@cedarjs/tenancy 8.0.0-canary.3541 → 8.0.0-canary.3545

package/README.md

@@ -130,17 +130,51 @@ Roles map to permissions in one place; fields ask for a permission with
 A role only gets what its list says, so a new role is one entry. Permission
 names are typed from the definitions. `withPermissions` in `getCurrentUser` gives each
 membership its permissions, which `useAuth().hasPermission()` checks inside
-`OrgScope`. Every permission is about an organization: fields about the user
+an organization route. Every permission is about an organization: fields about the user
 rather than an organization use `@requireUserAuth`.
 
 ## Web
 
-`@cedarjs/tenancy/web` exports `OrgScope`, `useCurrentOrg` and
-`getMemberships`/`hasOrgRole` for the client side: a per-organization Apollo
-client provided under organization routes, keyed by the immutable organization
-id so switching organizations never mixes caches. `useCurrentOrg().hasOrgRole`
-checks the user's role in the organization, and `OrgScope`'s `roles` and
-`unauthorized` props guard routes by it. `useAuth().hasUserRole` checks
+`@cedarjs/tenancy/web` exports `createTenancy`, a ready-made `tenancy`,
+`useCurrentOrg`, `useOrgBySlug` and `getMemberships`/`hasOrgRole` for the client
+side. Pass the tenancy to the router and put organization routes in a
+`PrivateSet`: the router renders a per-organization Apollo client, keyed by the
+immutable organization id so switching organizations never mixes caches, around
+the set's layouts and page. `useCurrentOrg().hasOrgRole` checks the user's role
+in the organization. To guard routes by it, give a `PrivateSet` `orgRoles` or
+`orgPermission`, and `unauthorized`:
+
+<!-- prettier-ignore -->
+```tsx
+import { tenancy } from 'src/tenancy'
+
+<Router useAuth={useAuth} tenancy={tenancy}>
+  <PrivateSet wrap={OrgLayout} unauthenticated="login">
+    <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
+  </PrivateSet>
+  <PrivateSet wrap={OrgLayout} unauthenticated="login" unauthorized="projects" orgRoles="owner">
+    <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
+  </PrivateSet>
+  <PrivateSet wrap={OrgLayout} unauthenticated="login" unauthorized="projects" orgPermission="members.manage">
+    <Route path="/org/{orgSlug}/members" page={MembersPage} name="members" />
+  </PrivateSet>
+</Router>
+```
+
+```tsx title="web/src/tenancy.tsx"
+import { createTenancy } from '@cedarjs/tenancy/web'
+
+export const tenancy = createTenancy({
+  notAMember: <p>You don't have access to this organization.</p>,
+})
+```
+
+The router checks the role and permission in the organization of the route's
+`orgSlug` param. A `PrivateSet` with `orgRoles` or `orgPermission` throws when
+the router has no `tenancy` or its `useOrg` finds no organization for the
+route; with the default lookup, that's a route without `{orgSlug}`. A route
+with `{orgSlug}` outside a `PrivateSet` is a public page with no organization
+context. `useAuth().hasUserRole` and `<PrivateSet userRoles>` check
 `currentUser.roles`; there's no `useAuth().hasRole` or `<PrivateSet roles>` in
-an app with tenancy. See the how-to for the full
-`<Set wrap={OrgScope}>` setup `yarn cedar setup tenancy` generates.
+an app with tenancy. See the
+how-to for the full setup `yarn cedar setup tenancy` generates.

package/dist/prismaExtension.js

@@ -135,7 +135,7 @@ function tenantScopeError(model) {
     );
   }
   return new TenantScopeError(
-    `"${model}" is tenant-owned, and the signed-in user has no organization in scope for this request. Either the request carried no \`cedar-org\` header, which queries made outside \`OrgScope\` and functions not wrapped in \`withTenancy\` do not, or the user has no membership yet and needs one before they can read tenant-owned data.`
+    `"${model}" is tenant-owned, and the signed-in user has no organization in scope for this request. Either the request carried no \`cedar-org\` header, which queries made outside an organization route and functions not wrapped in \`withTenancy\` do not, or the user has no membership yet and needs one before they can read tenant-owned data.`
   );
 }
 function requireTenantId(ctx, model) {

package/dist/web/OrgContext.d.ts

@@ -1,8 +1,8 @@
 import React from 'react';
 import type { OrgContextValue } from './types.js';
 /**
- * Carries the organization `OrgScope` resolved for the current route.
- * Read through `useCurrentOrg()`; only defined under `OrgScope`.
+ * Carries the organization the router resolved for the current route.
+ * Read through `useCurrentOrg()`; only defined under an organization route.
  */
 export declare const OrgContext: React.Context<OrgContextValue | undefined>;
 //# sourceMappingURL=OrgContext.d.ts.map

