@axcode/axcloud-sdk 0.1.7-dev.87ea138 → 0.1.7-dev.cc5cc69

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { createContext, useContext, useMemo, useCallback, useState, useRef } from 'react';
+import { createContext, useContext, useState, useRef, useCallback, useEffect, useMemo, useLayoutEffect } from 'react';
 import { Auth0Provider, useAuth0 } from '@auth0/auth0-react';
-import { QueryClient, QueryClientProvider, useQuery, useQueryClient, useMutation } from '@tanstack/react-query';
+import { QueryClientProvider, useQuery, useQueryClient, useMutation, QueryClient } from '@tanstack/react-query';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
 
 // src/core/errors.ts
@@ -18,7 +18,7 @@ var AxCloudError = class _AxCloudError extends Error {
   }
   static fromResponse(status, body) {
     const details = typeof body === "object" ? body : void 0;
-    const message = details?.message;
+    const message = (typeof details?.message === "string" ? details.message : void 0) || (typeof details?.error === "string" ? details.error : void 0);
     switch (status) {
       case 401:
         return new _AxCloudError(
@@ -28,19 +28,9 @@ var AxCloudError = class _AxCloudError extends Error {
           details
         );
       case 403:
-        return new _AxCloudError(
-          message || "Access denied",
-          "FORBIDDEN",
-          status,
-          details
-        );
+        return new _AxCloudError(message || "Access denied", "FORBIDDEN", status, details);
       case 404:
-        return new _AxCloudError(
-          message || "Resource not found",
-          "NOT_FOUND",
-          status,
-          details
-        );
+        return new _AxCloudError(message || "Resource not found", "NOT_FOUND", status, details);
       case 422:
         return new _AxCloudError(
           message || "Validation failed",
@@ -50,19 +40,9 @@ var AxCloudError = class _AxCloudError extends Error {
         );
       default:
         if (status >= 500) {
-          return new _AxCloudError(
-            message || "Server error",
-            "SERVER_ERROR",
-            status,
-            details
-          );
+          return new _AxCloudError(message || "Server error", "SERVER_ERROR", status, details);
         }
-        return new _AxCloudError(
-          message || "An error occurred",
-          "UNKNOWN_ERROR",
-          status,
-          details
-        );
+        return new _AxCloudError(message || "An error occurred", "UNKNOWN_ERROR", status, details);
     }
   }
   static networkError(originalError) {
@@ -76,12 +56,9 @@ var AxCloudError = class _AxCloudError extends Error {
     );
   }
   static timeoutError(timeoutMs) {
-    return new _AxCloudError(
-      `Request timed out after ${timeoutMs}ms`,
-      "TIMEOUT_ERROR",
-      0,
-      { timeout: timeoutMs }
-    );
+    return new _AxCloudError(`Request timed out after ${timeoutMs}ms`, "TIMEOUT_ERROR", 0, {
+      timeout: timeoutMs
+    });
   }
 };
 function isAxCloudError(error) {
@@ -236,6 +213,130 @@ function getClient(key) {
   throw new Error("AxCloud client not found. Make sure AxCloudProvider is mounted and use useAxCloudContext() to get the client.");
 }
 
+// src/core/analytics.ts
+var EVENT_NAME_PATTERN = /^[a-z][a-z0-9_]{1,63}$/;
+var PROPERTY_KEY_PATTERN = /^[a-z][a-z0-9_]{0,47}$/;
+var SENSITIVE_PROPERTY_PATTERN = /(^|_)(auth0|email|name|password|query|search|secret|token|trace|user|userid)($|_)/;
+var EMAIL_VALUE_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var OPAQUE_SEGMENT_PATTERNS = [
+  /^[0-9a-f]{8}-[0-9a-f-]{27,}$/i,
+  /^(org|user|section|document|content|poll|invitation|invite|trace|chan)[_-][a-z0-9_-]+$/i,
+  /^[a-f0-9]{20,}$/i,
+  /^[a-z0-9_-]{32,}$/i
+];
+var scriptLoads = /* @__PURE__ */ new Map();
+function isLocalAnalyticsHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+function sanitizeAnalyticsPath(pathname, customNormalizer) {
+  const rawPath = pathname.split(/[?#]/, 1)[0] || "/";
+  const normalizedInput = rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
+  const custom = customNormalizer?.(normalizedInput);
+  if (custom === null) return null;
+  const path = custom ?? normalizedInput;
+  const cleanPath = path.split(/[?#]/, 1)[0] || "/";
+  const segments = cleanPath.split("/").map((segment) => {
+    if (!segment) return segment;
+    let decoded = segment;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+    }
+    return OPAQUE_SEGMENT_PATTERNS.some((pattern) => pattern.test(decoded)) ? ":id" : segment;
+  });
+  return segments.join("/") || "/";
+}
+function sanitizeAnalyticsEventData(data) {
+  if (!data) return void 0;
+  const sanitized = {};
+  for (const [rawKey, rawValue] of Object.entries(data).slice(0, 20)) {
+    const key = rawKey.trim().toLowerCase();
+    if (!PROPERTY_KEY_PATTERN.test(key) || SENSITIVE_PROPERTY_PATTERN.test(key)) continue;
+    if (typeof rawValue === "string") {
+      const value = rawValue.trim();
+      if (!value || value.length > 100 || EMAIL_VALUE_PATTERN.test(value)) continue;
+      sanitized[key] = value;
+      continue;
+    }
+    if (typeof rawValue === "number" && Number.isFinite(rawValue)) {
+      sanitized[key] = rawValue;
+      continue;
+    }
+    if (typeof rawValue === "boolean") sanitized[key] = rawValue;
+  }
+  return Object.keys(sanitized).length > 0 ? sanitized : void 0;
+}
+function isAllowedAnalyticsEvent(eventName, allowedEvents) {
+  return EVENT_NAME_PATTERN.test(eventName) && Boolean(allowedEvents?.includes(eventName));
+}
+async function fetchAnalyticsPublicConfig(input) {
+  const baseUrl = input.apiUrl.replace(/\/$/, "");
+  const url = new URL(`${baseUrl}/analytics/public/config`);
