if (booted)
+            return;
+        booted = true;
+        /**
+         * §6.3 step 3: complete a redirect-based sign-in. An OAuth or hosted-page
+         * flow lands back here with a one-time ticket in the URL; exchange it for
+         * cookies, scrub the URL so a reload can't replay it, THEN boot. A redirect
+         * that only carries a `__atlas_status` (a second factor is still owed) has no
+         * ticket, so nothing is exchanged and the app boots signed-out.
+         */
+        const result = typeof window !== 'undefined' ? readRedirectResult(window.location.search) : null;
+        if (result?.ticket) {
+            await call('/v1/client/tickets/exchange', {
+                method: 'POST',
+                body: JSON.stringify({ attempt_id: result.attemptId, ticket: result.ticket }),
+            }).catch(() => undefined);
+        }
+        if (result && typeof window !== 'undefined') {
+            window.history.replaceState({}, document.title, stripRedirectParams(window.location.href));
+        }
+        await reload();
+    }
+    function destroy() {
+        if (timer)
+            clearTimeout(timer);
+        timer = null;
+    }
+    const isSignedIn = derived(status, ($status) => $status === 'signed_in');
+    const isLoaded = derived(status, ($status) => $status !== 'loading');
+    const client = {
+        publishableKey,
+        frontendApi: baseUrl,
+        appearance: options.appearance,
+        catalog,
+        pendingAttempt,
+        status: { subscribe: status.subscribe },
+        user: { subscribe: user.subscribe },
+        session: { subscribe: session.subscribe },
+        claims: { subscribe: claims.subscribe },
+        memberships: { subscribe: memberships.subscribe },
+        isSignedIn,
+        isLoaded,
+        getToken,
+        getProviderToken,
+        signOut,
+        setActiveOrganization,
+        reload,
+        boot,
+        destroy,
+    };
+    // Kick off the browser boot immediately unless the caller opts out. Guarded to
+    // the browser so SvelteKit SSR never touches window / a credentialed fetch.
+    if (!options.manualBoot && typeof window !== 'undefined') {
+        void boot();
+    }
+    return client;
+}
+/**
+ * Install the Atlas client into Svelte component context and return it.
+ *
+ * Call from the `<script>` of a top-level component (or `<AtlasProvider>`), the
+ * peer of mounting React's `<AtlasProvider>`. Everything below in the tree can
+ * then reach the stores and actions through {@link useAtlas} and friends.
+ */
+export function initAtlas(options) {
+    const client = createAtlasClient(options);
+    setContext(ATLAS_KEY, client);
+    return client;
+}
+/**
+ * The installed client, from any descendant of a component that called
+ * {@link initAtlas}. Throws rather than returning a null-ish default: a store of
+ * `null` outside the provider is indistinguishable from a signed-out user, and
+ * the developer spends an afternoon on it.
+ */
+export function useAtlas() {
+    const client = getContext(ATLAS_KEY);
+    if (!client) {
+        throw new Error('Atlas accessors must be used under a component that called initAtlas().');
+    }
+    return client;
+}

package/dist/fapi.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The FAPI client and sign-in flow driver now live in `@atlasauth/js` — the pure,
+ * framework-agnostic browser FAPI flow — so the React `<SignIn/>` and the
+ * framework-agnostic `@atlasauth/embed` widget drive the exact same endpoints
+ * through one implementation and cannot diverge in what the server sees.
+ *
+ * This module is kept as a thin re-export so every existing importer inside the
+ * React SDK (`./components`, the public barrel, the tests) keeps resolving the
+ * driver from `./fapi` unchanged.
+ */
+export { FapiClient, advance, prepareFactor, pollAttempt, shouldKeepPolling, requestForStep, flowFromPending, initialFlow, getProviderToken, type FapiClientOptions, type FapiResponse, type FlowState, type ProviderToken, } from '@atlasauth/js';