package/dist/web/createTenancy.d.ts

@@ -0,0 +1,60 @@
+import React from 'react';
+import type { Tenancy, UseOrg } from '@cedarjs/router';
+import type { OrgBySlug } from './useOrgBySlug.js';
+/**
+ * A `useOrg` for `createTenancy`: the router's `UseOrg`, but returning full
+ * memberships (see `OrgBySlug`)
+ */
+export type UseTenancyOrg = (useAuth: Parameters<UseOrg>[0], params: Record<string, string>) => OrgBySlug | null;
+export interface CreateTenancyOptions {
+    /**
+     * Finds the organization of a route, given the router's `useAuth` and the
+     * route's path params: `null` when the route isn't in an organization.
+     * By default it is the one with the route's `orgSlug` param (see
+     * `useOrgBySlug`). Use it for an organization that doesn't come from the
+     * path, such as from the host:
+     *
+     *   createTenancy({
+     *     useOrg: (useAuth) => useOrgBySlug(useAuth, subdomain()),
+     *   })
+     *
+     * It's a hook: the router calls it on every render of a private set. It
+     * returns the full memberships from `currentUser.memberships`, as
+     * `useOrgBySlug` does, since the provider needs the organization's id,
+     * slug and name.
+     */
+    useOrg?: UseTenancyOrg;
+    /** Rendered for a signed-in user who isn't a member of the organization */
+    notAMember?: React.ReactNode;
+    /**
+     * Called by `useCurrentOrg().setOrg` instead of navigating, for apps that
+     * select the organization from state rather than a URL segment.
+     */
+    onSetOrg?: (idOrSlug: string) => void;
+}
+/**
+ * Makes the `tenancy` to pass to the `Router`. The router then renders the
+ * organization's provider itself, around the layouts and page of every
+ * `PrivateSet` whose route is in an organization (by default, one with
+ * `{orgSlug}` in its path), and checks `orgRoles` and `orgPermission` on
+ * those sets.
+ *
+ * Call it once, at the top level of a module, like `web/src/tenancy.tsx`:
+ * a new tenancy on each render would remount the provider.
+ *
+ *   export const tenancy = createTenancy({
+ *     notAMember: <p>You don't have access to this organization.</p>,
+ *   })
+ *
+ *   <Router useAuth={useAuth} tenancy={tenancy}>
+ */
+export declare function createTenancy(options?: CreateTenancyOptions): Tenancy;
+/**
+ * The tenancy of an app that finds the organization with the route's
+ * `orgSlug` param and needs nothing else: `createTenancy()`. Pass it to the
+ * `Router`:
+ *
+ *   <Router useAuth={useAuth} tenancy={tenancy}>
+ */
+export declare const tenancy: Tenancy;
+//# sourceMappingURL=createTenancy.d.ts.map

package/dist/web/createTenancy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createTenancy.d.ts","sourceRoot":"","sources":["../../src/web/createTenancy.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAMzB,OAAO,KAAK,EAAoB,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AASxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAOlD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,SAAS,GAAG,IAAI,CAAA;AAErB,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CACtC;AAiJD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAwBzE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,SAAkB,CAAA"}