+  url.searchParams.set("orgId", input.orgId);
+  url.searchParams.set("siteKey", input.siteKey);
+  url.searchParams.set("stage", input.stage);
+  url.searchParams.set("hostname", input.hostname);
+  const response = await fetch(url, {
+    method: "GET",
+    headers: { Accept: "application/json" },
+    signal: input.signal
+  });
+  if (!response.ok) throw new Error(`Analytics configuration returned ${response.status}`);
+  return response.json();
+}
+function loadAnalyticsScript(config, doc = document) {
+  if (!config.enabled || !config.websiteId || !config.scriptUrl) {
+    return Promise.reject(new Error("Analytics tracker configuration is incomplete"));
+  }
+  const key = `${config.scriptUrl}|${config.websiteId}`;
+  const existingPromise = scriptLoads.get(key);
+  if (existingPromise) return existingPromise;
+  const existing = doc.querySelector(
+    `script[data-axcloud-analytics-site="${config.websiteId}"]`
+  );
+  if (existing && doc.defaultView?.umami) {
+    return Promise.resolve();
+  }
+  const promise = new Promise((resolve, reject) => {
+    const script = existing || doc.createElement("script");
+    const onLoad = () => resolve();
+    const onError = () => reject(new Error("Analytics tracker failed to load"));
+    script.addEventListener("load", onLoad, { once: true });
+    script.addEventListener("error", onError, { once: true });
+    if (!existing) {
+      script.src = config.scriptUrl;
+      script.defer = true;
+      script.dataset.websiteId = config.websiteId;
+      script.dataset.axcloudAnalyticsSite = config.websiteId;
+      script.dataset.autoTrack = String(config.autoTrack === true);
+      if (config.hostUrl) script.dataset.hostUrl = config.hostUrl;
+      if (config.domains?.length) script.dataset.domains = config.domains.join(",");
+      if (config.respectDoNotTrack !== false) script.dataset.doNotTrack = "true";
+      if (config.excludeSearch !== false) script.dataset.excludeSearch = "true";
+      if (config.excludeHash !== false) script.dataset.excludeHash = "true";
+      doc.head.appendChild(script);
+    }
+  }).catch((error) => {
+    scriptLoads.delete(key);
+    throw error;
+  });
+  scriptLoads.set(key, promise);
+  return promise;
+}
+function sendAnalyticsPageView(pathname, options, targetWindow = window) {
+  const path = sanitizeAnalyticsPath(pathname, options.normalizePath);
+  const umami = targetWindow.umami;
+  if (!path || !umami) return false;
+  umami.track({ url: path, title: targetWindow.document.title });
+  return true;
+}
+function sendAnalyticsEvent(eventName, data, allowedEvents, targetWindow = window) {
+  const umami = targetWindow.umami;
+  if (!umami || !isAllowedAnalyticsEvent(eventName, allowedEvents)) return false;
+  umami.track(eventName, sanitizeAnalyticsEventData(data));
+  return true;
+}
+
 // src/core/contentSlots.ts
 var SLOT_ATTRIBUTE_KEYS = ["slot", "field", "key", "name"];
 function getContentSlotMap(content) {
@@ -243,7 +344,7 @@ function getContentSlotMap(content) {
   for (const block of content?.blocks || []) {
     const slot = getBlockSlot(block);
     if (!slot) continue;
-    fields[slot] = blockToSlotValue(block);
+    if (!(slot in fields)) fields[slot] = blockToSlotValue(block);
   }
   return fields;
 }
@@ -252,11 +353,13 @@ function createContentSlotReader(content) {
   const value = (key, fallback) => {
     return key in fields ? fields[key] : fallback;
   };
+  const unsafeHtml = (key, fallback = "") => stringifySlotValue(value(key, fallback));
   return {
     fields,
     value,
     text: (key, fallback = "") => stringifySlotValue(value(key, fallback)),
-    html: (key, fallback = "") => stringifySlotValue(value(key, fallback)),
+    html: unsafeHtml,
+    unsafeHtml,
     list: (key, fallback = []) => slotValueToList(value(key, fallback)),
     image: (key, fallback) => slotValueToImage(value(key, fallback))
   };
@@ -531,24 +634,195 @@ function useAxCloudContext() {
   }
   return context;
 }
-var defaultQueryClient = new QueryClient({
-  defaultOptions: {
-    queries: {
-      staleTime: 1e3 * 60 * 5,
-      // 5 minutes
-      gcTime: 1e3 * 60 * 30,
-      // 30 minutes (garbage collection)
-      retry: 2,
-      refetchOnWindowFocus: false
+var NAVIGATION_EVENT = "axcloud-sdk:navigation";
+var historySubscriberCount = 0;
+var originalPushState = null;
+var originalReplaceState = null;
+function subscribeToNavigation(callback) {
+  if (typeof window === "undefined") return () => void 0;
+  if (historySubscriberCount === 0) {
+    originalPushState = window.history.pushState.bind(window.history);
+    originalReplaceState = window.history.replaceState.bind(window.history);
+    window.history.pushState = ((...args) => {
+      originalPushState?.(...args);
+      window.dispatchEvent(new Event(NAVIGATION_EVENT));
+    });
+    window.history.replaceState = ((...args) => {
+      originalReplaceState?.(...args);
+      window.dispatchEvent(new Event(NAVIGATION_EVENT));
+    });
+  }
+  historySubscriberCount += 1;
+  window.addEventListener("popstate", callback);
+  window.addEventListener(NAVIGATION_EVENT, callback);
+  return () => {
+    window.removeEventListener("popstate", callback);
+    window.removeEventListener(NAVIGATION_EVENT, callback);
+    historySubscriberCount = Math.max(0, historySubscriberCount - 1);
+    if (historySubscriberCount === 0) {
+      if (originalPushState) window.history.pushState = originalPushState;
+      if (originalReplaceState) window.history.replaceState = originalReplaceState;
+      originalPushState = null;
+      originalReplaceState = null;
     }
+  };
+}
+function doNotTrackEnabled(config) {
+  if (config.respectDoNotTrack === false || typeof navigator === "undefined") return false;
