@authyon/auth 0.2.0-beta.0 → 0.2.0-beta.2

package/dist/react/index.cjs

@@ -0,0 +1,428 @@
+"use strict";
+"use client";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/react/index.tsx
+var react_exports = {};
+__export(react_exports, {
+  AuthyonProvider: () => AuthyonProvider,
+  AuthyonSessionController: () => AuthyonSessionController,
+  PermissionGuard: () => PermissionGuard,
+  SessionGuard: () => SessionGuard,
+  useAuthyon: () => useAuthyon,
+  useAuthyonAbility: () => useAuthyonAbility,
+  useCan: () => useCan
+});
+module.exports = __toCommonJS(react_exports);
+var import_react = require("react");
+
+// ../../internal/core/authorization/ability.ts
+var AuthyonAbility = class {
+  constructor(rules = [], detectSubjectType = defaultSubjectType) {
+    this.detectSubjectType = detectSubjectType;
+    this.listeners = /* @__PURE__ */ new Set();
+    this.currentRules = rules.map(cloneRule);
+  }
+  get rules() {
+    return this.currentRules;
+  }
+  can(action, subject, field) {
+    const subjectType = typeof subject === "string" ? subject : this.detectSubjectType(subject);
+    for (let index = this.currentRules.length - 1; index >= 0; index -= 1) {
+      const rule = this.currentRules[index];
+      if (!matchesToken(rule.action, action, "manage")) continue;
+      if (!matchesToken(rule.subject, subjectType, "all")) continue;
+      if (field && rule.fields && !rule.fields.some((value) => matchesField(value, field)))
+        continue;
+      if (rule.conditions) {
+        if (typeof subject === "string" || !matchesConditions(subject, rule.conditions)) continue;
+      }
+      return !rule.inverted;
+    }
+    return false;
+  }
+  cannot(action, subject, field) {
+    return !this.can(action, subject, field);
+  }
+  rulesFor(action, subject) {
+    return this.currentRules.filter(
+      (rule) => matchesToken(rule.action, action, "manage") && matchesToken(rule.subject, subject, "all")
+    );
+  }
+  update(rules) {
+    this.currentRules = rules.map(cloneRule);
+    for (const listener of this.listeners) listener(this.rules);
+  }
+  on(event, listener) {
+    if (event !== "updated") return () => void 0;
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+};
+function createAuthyonAbility(source = {}, options = {}) {
+  return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
+}
+function createAuthyonRules(source = {}, options = {}) {
+  const permissions = /* @__PURE__ */ new Set([
+    ...source.permissions ?? [],
+    ...source.scope?.split(/\s+/).filter(Boolean) ?? []
+  ]);
+  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
+  for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
+    rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
+  }
+  rules.push(...(options.rules ?? []).map(cloneRule));
+  return rules;
+}
+function permissionToRule(permission) {
+  const normalized = permission.trim();
+  if (!normalized) return null;
+  if (normalized === "*" || normalized === "*:*" || normalized === "all:manage") {
+    return { action: "manage", subject: "all" };
+  }
+  const separator = normalized.lastIndexOf(":");
+  if (separator <= 0 || separator === normalized.length - 1) return null;
+  const subject = normalized.slice(0, separator);
+  const action = normalized.slice(separator + 1);
+  return {
+    action: action === "*" ? "manage" : action,
+    subject: subject === "*" ? "all" : subject
+  };
+}
+function matchesToken(value, expected, wildcard) {
+  return (Array.isArray(value) ? value : [value]).some(
+    (candidate) => candidate === expected || candidate === wildcard || candidate === "*" || matchesSegments(candidate, expected)
+  );
+}
+function matchesSegments(pattern, value) {
+  const patternSegments = pattern.split(":");
+  const valueSegments = value.split(":");
+  return patternSegments.length === valueSegments.length && patternSegments.every((segment, index) => segment === "*" || segment === valueSegments[index]);
+}
+function matchesField(pattern, field) {
+  if (pattern === "*" || pattern === field) return true;