package/dist/web/createTenancy.js

@@ -0,0 +1,125 @@
+import { Fragment, jsx } from "react/jsx-runtime";
+import React from "react";
+import { ApolloProvider } from "@apollo/client/react";
+import { HasPermissionContext } from "@cedarjs/auth";
+import { navigate, useLocation, useParams } from "@cedarjs/router";
+import { useCreateApolloClient } from "@cedarjs/web/apollo";
+import { isOrgMembership } from "./getMemberships.js";
+import { hasOrgRole } from "./hasOrgRole.js";
+import { getOrgClient } from "./orgClients.js";
+import { OrgContext } from "./OrgContext.js";
+import { useOrgBySlug } from "./useOrgBySlug.js";
+import { getUserId, useOrgClientTeardown } from "./useOrgClientTeardown.js";
+const CEDAR_ORG_HEADER = "cedar-org";
+function OrgProviderImplementation({
+  useAuth,
+  membership: routerMembership,
+  memberships: routerMemberships,
+  notAMember,
+  onSetOrg,
+  children
+}) {
+  const params = useParams();
+  const location = useLocation();
+  const createClient = useCreateApolloClient();
+  const { currentUser } = useAuth();
+  const userId = getUserId(currentUser);
+  const membership = isOrgMembership(routerMembership) ? routerMembership : void 0;
+  const memberships = routerMemberships.filter(isOrgMembership);
+  const setOrg = React.useCallback(
+    (idOrSlug) => {
+      if (onSetOrg) {
+        onSetOrg(idOrSlug);
+        return;
+      }
+      const currentSlug = params["orgSlug"];
+      if (!currentSlug) {
+        throw new Error(
+          "useCurrentOrg().setOrg has no orgSlug route param to replace and no onSetOrg option was given to createTenancy"
+        );
+      }
+      const target = routerMemberships.filter(isOrgMembership).find(
+        (m) => m.organizationId === idOrSlug || m.organization.slug === idOrSlug
+      );
+      const nextSlug = target?.organization.slug ?? idOrSlug;
+      let replaced = false;
+      const nextPathname = location.pathname.split("/").map((segment) => {
+        if (!replaced && segment === currentSlug) {
+          replaced = true;
+          return nextSlug;
+        }
+        return segment;
+      }).join("/");
+      navigate(nextPathname + location.search + location.hash);
+    },
+    [
+      onSetOrg,
+      params,
+      routerMemberships,
+      location.pathname,
+      location.search,
+      location.hash
+    ]
+  );
+  const membershipPermissions = membership?.permissions;
+  const hasPermission = React.useCallback(
+    (permissionToCheck) => membershipPermissions?.includes(permissionToCheck) ?? false,
+    [membershipPermissions]
+  );
+  if (!membership || !userId) {
+    return /* @__PURE__ */ jsx(Fragment, { children: notAMember });
+  }
+  const org = {
+    id: membership.organizationId,
+    slug: membership.organization.slug,
+    name: membership.organization.name,
+    role: membership.role,
+    membershipId: membership.id,
+    permissions: membership.permissions ?? []
+  };
+  const orgClient = getOrgClient({
+    userId,
+    organizationId: membership.organizationId,
+    role: membership.role,
+    createClient: () => createClient({
+      headers: { [CEDAR_ORG_HEADER]: membership.organizationId }
+    })
+  });
+  const contextValue = {
+    org,
+    memberships,
+    hasOrgRole: (roles, organizationId) => hasOrgRole(memberships, roles, organizationId ?? org.id),
+    setOrg
+  };
+  return /* @__PURE__ */ jsx(ApolloProvider, { client: orgClient, children: /* @__PURE__ */ jsx(OrgContext.Provider, { value: contextValue, children: /* @__PURE__ */ jsx(HasPermissionContext.Provider, { value: hasPermission, children }) }) });
+}
+const useOrgFromParams = (useAuth, params) => useOrgBySlug(
+  useAuth,
+  Object.hasOwn(params, "orgSlug") ? params["orgSlug"] : void 0
+);
+function createTenancy(options = {}) {
+  const {
+    useOrg: useFindOrg = useOrgFromParams,
+    notAMember,
+    onSetOrg
+  } = options;
+  const useOrg = (useAuth, params) => {
+    useOrgClientTeardown(useAuth);
+    return useFindOrg(useAuth, params);
+  };
+  const OrgProvider = (props) => /* @__PURE__ */ jsx(
+    OrgProviderImplementation,
+    {
+      ...props,
+      notAMember,
+      onSetOrg
+    }
+  );
+  OrgProvider.displayName = "OrgProvider";
+  return { useOrg, OrgProvider, notAMember };
+}
+const tenancy = createTenancy();
+export {
+  createTenancy,
+  tenancy
+};

package/dist/web/findMembership.d.ts

@@ -0,0 +1,8 @@
+import type { OrgMembership } from './types.js';
+/**
+ * The membership in the organization whose slug is `orgSlug`, if the user
+ * has one. The default `useOrg` of `createTenancy` finds the organization
+ * with it.
+ */
+export declare function findMembership(memberships: readonly OrgMembership[], orgSlug: string | undefined): OrgMembership | undefined;
+//# sourceMappingURL=findMembership.d.ts.map

package/dist/web/findMembership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findMembership.d.ts","sourceRoot":"","sources":["../../src/web/findMembership.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,aAAa,EAAE,EACrC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,aAAa,GAAG,SAAS,CAM3B"}

package/dist/web/findMembership.js

@@ -0,0 +1,9 @@
+function findMembership(memberships, orgSlug) {
+  if (!orgSlug) {
+    return void 0;
+  }
+  return memberships.find((m) => m.organization.slug === orgSlug);
+}
+export {
+  findMembership
+};

package/dist/web/getMemberships.d.ts

@@ -1,4 +1,10 @@
 import type { OrgMembership } from './types.js';
+/**
+ * Type guard for one entry of `currentUser.memberships`, since `currentUser`
+ * comes from the app's own `useAuth()` and is typed as `unknown` shape at
+ * this boundary.
+ */
+export declare function isOrgMembership(value: unknown): value is OrgMembership;
 /**
  * Reads `currentUser.memberships` defensively, since `currentUser` is
  * `unknown` shape from the app's `useAuth()`. Returns `[]` when it is

package/dist/web/getMemberships.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getMemberships.d.ts","sourceRoot":"","sources":["../../src/web/getMemberships.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAmC/C;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,OAAO,GAAG,aAAa,EAAE,CAYpE"}
+{"version":3,"file":"getMemberships.d.ts","sourceRoot":"","sources":["../../src/web/getMemberships.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CA0BtE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,OAAO,GAAG,aAAa,EAAE,CAYpE"}

package/dist/web/getMemberships.js

@@ -22,5 +22,6 @@ function getMemberships(currentUser) {
   return memberships.filter(isOrgMembership);
 }
 export {
-  getMemberships
+  getMemberships,
+  isOrgMembership
 };