package/dist/fapi.js

@@ -0,0 +1,11 @@
+/**
+ * The FAPI client and sign-in flow driver now live in `@atlasauth/js` — the pure,
+ * framework-agnostic browser FAPI flow — so the React `<SignIn/>` and the
+ * framework-agnostic `@atlasauth/embed` widget drive the exact same endpoints
+ * through one implementation and cannot diverge in what the server sees.
+ *
+ * This module is kept as a thin re-export so every existing importer inside the
+ * React SDK (`./components`, the public barrel, the tests) keeps resolving the
+ * driver from `./fapi` unchanged.
+ */
+export { FapiClient, advance, prepareFactor, pollAttempt, shouldKeepPolling, requestForStep, flowFromPending, initialFlow, getProviderToken, } from '@atlasauth/js';

package/dist/i18n.d.ts

@@ -0,0 +1,23 @@
+/**
+ * §10.3: "Every string passes through an i18n catalog; en-US ships, catalog
+ * format documented for community locales."
+ *
+ * A flat key-to-string map rather than nested objects, because nesting looks
+ * tidier and makes a missing key a runtime crash on `undefined.of.a.chain`
+ * rather than a visible fallback.
+ *
+ * A missing key renders the KEY, not an empty string. A blank button is a bug
+ * nobody can report; a button reading `signIn.submit` is one anyone can.
+ */
+export type Catalog = Record<string, string>;
+export declare const EN_US: Catalog;
+/**
+ * Look up a key and interpolate `{placeholders}`.
+ *
+ * An unknown placeholder is left visible for the same reason a missing key is:
+ * `Continue with {provider}` in the UI is a bug report waiting to be filed,
+ * whereas `Continue with ` is one nobody notices until a customer does.
+ */
+export declare function translate(catalog: Catalog, key: string, variables?: Record<string, string>): string;
+/** Merge a community locale over en-US so a partial translation still renders. */
+export declare function withFallback(locale: Catalog): Catalog;

package/dist/i18n.js

@@ -0,0 +1,77 @@
+/**
+ * §10.3: "Every string passes through an i18n catalog; en-US ships, catalog
+ * format documented for community locales."
+ *
+ * A flat key-to-string map rather than nested objects, because nesting looks
+ * tidier and makes a missing key a runtime crash on `undefined.of.a.chain`
+ * rather than a visible fallback.
+ *
+ * A missing key renders the KEY, not an empty string. A blank button is a bug
+ * nobody can report; a button reading `signIn.submit` is one anyone can.
+ */
+export const EN_US = {
+    'signIn.title': 'Sign in',
+    'signIn.subtitle': 'to continue to {application}',
+    'signIn.identifierLabel': 'Email address',
+    'signIn.passwordLabel': 'Password',
+    'signIn.submit': 'Continue',
+    'signIn.forgotPassword': 'Forgot password?',
+    'signIn.noAccount': 'No account?',
+    'signIn.signUpLink': 'Sign up',
+    'signIn.orDivider': 'or',
+    'signIn.socialButton': 'Continue with {provider}',
+    'signIn.emailCodeLabel': 'Verification code',
+    'signIn.magicLinkSent': 'Check your email for a sign-in link.',
+    'signIn.checkOtherTab': 'You can close this tab — you are signed in where you started.',
+    'signUp.title': 'Create your account',
+    'signUp.submit': 'Continue',
+    'signUp.haveAccount': 'Already have an account?',
+    'signUp.signInLink': 'Sign in',
+    'mfa.title': 'Two-step verification',
+    'mfa.subtitle': 'Enter the code from your authenticator app.',
+    'mfa.codeLabel': 'Code',
+    'mfa.enrollFirstCodeLabel': 'Code from your authenticator app',
+    'mfa.enrollSecondCodeLabel': 'The next code it shows',
+    'mfa.usePasskey': 'Use a passkey instead',
+    'mfa.useBackupCode': 'Use a recovery code',
+    'mfa.submit': 'Verify',
+    'reset.title': 'Reset your password',
+    'reset.submit': 'Send reset code',
+    'reset.newPasswordLabel': 'New password',
+    'userButton.manageAccount': 'Manage account',
+    'userButton.signOut': 'Sign out',
+    'userButton.signOutAll': 'Sign out of all devices',
+    'userProfile.title': 'Account',
+    'userProfile.profileSection': 'Profile',
+    'userProfile.emailsSection': 'Email addresses',
+    'userProfile.securitySection': 'Security',
+    'userProfile.devicesSection': 'Active devices',
+    'userProfile.dangerSection': 'Danger zone',
+    'userProfile.addEmail': 'Add an email address',
+    'userProfile.makePrimary': 'Make primary',
+    'userProfile.unverified': 'Unverified',
+    'userProfile.revokeDevice': 'Sign out',
+    'userProfile.deleteAccount': 'Delete account',
+    'organization.switcher': 'Switch organization',
+    'organization.personal': 'Personal account',
+    'organization.members': 'Members',
+    'organization.invite': 'Invite member',
+    'organization.roleLabel': 'Role',
+    'error.generic': 'Something went wrong. Please try again.',
+    'error.network': 'We could not reach the server. Check your connection.',
+};
+/**
+ * Look up a key and interpolate `{placeholders}`.
+ *
+ * An unknown placeholder is left visible for the same reason a missing key is:
+ * `Continue with {provider}` in the UI is a bug report waiting to be filed,
+ * whereas `Continue with ` is one nobody notices until a customer does.
+ */
+export function translate(catalog, key, variables = {}) {
+    const template = catalog[key] ?? EN_US[key] ?? key;
+    return template.replace(/\{(\w+)\}/g, (match, name) => variables[name] ?? match);
+}
+/** Merge a community locale over en-US so a partial translation still renders. */
+export function withFallback(locale) {
+    return { ...EN_US, ...locale };
+}