+  return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
+}
+function matchesConditions(subject, conditions) {
+  return Object.entries(conditions).every(([path, expected]) => {
+    if (path === "$and" && Array.isArray(expected)) {
+      return expected.every(
+        (condition) => matchesConditions(subject, condition)
+      );
+    }
+    if (path === "$or" && Array.isArray(expected)) {
+      return expected.some(
+        (condition) => matchesConditions(subject, condition)
+      );
+    }
+    return matchesValue(readPath(subject, path), expected);
+  });
+}
+function matchesValue(actual, expected) {
+  if (!isRecord(expected) || !Object.keys(expected).some((key) => key.startsWith("$"))) {
+    return isRecord(expected) && isRecord(actual) ? matchesConditions(actual, expected) : Object.is(actual, expected);
+  }
+  return Object.entries(expected).every(([operator, operand]) => {
+    switch (operator) {
+      case "$eq":
+        return Object.is(actual, operand);
+      case "$ne":
+        return !Object.is(actual, operand);
+      case "$in":
+        return Array.isArray(operand) && operand.some((value) => Object.is(actual, value));
+      case "$nin":
+        return Array.isArray(operand) && !operand.some((value) => Object.is(actual, value));
+      case "$gt":
+        return typeof actual === "number" && typeof operand === "number" && actual > operand;
+      case "$gte":
+        return typeof actual === "number" && typeof operand === "number" && actual >= operand;
+      case "$lt":
+        return typeof actual === "number" && typeof operand === "number" && actual < operand;
+      case "$lte":
+        return typeof actual === "number" && typeof operand === "number" && actual <= operand;
+      case "$exists":
+        return operand ? actual !== void 0 : actual === void 0;
+      default:
+        return false;
+    }
+  });
+}
+function readPath(value, path) {
+  return path.split(".").reduce((current, part) => isRecord(current) ? current[part] : void 0, value);
+}
+function defaultSubjectType(subject) {
+  const explicit = subject.__type ?? subject.type ?? subject.kind;
+  if (typeof explicit === "string") return explicit;
+  const constructorName = subject.constructor?.name;
+  return typeof constructorName === "string" ? constructorName : "Object";
+}
+function cloneRule(rule) {
+  return {
+    ...rule,
+    action: Array.isArray(rule.action) ? [...rule.action] : rule.action,
+    subject: Array.isArray(rule.subject) ? [...rule.subject] : rule.subject,
+    fields: rule.fields ? [...rule.fields] : void 0
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAbilityRule(value) {
+  return value !== null;
+}
+
+// src/session/sessionController.ts
+var SERVER_SNAPSHOT = {
+  // The server cannot inspect browser storage. Reporting unauthenticated here
+  // makes guards redirect during hydration before a persisted session can be
+  // restored and validated on the client.
+  status: "validating",
+  session: null,
+  user: null,
+  error: null
+};
+var AuthyonSessionController = class {
+  constructor(client, options = {}) {
+    this.client = client;
+    this.listeners = /* @__PURE__ */ new Set();
+    this.getSnapshot = () => this.snapshot;
+    this.getServerSnapshot = () => SERVER_SNAPSHOT;
+    this.subscribe = (listener) => {
+      this.listeners.add(listener);
+      return () => this.listeners.delete(listener);
+    };
+    this.refreshAheadMs = options.refreshAheadMs ?? 3e4;
+    if (!Number.isFinite(this.refreshAheadMs) || this.refreshAheadMs < 0) {
+      throw new Error("Authyon: `refreshAheadMs` must be a non-negative finite number");
+    }
+    const session = client.getSession();
+    this.snapshot = {
+      status: session ? "validating" : "unauthenticated",
+      session,
+      user: session?.user ?? null,
+      error: null
+    };
+  }
+  start() {
+    if (!this.unsubscribeAuth) {
+      this.unsubscribeAuth = this.client.onAuthStateChange((event) => {
+        if (event.type === "signed_out") {