package/dist/web/hasOrgRole.d.ts

@@ -8,5 +8,5 @@ import type { OrgMembership } from './types.js';
  * `roles` list returns `true` when a membership exists, matching
  * `@cedarjs/tenancy`'s server-side `hasOrgRole`.
  */
-export declare function hasOrgRole(memberships: OrgMembership[] | undefined, roles: string | string[], organizationId: string): boolean;
+export declare function hasOrgRole(memberships: readonly OrgMembership[] | undefined, roles: string | string[], organizationId: string): boolean;
 //# sourceMappingURL=hasOrgRole.d.ts.map

package/dist/web/hasOrgRole.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hasOrgRole.d.ts","sourceRoot":"","sources":["../../src/web/hasOrgRole.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,aAAa,EAAE,GAAG,SAAS,EACxC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAgBT"}
+{"version":3,"file":"hasOrgRole.d.ts","sourceRoot":"","sources":["../../src/web/hasOrgRole.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,EACjD,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAgBT"}

package/dist/web/index.d.ts

@@ -1,8 +1,10 @@
+export type { CreateTenancyOptions, UseTenancyOrg } from './createTenancy.js';
+export { createTenancy, tenancy } from './createTenancy.js';
 export { getMemberships } from './getMemberships.js';
 export { hasOrgRole } from './hasOrgRole.js';
-export type { OrgScopeProps } from './OrgScope.js';
-export { OrgScope } from './OrgScope.js';
 export { clearOrgClients } from './orgClients.js';
 export type { CurrentOrgSummary, OrgContextValue, OrgMembership, } from './types.js';
 export { useCurrentOrg } from './useCurrentOrg.js';
+export type { OrgBySlug } from './useOrgBySlug.js';
+export { useOrgBySlug } from './useOrgBySlug.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/web/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/web/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/web/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/web/index.js

@@ -1,12 +1,15 @@
+import { createTenancy, tenancy } from "./createTenancy.js";
 import { getMemberships } from "./getMemberships.js";
 import { hasOrgRole } from "./hasOrgRole.js";
-import { OrgScope } from "./OrgScope.js";
 import { clearOrgClients } from "./orgClients.js";
 import { useCurrentOrg } from "./useCurrentOrg.js";
+import { useOrgBySlug } from "./useOrgBySlug.js";
 export {
-  OrgScope,
   clearOrgClients,
+  createTenancy,
   getMemberships,
   hasOrgRole,
-  useCurrentOrg
+  tenancy,
+  useCurrentOrg,
+  useOrgBySlug
 };

package/dist/web/orgClients.d.ts

@@ -2,19 +2,31 @@ import type { ApolloClient } from '@apollo/client';
 export interface GetOrgClientOptions {
     userId: string;
     organizationId: string;
+    /**
+     * The user's role in the organization. A client cached for another role is
+     * replaced, so data cached under that role doesn't outlive it, whether or
+     * not a provider was mounted to see the role change.
+     */
+    role: string;
     /** Builds a new client. Only called on a cache miss. */
     createClient: () => ApolloClient;
 }
+/**
+ * Drops, after clearing their caches, the clients of every user but
+ * `userId`, so another user's data doesn't outlive their session, also when
+ * nothing saw them sign out.
+ */
+export declare function dropOtherUsersClients(userId: string): void;
 /**
  * Returns the Apollo client for one user's membership in one organization,
  * creating and caching it on first use so returning to an organization
  * reuses its client and cache.
  */
-export declare function getOrgClient({ userId, organizationId, createClient, }: GetOrgClientOptions): ApolloClient;
+export declare function getOrgClient({ userId, organizationId, role, createClient, }: GetOrgClientOptions): ApolloClient;
 /**
  * Drops one organization's client, clearing its cache first. Called when a
- * memberships refresh shows the membership gone or its role changed, so
- * data cached under the previous authorization does not outlive it.
+ * memberships refresh shows the membership gone, so data cached under it
+ * does not outlive it. (A role change is handled by `getOrgClient`.)
  */
 export declare function dropOrgClient(userId: string, organizationId: string): Promise<void>;
 /**

package/dist/web/orgClients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgClients.d.ts","sourceRoot":"","sources":["../../src/web/orgClients.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAgBlD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,wDAAwD;IACxD,YAAY,EAAE,MAAM,YAAY,CAAA;CACjC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACN,cAAc,EACd,YAAY,GACb,EAAE,mBAAmB,GAAG,YAAY,CAYpC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAKrD"}
+{"version":3,"file":"orgClients.d.ts","sourceRoot":"","sources":["../../src/web/orgClients.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAoBlD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,YAAY,EAAE,MAAM,YAAY,CAAA;CACjC;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAO1D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACN,cAAc,EACd,IAAI,EACJ,YAAY,GACb,EAAE,mBAAmB,GAAG,YAAY,CAkBpC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAKrD"}