package/dist/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `@atlasauth/svelte` — the official Svelte / SvelteKit SDK for Atlas.
+ *
+ * The Svelte peer of `@atlasauth/react`: the same surface, expressed as Svelte
+ * stores, context, and `.svelte` components. Install the client with
+ * {@link initAtlas} (or `<AtlasProvider>`), read reactive state through the
+ * accessors, and gate UI with the components.
+ *
+ * The SvelteKit server helper (`handleAtlas`, `getServerAuth`) lives at the
+ * separate `@atlasauth/svelte/server` entry — it depends on `@atlasauth/backend` and
+ * must never be pulled into a browser bundle.
+ */
+export * from './appearance';
+export * from './protect';
+export * from './i18n';
+export * from './types';
+export * from './fapi';
+export { ATLAS_KEY, initAtlas, createAtlasClient, useAtlas, type AuthStatus, type AtlasInitOptions, type AtlasStores, type AtlasClient, } from './context';
+export { getUser, getSession, getAuth, getOrganization, getToken, signIn, signUp, signOut, type UseUser, type UseSession, type UseAuth, type UseOrganization, type FlowController, } from './accessors';
+export { default as AtlasProvider } from './components/AtlasProvider.svelte';
+export { default as SignedIn } from './components/SignedIn.svelte';
+export { default as SignedOut } from './components/SignedOut.svelte';
+export { default as AtlasLoading } from './components/AtlasLoading.svelte';
+export { default as AtlasLoaded } from './components/AtlasLoaded.svelte';
+export { default as Protect } from './components/Protect.svelte';
+export { default as SignIn } from './components/SignIn.svelte';
+export { default as SignUp } from './components/SignUp.svelte';
+export { default as UserButton } from './components/UserButton.svelte';
+export { default as UserProfile } from './components/UserProfile.svelte';
+export { default as OrganizationSwitcher } from './components/OrganizationSwitcher.svelte';
+export { default as OrganizationProfile } from './components/OrganizationProfile.svelte';