+          this.cancelRefresh();
+          this.setSnapshot({
+            status: "unauthenticated",
+            session: null,
+            user: null,
+            error: null
+          });
+          return;
+        }
+        if (event.type === "session_validated") {
+          this.acceptSession(event.session);
+          return;
+        }
+        this.setSnapshot({
+          status: "validating",
+          session: event.session,
+          user: event.session.user ?? null,
+          error: null
+        });
+        void this.validate();
+      });
+    }
+    void this.validate();
+    return () => this.stop();
+  }
+  stop() {
+    this.unsubscribeAuth?.();
+    this.unsubscribeAuth = void 0;
+    this.cancelRefresh();
+  }
+  validate() {
+    if (this.validation) return this.validation;
+    const localSession = this.client.getSession();
+    if (!localSession) {
+      this.setSnapshot({
+        status: "unauthenticated",
+        session: null,
+        user: null,
+        error: null
+      });
+      return Promise.resolve(this.snapshot);
+    }
+    this.setSnapshot({ ...this.snapshot, status: "validating", error: null });
+    this.validation = this.client.validateSession().then((session) => {
+      if (session) this.acceptSession(session);
+      else {
+        this.setSnapshot({
+          status: "unauthenticated",
+          session: null,
+          user: null,
+          error: null
+        });
+      }
+      return this.snapshot;
+    }).catch((error) => {
+      this.setSnapshot({ ...this.snapshot, status: "error", error });
+      return this.snapshot;
+    }).finally(() => {
+      this.validation = void 0;
+    });
+    return this.validation;
+  }
+  async refreshNow() {
+    if (!this.client.getSession()) return this.validate();
+    try {
+      await this.client.refresh();
+    } catch (error) {
+      if (!this.client.getSession()) return this.validate();
+      this.setSnapshot({ ...this.snapshot, status: "error", error });
+      return this.snapshot;
+    }
+    return this.validate();
+  }
+  acceptSession(session) {
+    this.setSnapshot({
+      status: "authenticated",
+      session,
+      user: session.user ?? null,
+      error: null
+    });
+    this.scheduleRefresh(session);
+  }
+  scheduleRefresh(session) {
+    this.cancelRefresh();
+    const delay = Math.max(1e3, session.expiresAt - Date.now() - this.refreshAheadMs);
+    this.refreshTimer = setTimeout(() => void this.refreshNow(), delay);
+  }
+  cancelRefresh() {
+    if (this.refreshTimer !== void 0) clearTimeout(this.refreshTimer);
+    this.refreshTimer = void 0;
+  }
+  setSnapshot(snapshot) {
+    this.snapshot = snapshot;
+    for (const listener of this.listeners) listener();
+  }
+};
+
+// src/react/index.tsx
+var AuthyonReactContext = (0, import_react.createContext)(null);
+function AuthyonProvider({
+  client,
+  children,
+  refreshAheadMs,
+  validateOnFocus = true,
+  transformUser
+}) {
+  const controllerRef = (0, import_react.useRef)(null);
+  if (!controllerRef.current || controllerRef.current.client !== client) {
+    controllerRef.current = new AuthyonSessionController(client, { refreshAheadMs });
+  }
+  const controller = controllerRef.current;
+  const snapshot = (0, import_react.useSyncExternalStore)(
+    controller.subscribe,
+    controller.getSnapshot,
+    controller.getServerSnapshot
+  );
+  (0, import_react.useEffect)(() => controller.start(), [controller]);
+  (0, import_react.useEffect)(() => {
+    if (!validateOnFocus) return;
+    const validateWhenVisible = () => {
+      if (document.visibilityState === "visible") void controller.validate();
+    };
+    document.addEventListener("visibilitychange", validateWhenVisible);
+    return () => document.removeEventListener("visibilitychange", validateWhenVisible);
+  }, [controller, validateOnFocus]);
+  const exposedSnapshot = (0, import_react.useMemo)(
+    () => transformSnapshot(snapshot, transformUser),
+    [snapshot, transformUser]
+  );
+  const value = (0, import_react.useMemo)(