+  return navigator.doNotTrack === "1";
+}
+function useAnalyticsRuntime(config) {
+  const [enabled, setEnabled] = useState(false);
+  const [ready, setReady] = useState(false);
+  const publicConfigRef = useRef(null);
+  const optionsRef = useRef(config.analytics);
+  optionsRef.current = config.analytics;
+  const trackPageView = useCallback(
+    (pathname) => {
+      if (!ready || !optionsRef.current || typeof window === "undefined") return false;
+      return sendAnalyticsPageView(pathname || window.location.pathname, optionsRef.current);
+    },
+    [ready]
+  );
+  const track = useCallback(
+    (eventName, data) => {
+      if (!ready || typeof window === "undefined") return false;
+      return sendAnalyticsEvent(eventName, data, publicConfigRef.current?.allowedEvents);
+    },
+    [ready]
+  );
+  useEffect(() => {
+    const options = config.analytics;
+    setEnabled(false);
+    setReady(false);
+    publicConfigRef.current = null;
+    if (!options?.enabled || !options.siteKey || typeof window === "undefined") return void 0;
+    if (isLocalAnalyticsHostname(window.location.hostname) && !options.trackLocalhost)
+      return void 0;
+    const controller = new AbortController();
+    let cancelled = false;
+    let unsubscribe = () => void 0;
+    const initialize = async () => {
+      try {
+        const publicConfig = await fetchAnalyticsPublicConfig({
+          apiUrl: config.apiUrl,
+          orgId: config.orgId,
+          siteKey: options.siteKey,
+          stage: config.stage,
+          hostname: window.location.hostname,
+          signal: controller.signal
+        });
+        if (cancelled || !publicConfig.enabled || doNotTrackEnabled(publicConfig)) return;
+        publicConfigRef.current = publicConfig;
+        setEnabled(true);
+        await loadAnalyticsScript(publicConfig);
+        if (cancelled) return;
+        setReady(true);
+        if (!publicConfig.autoTrack) {
+          const trackCurrentPage = () => {
+            sendAnalyticsPageView(window.location.pathname, options);
+          };
+          trackCurrentPage();
+          unsubscribe = subscribeToNavigation(trackCurrentPage);
+        }
+      } catch (error) {
+        if (!cancelled && !(error instanceof Error && error.name === "AbortError")) {
+          setEnabled(false);
+          setReady(false);
+        }
+      }
+    };
+    void initialize();
+    return () => {
+      cancelled = true;
+      controller.abort();
+      unsubscribe();
+    };
+  }, [
+    config.analytics?.enabled,
+    config.analytics?.siteKey,
+    config.analytics?.trackLocalhost,
+    config.analytics?.normalizePath,
+    config.apiUrl,
+    config.orgId,
+    config.stage
+  ]);
+  return useMemo(
+    () => ({ enabled, ready, track, trackPageView }),
+    [enabled, ready, track, trackPageView]
+  );
+}
+function useAnalytics() {
+  return useAxCloudContext().analytics;
+}
+
+// src/react/auth/auth0Invitation.ts
+var AUTH0_INVITATION_PATTERN = /^[A-Za-z0-9_-]{1,2048}$/;
+function readAuth0InvitationAuthorizationParams(configuredOrganization, search = typeof window === "undefined" ? "" : window.location.search) {
+  if (!configuredOrganization || !search) return {};
+  const params = new URLSearchParams(search);
+  const invitation = params.get("invitation")?.trim();
+  const organization = params.get("organization")?.trim();
+  if (organization !== configuredOrganization || !invitation || !AUTH0_INVITATION_PATTERN.test(invitation)) {
+    return {};
   }
-});
+  return { invitation };
+}
+function createDefaultQueryClient() {
+  return new QueryClient({
+    defaultOptions: {
+      queries: {
+        staleTime: 1e3 * 60,
+        gcTime: 1e3 * 60 * 30,
+        retry: (failureCount, error) => {
+          if (isAxCloudError(error) && error.status >= 400 && error.status < 500) {
+            return false;
+          }
+          return failureCount < 2;
+        },
+        refetchOnWindowFocus: true
+      }
+    }
+  });
+}
+var queryClientAxCloudOwners = /* @__PURE__ */ new WeakMap();
+function createQueryClientOwnerSignature(config, subject) {
+  return JSON.stringify([
+    subject === null ? "public" : "authenticated",
+    subject,
+    config.orgId,
+    config.stage,
+    config.apiUrl,
+    config.apiKey ?? null,
+    config.auth0.domain,
+    config.auth0.clientId,
+    config.auth0.audience ?? null,
+    config.auth0.organization ?? null,
+    config.auth0.connection ?? null
+  ]);
+}
 function AxCloudInnerProvider({
   children,
   config,
+  queryClient,
   timeout
 }) {
-  const { getAccessTokenSilently, isAuthenticated } = useAuth0();
+  const { getAccessTokenSilently, isAuthenticated, isLoading, user } = useAuth0();
+  const analytics = useAnalyticsRuntime(config);
+  const [, setOwnerGeneration] = useState(0);
+  const currentSubject = isLoading ? void 0 : isAuthenticated ? user?.sub : null;
+  const currentOwnerSignature = currentSubject === void 0 ? void 0 : createQueryClientOwnerSignature(config, currentSubject);
+  const hasKnownOwner = queryClientAxCloudOwners.has(queryClient);
+  const ownerNeedsActivation = currentOwnerSignature !== void 0 && (!hasKnownOwner || queryClientAxCloudOwners.get(queryClient) !== currentOwnerSignature);
+  const clearContentCache = useCallback(() => {
+    queryClient.removeQueries({ queryKey: ["axcloud"] });
+  }, [queryClient]);
+  useLayoutEffect(() => {
+    if (currentOwnerSignature === void 0 || !ownerNeedsActivation) return;
+    clearContentCache();
+    queryClientAxCloudOwners.set(queryClient, currentOwnerSignature);
+    setOwnerGeneration((generation) => generation + 1);
+  }, [clearContentCache, currentOwnerSignature, ownerNeedsActivation, queryClient]);