package/dist/index.js

@@ -0,0 +1,35 @@
+/**
+ * `@atlasauth/svelte` — the official Svelte / SvelteKit SDK for Atlas.
+ *
+ * The Svelte peer of `@atlasauth/react`: the same surface, expressed as Svelte
+ * stores, context, and `.svelte` components. Install the client with
+ * {@link initAtlas} (or `<AtlasProvider>`), read reactive state through the
+ * accessors, and gate UI with the components.
+ *
+ * The SvelteKit server helper (`handleAtlas`, `getServerAuth`) lives at the
+ * separate `@atlasauth/svelte/server` entry — it depends on `@atlasauth/backend` and
+ * must never be pulled into a browser bundle.
+ */
+// Theming, i18n, authorization, and shared types (identical to @atlasauth/react).
+export * from './appearance';
+export * from './protect';
+export * from './i18n';
+export * from './types';
+export * from './fapi';
+// The client, context install, and the base accessor.
+export { ATLAS_KEY, initAtlas, createAtlasClient, useAtlas, } from './context';
+// Store accessors (peers of the React hooks) and action helpers.
+export { getUser, getSession, getAuth, getOrganization, getToken, signIn, signUp, signOut, } from './accessors';
+// Components.
+export { default as AtlasProvider } from './components/AtlasProvider.svelte';
+export { default as SignedIn } from './components/SignedIn.svelte';
+export { default as SignedOut } from './components/SignedOut.svelte';
+export { default as AtlasLoading } from './components/AtlasLoading.svelte';
+export { default as AtlasLoaded } from './components/AtlasLoaded.svelte';
+export { default as Protect } from './components/Protect.svelte';
+export { default as SignIn } from './components/SignIn.svelte';
+export { default as SignUp } from './components/SignUp.svelte';
+export { default as UserButton } from './components/UserButton.svelte';
+export { default as UserProfile } from './components/UserProfile.svelte';
+export { default as OrganizationSwitcher } from './components/OrganizationSwitcher.svelte';
+export { default as OrganizationProfile } from './components/OrganizationProfile.svelte';

package/dist/protect.d.ts

@@ -0,0 +1,18 @@
+/**
+ * §10.2 `<Protect permission="org:sys_memberships:manage">` — conditional
+ * rendering.
+ *
+ * The rule that makes this safe to ship: this is a RENDERING helper, never an
+ * authorization boundary. It decides what a user sees, and seeing is not doing.
+ * Anyone can open devtools and flip the condition; the only thing that stops
+ * them acting is the server checking the same permission on the request.
+ *
+ * That is worth stating loudly because the component reads like a guard, and a
+ * developer who believes it is one will eventually put a delete button behind
+ * it and no check behind the endpoint.
+ *
+ * The evaluation logic lives in `@atlasauth/authz` — the ONE primitive every SDK
+ * (backend, Next.js, React, React Native, JS) shares, so `<Protect>` here and
+ * `auth().has()` on the server judge a condition identically.
+ */
+export { type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, } from '@atlasauth/authz';

package/dist/protect.js

@@ -0,0 +1,18 @@
+/**
+ * §10.2 `<Protect permission="org:sys_memberships:manage">` — conditional
+ * rendering.
+ *
+ * The rule that makes this safe to ship: this is a RENDERING helper, never an
+ * authorization boundary. It decides what a user sees, and seeing is not doing.
+ * Anyone can open devtools and flip the condition; the only thing that stops
+ * them acting is the server checking the same permission on the request.
+ *
+ * That is worth stating loudly because the component reads like a guard, and a
+ * developer who believes it is one will eventually put a delete button behind
+ * it and no check behind the endpoint.
+ *
+ * The evaluation logic lives in `@atlasauth/authz` — the ONE primitive every SDK
+ * (backend, Next.js, React, React Native, JS) shares, so `<Protect>` here and
+ * `auth().has()` on the server judge a condition identically.
+ */
+export { evaluate, hasFromClaims, } from '@atlasauth/authz';