+    () => ({
+      ...exposedSnapshot,
+      client,
+      validateSession: async () => transformSnapshot(await controller.validate(), transformUser),
+      refreshSession: async () => transformSnapshot(await controller.refreshNow(), transformUser)
+    }),
+    [client, controller, exposedSnapshot, transformUser]
+  );
+  return (0, import_react.createElement)(AuthyonReactContext.Provider, { value }, children);
+}
+function useAuthyon() {
+  const context = (0, import_react.useContext)(AuthyonReactContext);
+  if (!context) throw new Error("Authyon: `useAuthyon` must be used inside `AuthyonProvider`");
+  return context;
+}
+function transformSnapshot(snapshot, transformUser) {
+  const mapUser = (user2) => transformUser ? transformUser(user2) : user2;
+  const user = snapshot.user ? mapUser(snapshot.user) : null;
+  const session = snapshot.session ? {
+    ...snapshot.session,
+    user: snapshot.session.user ? snapshot.session.user === snapshot.user && user ? user : mapUser(snapshot.session.user) : void 0
+  } : null;
+  return { ...snapshot, session, user };
+}
+function useAuthyonAbility(options = {}) {
+  const { user } = useAuthyon();
+  return (0, import_react.useMemo)(() => createAuthyonAbility(user ?? {}, options), [user, options]);
+}
+function useCan(action, subject, field, options) {
+  const ability = useAuthyonAbility(options);
+  return ability.can(action, subject, field);
+}
+function SessionGuard({
+  children,
+  loadingFallback = null,
+  unauthenticatedFallback = null,
+  errorFallback = null,
+  onUnauthenticated
+}) {
+  const { status } = useAuthyon();
+  (0, import_react.useEffect)(() => {
+    if (status === "unauthenticated") onUnauthenticated?.();
+  }, [onUnauthenticated, status]);
+  if (status === "validating") return loadingFallback;
+  if (status === "error") return errorFallback;
+  if (status !== "authenticated") return unauthenticatedFallback;
+  return children;
+}
+function PermissionGuard({
+  action,
+  subject,
+  field,
+  forbiddenFallback = null,
+  abilityOptions,
+  children,
+  ...sessionProps
+}) {
+  const allowed = useCan(action, subject, field, abilityOptions);
+  return (0, import_react.createElement)(SessionGuard, {
+    ...sessionProps,
+    children: allowed ? children : forbiddenFallback
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthyonProvider,
+  AuthyonSessionController,
+  PermissionGuard,
+  SessionGuard,
+  useAuthyon,
+  useAuthyonAbility,
+  useCan
+});

package/dist/react/index.d.cts

@@ -0,0 +1,47 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+import { U as User, B as SessionControllerOptions, A as AuthyonClient, E as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-g6nBpOQM.cjs';
+export { q as AuthyonSessionController, G as SessionSnapshotListener, J as SessionStatus } from '../ability-g6nBpOQM.cjs';
+
+interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
+    client: AuthyonClient;
+    children: ReactNode;
+    /** Revalidate with `/auth/me` when the tab becomes visible. Defaults to true. */
+    validateOnFocus?: boolean;
+    /** Derives the user exposed by `useAuthyon` without mutating the stored Authyon session. */
+    transformUser?: (user: User) => TUser;
+}
+type AuthyonSession<TUser extends User = User> = Omit<Session, "user"> & {
+    user?: TUser;
+};
+type AuthyonSessionSnapshot<TUser extends User = User> = Omit<SessionSnapshot, "session" | "user"> & {
+    session: AuthyonSession<TUser> | null;
+    user: TUser | null;
+};
+interface AuthyonReactContextValue<TUser extends User = User> extends AuthyonSessionSnapshot<TUser> {
+    client: AuthyonClient;
+    validateSession(): Promise<AuthyonSessionSnapshot<TUser>>;
+    refreshSession(): Promise<AuthyonSessionSnapshot<TUser>>;
+}
+declare function AuthyonProvider<TUser extends User = User>({ client, children, refreshAheadMs, validateOnFocus, transformUser, }: AuthyonProviderProps<TUser>): react.FunctionComponentElement<react.ProviderProps<AuthyonReactContextValue<User> | null>>;