   const tokenGetterRef = useRef(async () => void 0);
   tokenGetterRef.current = isAuthenticated ? async () => {
     try {
@@ -578,11 +852,17 @@ function AxCloudInnerProvider({
       client,
       orgId: config.orgId,
       stage: config.stage,
-      isPublicMode: Boolean(config.apiKey) && !isAuthenticated
+      isPublicMode: !isAuthenticated,
+      isAuthLoading: isLoading,
+      isAuthenticated,
+      authSubject: isAuthenticated ? user?.sub : void 0,
+      clearContentCache,
+      analytics
     }),
-    [config, client, isAuthenticated]
+    [config, client, isAuthenticated, isLoading, user?.sub, clearContentCache, analytics]
   );
-  return /* @__PURE__ */ jsx(AxCloudContext.Provider, { value: contextValue, children });
+  const identityReady = currentOwnerSignature !== void 0 && !ownerNeedsActivation;
+  return /* @__PURE__ */ jsx(AxCloudContext.Provider, { value: contextValue, children: identityReady ? children : null });
 }
 function AxCloudProvider({
   children,
@@ -590,19 +870,24 @@ function AxCloudProvider({
   apiUrl,
   stage = "dev",
   apiKey,
+  analytics,
   auth0,
-  queryClient = defaultQueryClient,
+  queryClient: providedQueryClient,
   timeout
 }) {
+  const [ownedQueryClient] = useState(createDefaultQueryClient);
+  const queryClient = providedQueryClient || ownedQueryClient;
+  const invitationAuthorizationParams = readAuth0InvitationAuthorizationParams(auth0.organization);
   const config = useMemo(
     () => ({
       orgId,
       apiUrl,
       stage,
       apiKey,
+      analytics,
       auth0
     }),
-    [orgId, apiUrl, stage, apiKey, auth0]
+    [orgId, apiUrl, stage, apiKey, analytics, auth0]
   );
   return /* @__PURE__ */ jsx(QueryClientProvider, { client: queryClient, children: /* @__PURE__ */ jsx(
     Auth0Provider,
@@ -611,14 +896,16 @@ function AxCloudProvider({
       clientId: auth0.clientId,
       authorizationParams: {
         redirect_uri: auth0.redirectUri,
-        audience: auth0.audience
+        audience: auth0.audience,
+        ...auth0.organization ? { organization: auth0.organization } : {},
+        ...invitationAuthorizationParams
       },
-      children: /* @__PURE__ */ jsx(AxCloudInnerProvider, { config, timeout, children })
+      children: /* @__PURE__ */ jsx(AxCloudInnerProvider, { config, queryClient, timeout, children })
     }
   ) });
 }
 function useAuth() {
-  const { config } = useAxCloudContext();
+  const { config, client, clearContentCache } = useAxCloudContext();
   const {
     isAuthenticated,
     isLoading,
@@ -631,23 +918,33 @@ function useAuth() {
   } = useAuth0();
   const login = useCallback(
     (options) => {
+      const invitationAuthorizationParams = readAuth0InvitationAuthorizationParams(
+        config.auth0.organization
+      );
       return loginWithRedirect({
         appState: {
           returnTo: options?.returnTo || window.location.pathname
-        }
+        },
+        ...config.auth0.organization ? {
+          authorizationParams: {
+            organization: config.auth0.organization,
+            ...invitationAuthorizationParams
+          }
+        } : {}
       });
     },
-    [loginWithRedirect]
+    [config.auth0.organization, loginWithRedirect]
   );
   const logout = useCallback(
     (options) => {
+      clearContentCache?.();
       return auth0Logout({
         logoutParams: {
           returnTo: options?.returnTo || window.location.origin
         }
       });
     },
-    [auth0Logout]
+    [auth0Logout, clearContentCache]
   );
   const getAccessToken = useCallback(async () => {
     try {
@@ -656,6 +953,60 @@ function useAuth() {
       return void 0;
     }
   }, [getAccessTokenSilently]);
+  const refreshUser = useCallback(async () => {
+    await getAccessTokenSilently({ cacheMode: "off" });
+    const claims = await getIdTokenClaims();
+    return claims?.email_verified === true;
+  }, [getAccessTokenSilently, getIdTokenClaims]);
+  const requestEmailVerification = useCallback(
+    async (options) => {
+      if (!isAuthenticated || !auth0User) {
+        return {
+          success: false,
+          status: "failed",
+          message: "You must be signed in to verify your email."
+        };
+      }
+      if (auth0User.email_verified === true) {
+        return {
+          success: true,
+          status: "already_verified",
+          message: "Your email address is already verified."
+        };
+      }
+      try {
+        const response = await client.post("/email/identity/verification-email", {
+          return_to: options?.returnTo || window.location.href
+        });
+        const data = response.data || {};
+        return {
+          success: true,
+          status: data.status || "sent",
+          message: data.message || "A verification email has been sent.",
+          ...data.retry_after_seconds !== void 0 ? { retryAfterSeconds: data.retry_after_seconds } : {}
+        };
+      } catch (requestError) {
+        if (isAxCloudError(requestError) && requestError.status === 429) {
+          const responseDetails = requestError.details?.details;
+          const retryAfterSeconds = Number(
+            responseDetails && typeof responseDetails === "object" ? responseDetails.retry_after_seconds : void 0
+          );
+          return {
+            success: false,
+            status: "rate_limited",
+            message: "Please wait before requesting another verification email.",
+            ...Number.isFinite(retryAfterSeconds) ? { retryAfterSeconds } : {}
+          };
+        }
+        return {
+          success: false,
+          status: "failed",
+          message: "Failed to send the verification email. Please try again."