package/dist/web/orgClients.js

@@ -2,36 +2,50 @@ const clients = /* @__PURE__ */ new Map();
 function clientKey(userId, organizationId) {
   return `${userId}:${organizationId}`;
 }
+function dropOtherUsersClients(userId) {
+  for (const [key, entry] of clients) {
+    if (entry.userId !== userId) {
+      clients.delete(key);
+      void entry.client.clearStore();
+    }
+  }
+}
 function getOrgClient({
   userId,
   organizationId,
+  role,
   createClient
 }) {
+  dropOtherUsersClients(userId);
   const key = clientKey(userId, organizationId);
   const existing = clients.get(key);
+  if (existing?.role === role) {
+    return existing.client;
+  }
   if (existing) {
-    return existing;
+    void existing.client.clearStore();
   }
   const client = createClient();
-  clients.set(key, client);
+  clients.set(key, { userId, client, role });
   return client;
 }
 async function dropOrgClient(userId, organizationId) {
   const key = clientKey(userId, organizationId);
-  const client = clients.get(key);
-  if (!client) {
+  const entry = clients.get(key);
+  if (!entry) {
     return;
   }
   clients.delete(key);
-  await client.clearStore();
+  await entry.client.clearStore();
 }
 async function clearOrgClients() {
   const clientsToClear = Array.from(clients.values());
   clients.clear();
-  await Promise.all(clientsToClear.map((client) => client.clearStore()));
+  await Promise.all(clientsToClear.map(({ client }) => client.clearStore()));
 }
 export {
   clearOrgClients,
   dropOrgClient,
+  dropOtherUsersClients,
   getOrgClient
 };

package/dist/web/types.d.ts

@@ -20,7 +20,7 @@ export interface OrgMembership {
     };
 }
 /**
- * The organization `OrgScope` has resolved for the current route, combining
+ * The organization the router has resolved for the current route, combining
  * the matching membership with the organization it belongs to.
  */
 export interface CurrentOrgSummary {
@@ -33,7 +33,7 @@ export interface CurrentOrgSummary {
     permissions: string[];
 }
 /**
- * What `OrgScope` provides below it, read through `useCurrentOrg()`.
+ * What the organization provider provides below it, read through `useCurrentOrg()`.
  */
 export interface OrgContextValue {
     org: CurrentOrgSummary | undefined;

package/dist/web/useCurrentOrg.d.ts

@@ -1,10 +1,12 @@
 import type { OrgContextValue } from './types.js';
 /**
- * Reads the organization `OrgScope` resolved for the current route: the
+ * Reads the organization the router resolved for the current route: the
  * current organization, the full memberships snapshot, a role check scoped
  * to it, and `setOrg` to switch organizations.
  *
- * Must be called from a component rendered under `OrgScope`.
+ * Must be called from a component rendered by a `PrivateSet` whose route is
+ * in an organization (by default, one with `{orgSlug}` in its path), with
+ * `tenancy` on the `Router`.
  */
 export declare function useCurrentOrg(): OrgContextValue;
 //# sourceMappingURL=useCurrentOrg.d.ts.map

package/dist/web/useCurrentOrg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useCurrentOrg.d.ts","sourceRoot":"","sources":["../../src/web/useCurrentOrg.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,eAAe,CAQ/C"}
+{"version":3,"file":"useCurrentOrg.d.ts","sourceRoot":"","sources":["../../src/web/useCurrentOrg.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,IAAI,eAAe,CAY/C"}

package/dist/web/useCurrentOrg.js

@@ -3,7 +3,9 @@ import { OrgContext } from "./OrgContext.js";
 function useCurrentOrg() {
   const context = React.useContext(OrgContext);
   if (!context) {
-    throw new Error("useCurrentOrg must be used within an OrgScope");
+    throw new Error(
+      "useCurrentOrg must be used under an organization route: in a component rendered by a PrivateSet whose route has `{orgSlug}` in its path, with `tenancy` on the Router"
+    );
   }
   return context;
 }

package/dist/web/useOrgBySlug.d.ts

@@ -0,0 +1,20 @@
+import type { RouterOrg, UseOrg } from '@cedarjs/router';
+import type { OrgMembership } from './types.js';
+/** What `useOrgBySlug` finds: the router's organization, with full memberships */
+export interface OrgBySlug extends RouterOrg {
+    membership: OrgMembership | null;
+    memberships: OrgMembership[];
+}
+/**
+ * Finds the organization with the slug `orgSlug` in the signed-in user's
+ * `currentUser.memberships`, for a `useOrg` of `createTenancy`. It is what
+ * `createTenancy` uses by default, with the route's `orgSlug` param.
+ *
+ * Returns `null` when `orgSlug` is `undefined`, so there's no organization.
+ * Otherwise the `membership` is `null` when the user isn't signed in or isn't
+ * a member of that organization.
+ *
+ * A hook: it reads the user with the router's `useAuth`.
+ */
+export declare function useOrgBySlug(useAuth: Parameters<UseOrg>[0], orgSlug: string | undefined): OrgBySlug | null;
+//# sourceMappingURL=useOrgBySlug.d.ts.map

package/dist/web/useOrgBySlug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useOrgBySlug.d.ts","sourceRoot":"","sources":["../../src/web/useOrgBySlug.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAIxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,kFAAkF;AAClF,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,UAAU,EAAE,aAAa,GAAG,IAAI,CAAA;IAChC,WAAW,EAAE,aAAa,EAAE,CAAA;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAC9B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,SAAS,GAAG,IAAI,CAalB"}