+declare function useAuthyon<TUser extends User = User>(): AuthyonReactContextValue<TUser>;
+declare function useAuthyonAbility(options?: AuthyonAbilityOptions): AuthyonAbility;
+declare function useCan(action: string, subject: AbilitySubject, field?: string, options?: AuthyonAbilityOptions): boolean;
+interface SessionGuardProps {
+    children: ReactNode;
+    loadingFallback?: ReactNode;
+    unauthenticatedFallback?: ReactNode;
+    errorFallback?: ReactNode;
+    onUnauthenticated?: () => void;
+}
+declare function SessionGuard({ children, loadingFallback, unauthenticatedFallback, errorFallback, onUnauthenticated, }: SessionGuardProps): ReactNode;
+interface PermissionGuardProps extends SessionGuardProps {
+    action: string;
+    subject: AbilitySubject;
+    field?: string;
+    forbiddenFallback?: ReactNode;
+    abilityOptions?: AuthyonAbilityOptions;
+}
+declare function PermissionGuard({ action, subject, field, forbiddenFallback, abilityOptions, children, ...sessionProps }: PermissionGuardProps): react.FunctionComponentElement<SessionGuardProps>;
+
+export { AuthyonProvider, type AuthyonProviderProps, type AuthyonReactContextValue, type AuthyonSession, type AuthyonSessionSnapshot, PermissionGuard, type PermissionGuardProps, SessionControllerOptions, SessionGuard, type SessionGuardProps, SessionSnapshot, useAuthyon, useAuthyonAbility, useCan };

package/dist/react/index.d.ts

@@ -0,0 +1,47 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+import { U as User, B as SessionControllerOptions, A as AuthyonClient, E as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-g6nBpOQM.js';
+export { q as AuthyonSessionController, G as SessionSnapshotListener, J as SessionStatus } from '../ability-g6nBpOQM.js';
+
+interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
+    client: AuthyonClient;
+    children: ReactNode;
+    /** Revalidate with `/auth/me` when the tab becomes visible. Defaults to true. */
+    validateOnFocus?: boolean;
+    /** Derives the user exposed by `useAuthyon` without mutating the stored Authyon session. */
+    transformUser?: (user: User) => TUser;
+}
+type AuthyonSession<TUser extends User = User> = Omit<Session, "user"> & {
+    user?: TUser;
+};
+type AuthyonSessionSnapshot<TUser extends User = User> = Omit<SessionSnapshot, "session" | "user"> & {
+    session: AuthyonSession<TUser> | null;
+    user: TUser | null;
+};
+interface AuthyonReactContextValue<TUser extends User = User> extends AuthyonSessionSnapshot<TUser> {
+    client: AuthyonClient;
+    validateSession(): Promise<AuthyonSessionSnapshot<TUser>>;
+    refreshSession(): Promise<AuthyonSessionSnapshot<TUser>>;
+}
+declare function AuthyonProvider<TUser extends User = User>({ client, children, refreshAheadMs, validateOnFocus, transformUser, }: AuthyonProviderProps<TUser>): react.FunctionComponentElement<react.ProviderProps<AuthyonReactContextValue<User> | null>>;
+declare function useAuthyon<TUser extends User = User>(): AuthyonReactContextValue<TUser>;
+declare function useAuthyonAbility(options?: AuthyonAbilityOptions): AuthyonAbility;
+declare function useCan(action: string, subject: AbilitySubject, field?: string, options?: AuthyonAbilityOptions): boolean;
+interface SessionGuardProps {
+    children: ReactNode;
+    loadingFallback?: ReactNode;
+    unauthenticatedFallback?: ReactNode;
+    errorFallback?: ReactNode;
+    onUnauthenticated?: () => void;
+}
+declare function SessionGuard({ children, loadingFallback, unauthenticatedFallback, errorFallback, onUnauthenticated, }: SessionGuardProps): ReactNode;
+interface PermissionGuardProps extends SessionGuardProps {
+    action: string;
+    subject: AbilitySubject;
+    field?: string;
+    forbiddenFallback?: ReactNode;
+    abilityOptions?: AuthyonAbilityOptions;
+}
+declare function PermissionGuard({ action, subject, field, forbiddenFallback, abilityOptions, children, ...sessionProps }: PermissionGuardProps): react.FunctionComponentElement<SessionGuardProps>;
+