+        };
+      }
+    },
+    [auth0User, client, isAuthenticated]
+  );
   const getAuth0Client = useCallback(() => {
     return {
       loginWithRedirect,
@@ -729,35 +1080,182 @@ function useAuth() {
       id: auth0User.sub || "",
       email: auth0User.email || "",
       name: auth0User.name || "",
-      avatar: auth0User.picture
+      avatar: auth0User.picture,
+      ...typeof auth0User.email_verified === "boolean" ? { emailVerified: auth0User.email_verified } : {}
     } : null,
+    needsEmailVerification: isAuthenticated && auth0User?.email_verified === false,
     login,
     logout,
     // Escape hatch for advanced use cases
     getAccessToken,
     getAuth0Client,
+    refreshUser,
+    requestEmailVerification,
     // Password management
     requestPasswordReset
   };
 }
+var currentUserQueryKey = (stage, orgId, subject) => ["axcloud", "user", "me", stage, orgId, subject];
+function asRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function asString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value : null;
+}
+function asStringArray(value) {
+  if (!Array.isArray(value)) return [];
+  return Array.from(new Set(value.map(asString).filter((item) => item !== null)));
+}
+function normalizeMembershipSections(rawMembership) {
+  const sections = /* @__PURE__ */ new Map();
+  const addSection = (idValue, nameValue, roleValue) => {
+    const id = asString(idValue);
+    if (!id) return;
+    const existing = sections.get(id);
+    sections.set(id, {
+      id,
+      name: asString(nameValue) || existing?.name || id,
+      role: asString(roleValue) || existing?.role || "member"
+    });
+  };
+  const directSections = rawMembership.sections;
+  if (Array.isArray(directSections)) {
+    for (const rawSection of directSections) {
+      if (typeof rawSection === "string") {
+        addSection(rawSection);
+        continue;
+      }
+      const section = asRecord(rawSection);
+      addSection(
+        section.id ?? section.sectionId ?? section.section_id,
+        section.name ?? section.sectionName ?? section.section_name,
+        section.role
+      );
+    }
+  }
+  const sectionMemberships = asRecord(
+    rawMembership.sectionMemberships ?? rawMembership.section_memberships
+  );
+  for (const [sectionId, rawSectionMembership] of Object.entries(sectionMemberships)) {
+    const sectionMembership = asRecord(rawSectionMembership);
+    addSection(
+      sectionId,
+      sectionMembership.name ?? sectionMembership.sectionName ?? sectionMembership.section_name,
+      sectionMembership.role
+    );
+  }
+  for (const sectionId of asStringArray(rawMembership.sectionIds ?? rawMembership.section_ids)) {
+    addSection(sectionId);
+  }
+  const primarySectionId = asString(rawMembership.sectionId ?? rawMembership.section_id);
+  if (primarySectionId) addSection(primarySectionId);
+  const normalized = Array.from(sections.values());
+  if (!primarySectionId) return normalized;
+  return normalized.sort((left, right) => {
+    if (left.id === primarySectionId) return -1;
+    if (right.id === primarySectionId) return 1;
+    return 0;
+  });
+}
+function normalizeMembership(rawValue) {
+  const raw = asRecord(rawValue);
+  const role = asString(raw.role) || "member";
+  const roles = asStringArray(raw.roles);
+  const sections = normalizeMembershipSections(raw);
+  const sectionId = asString(raw.sectionId ?? raw.section_id) || sections[0]?.id || null;
+  const joinedAt = asString(raw.joinedAt ?? raw.joined_at);
+  return {
+    role,
+    roles: roles.length > 0 ? roles : [role],
+    title: asString(raw.title),
+    status: asString(raw.status),
+    joinedAt,
+    memberSince: asString(raw.memberSince ?? raw.member_since) || joinedAt,
+    sectionId,
+    sectionIds: sections.map((section) => section.id),
+    sections
+  };
+}
+function normalizeCurrentUserResponse(raw, configuredOrgId) {
+  const rawMemberships = asRecord(
+    raw.organizationMemberships ?? raw.organization_memberships
+  );
+  const organizationMemberships = Object.fromEntries(
+    Object.entries(rawMemberships).map(([organizationId2, membership]) => [
+      organizationId2,
+      normalizeMembership(membership)
+    ])
+  );
+  const allOrgIds = Array.from(
+    /* @__PURE__ */ new Set([
+      ...asStringArray(raw.allOrgIds ?? raw.all_org_ids),
+      ...Object.keys(organizationMemberships)
+    ])
+  );
+  const effectiveOrganizationId = asString(
+    raw.effectiveOrganizationId ?? raw.effective_org_id
+  );
+  const primaryOrganizationId = asString(
+    raw.organizationId ?? raw.primary_org_id ?? raw.org_id
+  );
+  const organizationId = effectiveOrganizationId || primaryOrganizationId || (organizationMemberships[configuredOrgId] ? configuredOrgId : null) || allOrgIds[0] || configuredOrgId;
+  const configuredMembership = organizationMemberships[configuredOrgId];
+  const firstName = asString(raw.firstName ?? raw.first_name ?? raw.given_name) || "";
+  const lastName = asString(raw.lastName ?? raw.last_name ?? raw.family_name) || "";
+  const email = asString(raw.email) || "";
+  const createdAt = asString(raw.createdAt ?? raw.created_at) || "";
+  const updatedAt = asString(raw.updatedAt ?? raw.updated_at) || createdAt;
+  const role = configuredMembership?.role || asString(raw.role) || "member";
+  const sectionId = configuredMembership?.sectionId || asString(raw.sectionId ?? raw.section_id);
+  const permissions = asStringArray(raw.permissions ?? raw.effective_permissions);
+  const metadata = asRecord(raw.metadata);
+  return {
+    id: asString(raw.id ?? raw.userId ?? raw.user_id ?? raw.sub) || "",
+    email,
+    name: asString(raw.name) || [firstName, lastName].filter(Boolean).join(" ") || email,
+    firstName,
+    lastName,
+    title: configuredMembership?.title ?? asString(raw.title),
+    phone: asString(raw.phone ?? raw.phoneNumber ?? raw.phone_number),