package/dist/web/useOrgBySlug.js

@@ -0,0 +1,16 @@
+import { findMembership } from "./findMembership.js";
+import { getMemberships } from "./getMemberships.js";
+function useOrgBySlug(useAuth, orgSlug) {
+  const { isAuthenticated, currentUser } = useAuth();
+  if (orgSlug === void 0) {
+    return null;
+  }
+  const memberships = isAuthenticated ? getMemberships(currentUser) : [];
+  return {
+    membership: findMembership(memberships, orgSlug) ?? null,
+    memberships
+  };
+}
+export {
+  useOrgBySlug
+};

package/dist/web/useOrgClientTeardown.d.ts

@@ -0,0 +1,15 @@
+import type { UseOrg } from '@cedarjs/router';
+/** `currentUser.id`, which only exists when the app's `getCurrentUser` returns it */
+export declare function getUserId(currentUser: unknown): string | undefined;
+/**
+ * Clears the per-organization Apollo clients when the user signs out or
+ * changes, and drops the client of an organization the user is no longer a
+ * member of. (A role change is handled by `getOrgClient`.)
+ *
+ * It runs from the tenancy's `useOrg`, which the router calls for every
+ * private route, so it still sees the change when the organization's
+ * provider is no longer rendered because the user has signed out or left the
+ * organization.
+ */
+export declare function useOrgClientTeardown(useAuth: Parameters<UseOrg>[0]): void;
+//# sourceMappingURL=useOrgClientTeardown.d.ts.map

package/dist/web/useOrgClientTeardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useOrgClientTeardown.d.ts","sourceRoot":"","sources":["../../src/web/useOrgClientTeardown.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAmB7C,qFAAqF;AACrF,wBAAgB,SAAS,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWlE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAwDlE"}

package/dist/web/useOrgClientTeardown.js

@@ -0,0 +1,56 @@
+import React from "react";
+import { getMemberships } from "./getMemberships.js";
+import {
+  clearOrgClients,
+  dropOrgClient,
+  dropOtherUsersClients
+} from "./orgClients.js";
+function membershipRoleMap(memberships) {
+  return new Map(memberships.map((m) => [m.organizationId, m.role]));
+}
+function getUserId(currentUser) {
+  if (currentUser && typeof currentUser === "object" && "id" in currentUser && typeof currentUser.id === "string") {
+    return currentUser.id;
+  }
+  return void 0;
+}
+function useOrgClientTeardown(useAuth) {
+  const { isAuthenticated, currentUser } = useAuth();
+  const userId = getUserId(currentUser);
+  const memberships = getMemberships(currentUser);
+  const membershipSignature = memberships.map((m) => `${m.organizationId}:${m.role}`).sort().join(",");
+  const lastUserIdRef = React.useRef(userId);
+  const lastMembershipsRef = React.useRef(
+    membershipRoleMap(memberships)
+  );
+  React.useEffect(() => {
+    const previousUserId = lastUserIdRef.current;
+    const userChanged = previousUserId !== void 0 && previousUserId !== userId;
+    if (!isAuthenticated) {
+      lastUserIdRef.current = userId;
+      lastMembershipsRef.current = /* @__PURE__ */ new Map();
+      void clearOrgClients();
+      return;
+    }
+    if (userChanged && userId) {
+      lastUserIdRef.current = userId;
+      lastMembershipsRef.current = membershipRoleMap(memberships);
+      dropOtherUsersClients(userId);
+      return;
+    }
+    lastUserIdRef.current = userId;
+    const nextMemberships = membershipRoleMap(memberships);
+    if (userId) {
+      for (const organizationId of lastMembershipsRef.current.keys()) {
+        if (!nextMemberships.has(organizationId)) {
+          void dropOrgClient(userId, organizationId);
+        }
+      }
+    }
+    lastMembershipsRef.current = nextMemberships;
+  }, [isAuthenticated, userId, membershipSignature]);
+}
+export {
+  getUserId,
+  useOrgClientTeardown
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/tenancy",
-  "version": "8.0.0-canary.3541",
+  "version": "8.0.0-canary.3545",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -44,17 +44,17 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/api": "8.0.0-canary.3541",
-    "@cedarjs/context": "8.0.0-canary.3541",
-    "@cedarjs/graphql-server": "8.0.0-canary.3541"
+    "@cedarjs/api": "8.0.0-canary.3545",
+    "@cedarjs/context": "8.0.0-canary.3545",
+    "@cedarjs/graphql-server": "8.0.0-canary.3545"
   },
   "devDependencies": {
     "@apollo/client": "4.3.5",
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "8.0.0-canary.3541",
-    "@cedarjs/framework-tools": "8.0.0-canary.3541",
-    "@cedarjs/router": "8.0.0-canary.3541",
-    "@cedarjs/web": "8.0.0-canary.3541",
+    "@cedarjs/auth": "8.0.0-canary.3545",
+    "@cedarjs/framework-tools": "8.0.0-canary.3545",
+    "@cedarjs/router": "8.0.0-canary.3545",
+    "@cedarjs/web": "8.0.0-canary.3545",
     "@prisma/adapter-better-sqlite3": "7.10.1",
     "@prisma/client": "7.10.1",
     "@testing-library/dom": "10.4.2",
@@ -80,9 +80,9 @@
   },
   "peerDependencies": {
     "@apollo/client": "4.3.5",
-    "@cedarjs/auth": "8.0.0-canary.3541",
-    "@cedarjs/router": "8.0.0-canary.3541",
-    "@cedarjs/web": "8.0.0-canary.3541",
+    "@cedarjs/auth": "8.0.0-canary.3545",
+    "@cedarjs/router": "8.0.0-canary.3545",
+    "@cedarjs/web": "8.0.0-canary.3545",
     "@prisma/client": "7.10.1",
     "react": "19.3.1"
   },