+export { AuthyonProvider, type AuthyonProviderProps, type AuthyonReactContextValue, type AuthyonSession, type AuthyonSessionSnapshot, PermissionGuard, type PermissionGuardProps, SessionControllerOptions, SessionGuard, type SessionGuardProps, SessionSnapshot, useAuthyon, useAuthyonAbility, useCan };

package/dist/react/index.js

@@ -0,0 +1,120 @@
+"use client";
+import {
+  AuthyonSessionController,
+  createAuthyonAbility
+} from "../chunk-EHZEUM47.js";
+
+// src/react/index.tsx
+import {
+  createContext,
+  createElement,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useSyncExternalStore
+} from "react";
+var AuthyonReactContext = createContext(null);
+function AuthyonProvider({
+  client,
+  children,
+  refreshAheadMs,
+  validateOnFocus = true,
+  transformUser
+}) {
+  const controllerRef = useRef(null);
+  if (!controllerRef.current || controllerRef.current.client !== client) {
+    controllerRef.current = new AuthyonSessionController(client, { refreshAheadMs });
+  }
+  const controller = controllerRef.current;
+  const snapshot = useSyncExternalStore(
+    controller.subscribe,
+    controller.getSnapshot,
+    controller.getServerSnapshot
+  );
+  useEffect(() => controller.start(), [controller]);
+  useEffect(() => {
+    if (!validateOnFocus) return;
+    const validateWhenVisible = () => {
+      if (document.visibilityState === "visible") void controller.validate();
+    };
+    document.addEventListener("visibilitychange", validateWhenVisible);
+    return () => document.removeEventListener("visibilitychange", validateWhenVisible);
+  }, [controller, validateOnFocus]);
+  const exposedSnapshot = useMemo(
+    () => transformSnapshot(snapshot, transformUser),
+    [snapshot, transformUser]
+  );
+  const value = useMemo(
+    () => ({
+      ...exposedSnapshot,
+      client,
+      validateSession: async () => transformSnapshot(await controller.validate(), transformUser),
+      refreshSession: async () => transformSnapshot(await controller.refreshNow(), transformUser)
+    }),
+    [client, controller, exposedSnapshot, transformUser]
+  );
+  return createElement(AuthyonReactContext.Provider, { value }, children);
+}
+function useAuthyon() {
+  const context = useContext(AuthyonReactContext);
+  if (!context) throw new Error("Authyon: `useAuthyon` must be used inside `AuthyonProvider`");
+  return context;
+}
+function transformSnapshot(snapshot, transformUser) {
+  const mapUser = (user2) => transformUser ? transformUser(user2) : user2;
+  const user = snapshot.user ? mapUser(snapshot.user) : null;
+  const session = snapshot.session ? {
+    ...snapshot.session,
+    user: snapshot.session.user ? snapshot.session.user === snapshot.user && user ? user : mapUser(snapshot.session.user) : void 0
+  } : null;
+  return { ...snapshot, session, user };
+}
+function useAuthyonAbility(options = {}) {
+  const { user } = useAuthyon();
+  return useMemo(() => createAuthyonAbility(user ?? {}, options), [user, options]);
+}
+function useCan(action, subject, field, options) {
+  const ability = useAuthyonAbility(options);
+  return ability.can(action, subject, field);
+}
+function SessionGuard({
+  children,
+  loadingFallback = null,
+  unauthenticatedFallback = null,
+  errorFallback = null,
+  onUnauthenticated
+}) {
+  const { status } = useAuthyon();
+  useEffect(() => {
+    if (status === "unauthenticated") onUnauthenticated?.();
+  }, [onUnauthenticated, status]);
+  if (status === "validating") return loadingFallback;
+  if (status === "error") return errorFallback;
+  if (status !== "authenticated") return unauthenticatedFallback;
+  return children;
+}
+function PermissionGuard({
+  action,
+  subject,
+  field,
+  forbiddenFallback = null,
+  abilityOptions,
+  children,
+  ...sessionProps
+}) {
+  const allowed = useCan(action, subject, field, abilityOptions);
+  return createElement(SessionGuard, {
+    ...sessionProps,
+    children: allowed ? children : forbiddenFallback
+  });
+}
+export {
+  AuthyonProvider,
+  AuthyonSessionController,
+  PermissionGuard,
+  SessionGuard,
+  useAuthyon,
+  useAuthyonAbility,
+  useCan
+};