+    address: asString(raw.address ?? raw.location),
+    avatar: asString(raw.avatar ?? raw.avatarUrl ?? raw.avatar_url ?? raw.picture) || void 0,
+    organizationId,
+    ...sectionId ? { sectionId } : {},
+    role,
+    permissions,
+    ...Object.keys(metadata).length > 0 ? { metadata } : {},
+    createdAt,
+    updatedAt,
+    allOrgIds,
+    organizationMemberships,
+    effectiveOrganizationId,
+    isSuperAdmin: raw.isSuperAdmin === true || raw.is_super_admin === true || asString(raw.global_role) === "super_admin" || role === "super_admin"
+  };
+}
 function useUser() {
-  const { isAuthenticated, isLoading: isAuthLoading } = useAuth0();
+  const { isAuthenticated, isLoading: isAuthLoading, user: auth0User } = useAuth0();
   const { client, stage, orgId } = useAxCloudContext();
+  const queryKey = currentUserQueryKey(stage, orgId, auth0User?.sub);
   const query = useQuery({
-    queryKey: ["axcloud", "user", "me", stage],
+    queryKey,
     queryFn: async () => {
-      return client.get(`/${stage}/api/users/me`);
+      const response = await client.get("/api/users/me");
+      return normalizeCurrentUserResponse(response, orgId);
     },
     enabled: isAuthenticated && !isAuthLoading,
     staleTime: 1e3 * 60 * 5
     // 5 minutes
   });
   const userData = query.data;
-  const userOrgIds = userData?.all_org_ids ?? [];
+  const userOrgIds = userData?.allOrgIds ?? [];
   const isSuperAdmin = userData?.isSuperAdmin === true;
-  const hasOrgAccess = isSuperAdmin || userOrgIds.includes(orgId);
-  const orgMembership = userData?.organization_memberships?.[orgId];
+  const orgMembership = userData?.organizationMemberships?.[orgId];
+  const hasOrgAccess = userOrgIds.includes(orgId) && orgMembership?.status?.trim().toLowerCase() === "active";
   const roleInOrg = orgMembership?.role ?? null;
+  const sectionId = orgMembership?.sectionId ?? userData?.sectionId ?? null;
+  const sections = orgMembership?.sections?.length ? orgMembership.sections : sectionId ? [{ id: sectionId, name: sectionId, role: roleInOrg ?? "member" }] : [];
+  const section = sections.find((item) => item.id === sectionId) ?? sections[0] ?? null;
+  const memberSince = orgMembership?.memberSince ?? null;
   return {
     user: query.data ?? null,
     isLoading: isAuthLoading || query.isLoading,
@@ -767,15 +1265,35 @@ function useUser() {
     // Organization access
     hasOrgAccess,
     roleInOrg,
+    organizationMembership: orgMembership ?? null,
+    title: orgMembership?.title ?? query.data?.title ?? null,
+    section,
+    sections,
+    sectionIds: orgMembership?.sectionIds?.length ? orgMembership.sectionIds : sectionId ? [sectionId] : [],
+    joinedAt: orgMembership?.joinedAt ?? null,
+    memberSince,
     // Convenience properties
     isAuthenticated,
-    role: query.data?.role ?? null,
+    role: roleInOrg ?? query.data?.role ?? null,
     organizationId: query.data?.organizationId ?? null,
-    sectionId: query.data?.sectionId ?? null,
+    sectionId,
     permissions: query.data?.permissions ?? [],
     isSuperAdmin
   };
 }
+function useUpdateMyProfile() {
+  const { client, stage } = useAxCloudContext();
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (updates) => client.patch("/api/users/me/profile", updates),
+    onSuccess: async () => {
+      await queryClient.invalidateQueries({
+        queryKey: ["axcloud", "user", "me", stage],
+        exact: false
+      });
+    }
+  });
+}
 function useOrg() {
   const { client, orgId, stage, isPublicMode } = useAxCloudContext();
   const usePublicEndpoint = isPublicMode;
@@ -822,152 +1340,169 @@ function useOrg() {
     modules
   };
 }
-function useNews(options = {}) {
-  const { client, orgId, isPublicMode } = useAxCloudContext();
-  const {
-    page = 1,
-    pageSize = 20,
-    status = "published",
-    visibility,
-    sectionId,
-    search,
-    sortBy = "publishedAt",
-    sortOrder = "desc",
-    lang,
-    publicOnly = false
-  } = options;
-  const usePublicEndpoint = isPublicMode || publicOnly;
-  const query = useQuery({
-    queryKey: [
-      "axcloud",
-      "news",
-      orgId,
-      usePublicEndpoint,
-      page,
-      pageSize,
-      status,
-      visibility,
-      sectionId,
-      search,
-      sortBy,
-      sortOrder,
-      lang
-    ],
-    queryFn: async () => {
-      const endpoint = usePublicEndpoint ? `/content/public/${orgId}/news` : `/content/members/${orgId}/news`;
-      return client.get(endpoint, {
-        page,
-        pageSize,
-        status,
-        visibility,
-        sectionId,
-        search,
-        sortBy,
-        sortOrder,
-        lang
-      });
-    },
-    staleTime: 1e3 * 60 * 5
-    // 5 minutes
-  });
-  return {
-    data: query.data?.items ?? [],
-    total: query.data?.total ?? 0,
-    hasMore: query.data?.hasMore ?? false,
-    isLoading: query.isLoading,
-    isError: query.isError,
-    error: query.error,
-    refetch: query.refetch
-  };
+
+// src/react/contentQueryPolicy.ts
+var CONTENT_STALE_TIME_MS = 6e4;
+function shouldRetryContentRequest(failureCount, error) {
+  if (isAxCloudError(error) && error.status >= 400 && error.status < 500) {
+    return false;
+  }
+  return failureCount < 2;
+}
+function normalizeContentCollectionType(contentType) {
+  switch (contentType.toLowerCase()) {
+    case "news":
+      return "news";
+    case "page":
+    case "pages":
+      return "pages";
+    case "event":
+    case "events":
+      return "events";
+    default:
+      throw new Error(`Unsupported AxCloud content collection type: ${contentType}`);
+  }
+}
+function normalizeContentDetailType(contentType) {
+  switch (contentType.toLowerCase()) {
+    case "news":
+      return "news";
+    case "page":
+    case "pages":
+      return "page";
+    case "event":
+    case "events":