package/dist/web/OrgScope.d.ts

@@ -1,50 +0,0 @@
-import React from 'react';
-import type { PermissionName, UseAuth } from '@cedarjs/auth';
-export interface OrgScopeProps {
-    /** Overrides the `orgSlug` route param. */
-    orgSlug?: string;
-    /** Rendered when the user has no membership matching the slug. */
-    notAMember?: React.ReactNode;
-    /**
-     * Only members with one of these roles in the organization get in.
-     * Checked after the organization is resolved, which `<PrivateSet roles>`
-     * around `OrgScope` can't do.
-     */
-    roles?: string | string[];
-    /**
-     * Only members whose membership has this permission get in (see
-     * `createPermissions` in `@cedarjs/tenancy`). Checked like `roles`.
-     */
-    permission?: PermissionName;
-    /**
-     * The name of the route a member without one of `roles`, or without
-     * `permission`, is redirected to. It gets the `orgSlug` param when its
-     * path has one, so it can be a page of the same organization. Without
-     * it, they get `notAMember`.
-     */
-    unauthorized?: string;
-    /**
-     * The app's `useAuth`, so `OrgScope` can read `currentUser.memberships`
-     * without importing app code. Defaults to `useNoAuth`.
-     */
-    useAuth?: UseAuth;
-    /**
-     * Called by `useCurrentOrg().setOrg` instead of navigating, for apps that
-     * select the organization from state rather than a URL segment.
-     */
-    onSetOrg?: (idOrSlug: string) => void;
-    children: React.ReactNode;
-}
-/**
- * Provides the per-organization Apollo client and `OrgContext` for the
- * organization matching `orgSlug` (a prop, or else the `orgSlug` route
- * param). Renders `notAMember` when the current user has no membership in
- * that organization (or not one with `roles`, see `unauthorized`);
- * otherwise wraps `children` in that organization's own `ApolloProvider`,
- * so every Cell, `useQuery` and `useMutation` under it carries the
- * `cedar-org` header and reads from that organization's cache. Under it,
- * `useAuth().hasPermission` checks the user's membership in that
- * organization.
- */
-export declare function OrgScope({ orgSlug: orgSlugProp, notAMember, roles, permission, unauthorized, useAuth, onSetOrg, children, }: OrgScopeProps): React.JSX.Element;
-//# sourceMappingURL=OrgScope.d.ts.map

package/dist/web/OrgScope.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"OrgScope.d.ts","sourceRoot":"","sources":["../../src/web/OrgScope.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAIzB,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAqB5D,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAwCD;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,EACvB,OAAO,EAAE,WAAW,EACpB,UAAiB,EACjB,KAAK,EACL,UAAU,EACV,YAAY,EACZ,OAAmB,EACnB,QAAQ,EACR,QAAQ,GACT,EAAE,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CA8KnC"}