+      return "event";
+    default:
+      throw new Error(`Unsupported AxCloud content detail type: ${contentType}`);
+  }
+}
+function getContentAccessState(context, publicOnly) {
+  if (publicOnly) {
+    return { mode: "public", enabled: true, subject: "anonymous" };
+  }
+  const isLoading = context.isAuthLoading ?? false;
+  if (isLoading) {
+    return { mode: "pending", enabled: false, subject: "auth-loading" };
+  }
+  const hasExplicitAuthState = typeof context.isAuthenticated === "boolean";
+  const isAuthenticated = context.isAuthenticated ?? !context.isPublicMode;
+  if (!isAuthenticated) {
+    return { mode: "public", enabled: true, subject: "anonymous" };
+  }
+  if (hasExplicitAuthState && !context.authSubject) {
+    return { mode: "pending", enabled: false, subject: "auth-subject-pending" };
+  }
+  const subject = context.authSubject || "legacy-authenticated-session";
+  return { mode: "member", enabled: Boolean(subject), subject };
 }
-var MEMBER_ENDPOINT_TYPES = ["news", "pages", "events"];
-var PAGE_CONTENT_TYPES = ["page", "pages"];
+
+// src/react/hooks/useContent.ts
 function useContent(contentType, options = {}) {
-  const { client, orgId, isPublicMode } = useAxCloudContext();
+  const context = useAxCloudContext();
+  const { client, config, orgId, stage } = context;
+  const collectionType = normalizeContentCollectionType(contentType);
   const {
     publicOnly = false,
     page = 1,
     pageSize = 20,
-    status = "published",
-    visibility,
-    sectionId,
     search,
-    sortBy = "createdAt",
+    sortBy = collectionType === "news" ? "publishedAt" : "createdAt",
     sortOrder = "desc",
+    tags,
     lang
   } = options;
+  const access = getContentAccessState(context, publicOnly);
+  const deliveryScope = access.mode === "member" ? "members" : "public";
+  const params = {
+    page,
+    pageSize,
+    search,
+    sort: sortBy,
+    order: sortOrder,
+    tags: tags?.length ? tags.join(",") : void 0,
+    lang
+  };
   const query = useQuery({
     queryKey: [
       "axcloud",
       "content",
+      "collection",
+      stage,
+      config.apiUrl,
       orgId,
-      contentType,
-      isPublicMode,
-      publicOnly,
-      page,
-      pageSize,
-      status,
-      visibility,
-      sectionId,
-      search,
-      sortBy,
-      sortOrder,
-      lang
+      access.mode,
+      access.subject,
+      collectionType,
+      params
     ],
-    queryFn: async () => {
-      const useMemberEndpoint = !isPublicMode && !publicOnly && MEMBER_ENDPOINT_TYPES.includes(contentType);
-      const endpoint = useMemberEndpoint ? `/content/members/${orgId}/${contentType}` : `/content/public/${orgId}/${contentType}`;
-      return client.get(endpoint, {
-        page,
-        pageSize,
-        status,
-        visibility,
-        sectionId,
-        search,
-        sortBy,
-        sortOrder,
-        lang
-      });
-    },
-    staleTime: 1e3 * 60 * 5
-    // 5 minutes
+    queryFn: () => client.get(
+      `/content/${deliveryScope}/${orgId}/${collectionType}`,
+      params
+    ),
+    enabled: access.enabled,
+    staleTime: CONTENT_STALE_TIME_MS,
+    refetchOnWindowFocus: true,
+    retry: shouldRetryContentRequest
   });
+  const items = query.data?.items ?? [];
   return {
-    data: query.data?.items ?? [],
-    total: query.data?.total ?? 0,
+    data: items,
+    count: query.data?.count ?? items.length,
+    total: query.data?.total ?? items.length,
+    page: query.data?.page ?? page,
+    pageSize: query.data?.pageSize ?? pageSize,
     hasMore: query.data?.hasMore ?? false,
-    isLoading: query.isLoading,
+    nextCursor: query.data?.nextCursor,
+    isLoading: access.mode === "pending" || query.isLoading,
+    isFetching: query.isFetching,
     isError: query.isError,
     error: query.error,
     refetch: query.refetch
   };
 }
 function useContentItem(contentType, idOrSlug, options = {}) {
-  const { client, orgId, isPublicMode } = useAxCloudContext();
+  const context = useAxCloudContext();
+  const { client, config, orgId, stage } = context;
+  const detailType = normalizeContentDetailType(contentType);
   const { publicOnly = false, lang } = options;
-  const useMemberEndpoint = !isPublicMode && !publicOnly && (MEMBER_ENDPOINT_TYPES.includes(contentType) || PAGE_CONTENT_TYPES.includes(contentType));
+  const access = getContentAccessState(context, publicOnly);
+  const deliveryScope = access.mode === "member" ? "members" : "public";
   const query = useQuery({
-    queryKey: ["axcloud", "content", orgId, contentType, idOrSlug, useMemberEndpoint, lang],
-    queryFn: async () => {
-      const basePath = useMemberEndpoint ? "members" : "public";
+    queryKey: [
+      "axcloud",
+      "content",
+      "item",
+      stage,
+      config.apiUrl,
+      orgId,
+      access.mode,
+      access.subject,
+      detailType,
+      idOrSlug,
+      lang
+    ],
+    queryFn: () => {
       const encodedIdOrSlug = encodeURIComponent(idOrSlug);
-      const endpoint = PAGE_CONTENT_TYPES.includes(contentType) ? `/content/${basePath}/${orgId}/page/${encodedIdOrSlug}` : `/content/${basePath}/${orgId}/${contentType}/${encodedIdOrSlug}`;
+      const endpoint = `/content/${deliveryScope}/${orgId}/items/${detailType}/${encodedIdOrSlug}`;
       return lang ? client.get(endpoint, { lang }) : client.get(endpoint);
     },
-    enabled: !!idOrSlug,
-    staleTime: 1e3 * 60 * 5
-    // 5 minutes
+    enabled: access.enabled && Boolean(idOrSlug),
+    staleTime: CONTENT_STALE_TIME_MS,
+    refetchOnWindowFocus: true,
+    retry: shouldRetryContentRequest
   });
   return {
     data: query.data ?? null,
-    isLoading: query.isLoading,
+    isLoading: access.mode === "pending" || query.isLoading,
+    isFetching: query.isFetching,
     isError: query.isError,
     error: query.error,
     refetch: query.refetch