package/dist/web/OrgScope.js

@@ -1,148 +0,0 @@
-import { Fragment, jsx } from "react/jsx-runtime";
-import React from "react";
-import { ApolloProvider } from "@apollo/client/react";
-import { HasPermissionContext, useNoAuth } from "@cedarjs/auth";
-import {
-  navigate,
-  Redirect,
-  routes,
-  useLocation,
-  useParams
-} from "@cedarjs/router";
-import { useCreateApolloClient } from "@cedarjs/web/apollo";
-import { getMemberships } from "./getMemberships.js";
-import { hasOrgRole } from "./hasOrgRole.js";
-import { clearOrgClients, dropOrgClient, getOrgClient } from "./orgClients.js";
-import { OrgContext } from "./OrgContext.js";
-const CEDAR_ORG_HEADER = "cedar-org";
-const toList = (roles) => Array.isArray(roles) ? roles : [roles];
-const REPLACE = { replace: true };
-function isNamedRoute(value) {
-  return typeof value === "function";
-}
-function unauthorizedPath(route, orgSlug) {
-  try {
-    return route();
-  } catch (e) {
-    if (e instanceof Error && e.message.includes("Missing parameter")) {
-      return route({ orgSlug });
-    }
-    throw e;
-  }
-}
-function membershipRoleMap(memberships) {
-  return new Map(memberships.map((m) => [m.organizationId, m.role]));
-}
-function OrgScope({
-  orgSlug: orgSlugProp,
-  notAMember = null,
-  roles,
-  permission,
-  unauthorized,
-  useAuth = useNoAuth,
-  onSetOrg,
-  children
-}) {
-  const params = useParams();
-  const location = useLocation();
-  const createClient = useCreateApolloClient();
-  const { isAuthenticated, currentUser } = useAuth();
-  const orgSlug = orgSlugProp ?? params["orgSlug"];
-  const memberships = getMemberships(currentUser);
-  const userId = currentUser && "id" in currentUser && typeof currentUser.id === "string" ? currentUser.id : void 0;
-  const membershipSignature = memberships.map((m) => `${m.organizationId}:${m.role}`).sort().join(",");
-  const lastAuthUserIdRef = React.useRef(userId);
-  const lastMembershipsRef = React.useRef(
-    membershipRoleMap(memberships)
-  );
-  const [, forceRenderAfterTeardown] = React.useReducer((c) => c + 1, 0);
-  React.useEffect(() => {
-    const previousUserId = lastAuthUserIdRef.current;
-    const userChanged = previousUserId !== void 0 && previousUserId !== userId;
-    if (!isAuthenticated || userChanged) {
-      lastAuthUserIdRef.current = userId;
-      lastMembershipsRef.current = /* @__PURE__ */ new Map();
-      void clearOrgClients();
-      forceRenderAfterTeardown();
-      return;
-    }
-    lastAuthUserIdRef.current = userId;
-    const nextMemberships = membershipRoleMap(memberships);
-    let dropped = false;
-    if (userId) {
-      for (const [organizationId, role] of lastMembershipsRef.current) {
-        const currentRole = nextMemberships.get(organizationId);
-        if (currentRole === void 0 || currentRole !== role) {
-          void dropOrgClient(userId, organizationId);
-          dropped = true;
-        }
-      }
-    }
-    lastMembershipsRef.current = nextMemberships;
-    if (dropped) {
-      forceRenderAfterTeardown();
-    }
-  }, [isAuthenticated, userId, membershipSignature]);
-  const setOrg = React.useCallback(
-    (idOrSlug) => {
-      if (onSetOrg) {
-        onSetOrg(idOrSlug);
-        return;
-      }
-      const currentSlug = params["orgSlug"];
-      if (!currentSlug) {
-        throw new Error(
-          "useCurrentOrg().setOrg has no orgSlug route param to replace and no onSetOrg prop was given to OrgScope"
-        );
-      }
-      const nextPathname = location.pathname.split("/").map((segment) => segment === currentSlug ? idOrSlug : segment).join("/");
-      navigate(nextPathname + location.search + location.hash);
-    },
-    [onSetOrg, params, location.pathname, location.search, location.hash]
-  );
-  const membership = orgSlug ? memberships.find((m) => m.organization.slug === orgSlug) : void 0;
-  const membershipPermissions = membership?.permissions;
-  const hasPermission = React.useCallback(
-    (permissionToCheck) => membershipPermissions?.includes(permissionToCheck) ?? false,
-    [membershipPermissions]
-  );
-  if (!membership || !userId || !orgSlug) {
-    return /* @__PURE__ */ jsx(Fragment, { children: notAMember });
-  }
-  const allowed = (roles === void 0 || toList(roles).includes(membership.role)) && (permission === void 0 || hasPermission(permission));
-  if (!allowed) {
-    if (!unauthorized) {
-      return /* @__PURE__ */ jsx(Fragment, { children: notAMember });
-    }
-    const route = Object.hasOwn(routes, unauthorized) ? Reflect.get(routes, unauthorized) : void 0;
-    if (!isNamedRoute(route)) {
-      throw new Error(`We could not find a route named ${unauthorized}`);
-    }
-    return /* @__PURE__ */ jsx(Redirect, { to: unauthorizedPath(route, orgSlug), options: REPLACE });
-  }
-  const org = {
-    id: membership.organizationId,
-    slug: membership.organization.slug,
-    name: membership.organization.name,
-    role: membership.role,
-    membershipId: membership.id,
-    permissions: membership.permissions ?? []
-  };
-  const orgClient = getOrgClient({
-    userId,
-    organizationId: membership.organizationId,
-    createClient: () => createClient({
-      headers: { [CEDAR_ORG_HEADER]: membership.organizationId }
-    })
-  });
-  const contextValue = {
-    org,
-    memberships,
-    hasOrgRole: (roles2, organizationId) => hasOrgRole(memberships, roles2, organizationId ?? org.id),
-    setOrg
-  };
-  return /* @__PURE__ */ jsx(ApolloProvider, { client: orgClient, children: /* @__PURE__ */ jsx(OrgContext.Provider, { value: contextValue, children: /* @__PURE__ */ jsx(HasPermissionContext.Provider, { value: hasPermission, children }) }) });
-}
-export {
-  OrgScope
-};