   };
 }
 function usePageContent(slug, options = {}) {
-  const state = useContentItem("pages", slug, options);
+  const state = useContentItem("page", slug, options);
   const reader = useMemo(() => createContentSlotReader(state.data), [state.data]);
   return {
     ...state,
@@ -975,6 +1510,11 @@ function usePageContent(slug, options = {}) {
     ...reader
   };
 }
+
+// src/react/hooks/useNews.ts
+function useNews(options = {}) {
+  return useContent("news", options);
+}
 function useMySection(options = {}) {
   const { includeMembers = true } = options;
   const { isAuthenticated } = useAuth0();
@@ -1373,6 +1913,73 @@ function useDocumentDownload(documentId) {
     refetch: query.refetch
   };
 }
+function useMemberDocuments(options) {
+  const { client, orgId } = useAxCloudContext();
+  const params = buildDocumentParams(options);
+  const folderId = options?.folderId;
+  const query = useQuery({
+    queryKey: ["axcloud", "documents", "member", "list", orgId, options],
+    queryFn: async () => {
+      return client.get(`/documents/members/${orgId}/documents`, params);
+    },
+    staleTime: 1e3 * 60 * 5
+  });
+  const allItems = query.data?.items ?? [];
+  const items = folderId ? allItems.filter((doc) => doc.folder_ids?.includes(folderId)) : allItems;
+  return {
+    documents: items,
+    items,
+    count: folderId ? items.length : query.data?.count ?? 0,
+    isLoading: query.isLoading,
+    isError: query.isError,
+    error: query.error,
+    refetch: query.refetch
+  };
+}
+function useMemberDocumentFolders() {
+  const { client, orgId } = useAxCloudContext();
+  const query = useQuery({
+    queryKey: ["axcloud", "documents", "member", "folders", orgId],
+    queryFn: async () => {
+      return client.get(
+        `/documents/members/${orgId}/document-folders`
+      );
+    },
+    staleTime: 1e3 * 60 * 5
+  });
+  return {
+    folders: query.data?.folders ?? [],
+    isLoading: query.isLoading,
+    isError: query.isError,
+    error: query.error,
+    refetch: query.refetch
+  };
+}
+function useMemberDocumentDownload(documentId) {
+  const { client, orgId } = useAxCloudContext();
+  const query = useQuery({
+    queryKey: ["axcloud", "documents", "member", "download", orgId, documentId],
+    queryFn: async () => {
+      return client.get(
+        `/documents/members/${orgId}/documents/${encodeURIComponent(documentId || "")}/download`
+      );
+    },
+    enabled: !!documentId,
+    staleTime: 1e3 * 60 * 10,
+    gcTime: 1e3 * 60 * 14
+  });
+  return {
+    url: query.data?.url ?? null,
+    documentUrl: query.data?.url ?? null,
+    filename: query.data?.filename ?? null,
+    mimeType: query.data?.mimeType ?? null,
+    expiresIn: query.data?.expiresIn ?? null,
+    isLoading: query.isLoading,
+    isError: query.isError,
+    error: query.error,
+    refetch: query.refetch
+  };
+}
 function useBarnsportMunicipalities() {
   const { client, orgId } = useAxCloudContext();
   const query = useQuery({
@@ -1409,6 +2016,24 @@ function useBarnsportSports() {
     refetch: query.refetch
   };
 }
+function useBarnsportSport(slug) {
+  const { client, orgId } = useAxCloudContext();
+  const query = useQuery({
+    queryKey: ["axcloud", "barnsport", "sport", orgId, slug],
+    queryFn: () => client.get(
+      `/barnsport/public/${orgId}/sports/${slug || ""}`
+    ),
+    enabled: Boolean(slug),
+    staleTime: 1e3 * 60 * 15
+  });
+  return {
+    sport: query.data?.sport ?? null,
+    isLoading: query.isLoading,
+    isError: query.isError,
+    error: query.error,
+    refetch: query.refetch
+  };
+}
 function useBarnsportActivities(filters = {}) {
   const { client, orgId } = useAxCloudContext();
   const params = { ...filters };
@@ -1718,6 +2343,6 @@ function LinkedAccountsList({
   ] });
 }
 
-export { AxCloudClient, AxCloudError, AxCloudProvider, LinkedAccountsList, LoginButton, LogoutButton, ModuleGate, ProtectedRoute, castVote, castVoteWithCode, checkEligibility, checkVotingCode, createClient, createContentSlotReader, createFormHelper, getBallot, getClient, getContentSlotMap, getVotingReceipt, isAxCloudError, submitForm, useAuth, useAvatar, useAxCloudContext, useBarnsportActivities, useBarnsportActivity, useBarnsportMunicipalities, useBarnsportSitemap, useBarnsportSports, useBranding, useCodeBallot, useContent, useContentItem, useDocumentDownload, useDocuments, useFormStats, useForms, useLinkedAccounts, useLogo, useMedia, useMediaList, useModuleAccess, useMySection, useNews, useOrg, usePageContent, useSections, useSubmitBarnsportInterest, useUpdateFormSubmission, useUser, userHasAllPermissions, userHasAnyPermission, userHasPermission };
+export { AxCloudClient, AxCloudError, AxCloudProvider, LinkedAccountsList, LoginButton, LogoutButton, ModuleGate, ProtectedRoute, castVote, castVoteWithCode, checkEligibility, checkVotingCode, createClient, createContentSlotReader, createFormHelper, fetchAnalyticsPublicConfig, getBallot, getClient, getContentSlotMap, getVotingReceipt, isAllowedAnalyticsEvent, isAxCloudError, isLocalAnalyticsHostname, sanitizeAnalyticsEventData, sanitizeAnalyticsPath, submitForm, useAnalytics, useAnalyticsRuntime, useAuth, useAvatar, useAxCloudContext, useBarnsportActivities, useBarnsportActivity, useBarnsportMunicipalities, useBarnsportSitemap, useBarnsportSport, useBarnsportSports, useBranding, useCodeBallot, useContent, useContentItem, useDocumentDownload, useDocuments, useFormStats, useForms, useLinkedAccounts, useLogo, useMedia, useMediaList, useMemberDocumentDownload, useMemberDocumentFolders, useMemberDocuments, useModuleAccess, useMySection, useNews, useOrg, usePageContent, useSections, useSubmitBarnsportInterest, useUpdateFormSubmission, useUpdateMyProfile, useUser, userHasAllPermissions, userHasAnyPermission, userHasPermission };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map