@gusnips/react 0.4.4 → 0.4.6

package/README.md

@@ -136,6 +136,22 @@ where there is no window. A session bootstrap can only be in flight in a browser
 during a build is a wait that never ends: it once shipped a spinner as the indexable body of a
 page whose whole job was to be found.
 
+When your store needs more than those flags, `authSlice` in the same place gives you them as a
+plain object to spread, so `create` stays yours — and with it `persist`, your own actions, and
+fields of your own:
+
+```ts
+const useAuthStore = create<AuthState<User> & { isAnonymous: boolean }>((set) => ({
+  ...authSlice<User, { isAnonymous: boolean }>(set, (user) => ({
+    isAnonymous: !!user?.isAnonymous,
+  })),
+}));
+```
+
+The second argument is what makes this more than spreading extra keys in yourself: a field read
+off the user has to be rewritten whenever the user changes, and `setUser` and `clear` are the two
+writes you no longer own.
+
 `hydrateOrMount` is at `@gusnips/react/hydrate`, and the guards are at `@gusnips/react/guards`.
 
 ## On a phone
@@ -169,13 +185,13 @@ something.
 `@gusnips/react` itself needs `react`, `react-dom` and nothing else. Anything that needs more
 lives behind a subpath, so you install a dependency only if you import the thing that uses it:
 
-| Import from               | What is in it       | What you must have |
-| ------------------------- | ------------------- | ------------------ |
-| `@gusnips/react`          | the client and rest | react, react-dom   |
-| `@gusnips/react/store`    | `createAuthStore`   | zustand            |
-| `@gusnips/react/guards`   | the route guards    | react-router-dom   |
-| `@gusnips/react/ui`       | the seven wrappers  | @base-ui/react     |
-| `@gusnips/react/contract` | two prerender names | nothing            |
+| Import from               | What is in it                  | What you must have |
+| ------------------------- | ------------------------------ | ------------------ |
+| `@gusnips/react`          | the client and rest            | react, react-dom   |
+| `@gusnips/react/store`    | `createAuthStore`, `authSlice` | zustand            |
+| `@gusnips/react/guards`   | the route guards               | react-router-dom   |
+| `@gusnips/react/ui`       | the seven wrappers             | @base-ui/react     |
+| `@gusnips/react/contract` | two prerender names            | nothing            |
 
 The rule behind that table: **a peer marked optional must not be reachable from the main entry
 point.** An optional peer the barrel imports anyway is not optional — it is a required one whose

package/dist/auth-store.d.ts

@@ -46,4 +46,35 @@ export interface AuthState<TUser> {
  * Only one of the three donors knew this. It is invariant 7.
  */
 export declare function createAuthStore<TUser>(): UseBoundStore<StoreApi<AuthState<TUser>>>;
+/**
+ * zustand's `set`, narrowed to the two writes this slice makes.
+ *
+ * Not `Partial<AuthState<TUser> & TExtra>`, which is what it means and what a caller passes:
+ * inside a generic function TypeScript cannot check `{ isLoading }` against a partial of an
+ * unresolved type parameter, because `TExtra` might yet declare an `isLoading` of its own. The
+ * union says the same thing in terms it can check at both ends. Any real store's setter
+ * satisfies it, where `TExtra` is a concrete type.
+ */
+type AuthSet<TUser, TExtra> = (partial: (TExtra & Partial<AuthState<TUser>>) | Pick<AuthState<TUser>, "isLoading">) => void;
+/**
+ * The session flags as a plain object, for a product whose store needs more than them.
+ *
+ * `createAuthStore` owns its `create()` call, which means it owns the whole store: a product
+ * cannot wrap it in `persist`, cannot add an action, and cannot add a field. Both adopters that
+ * met it had a superset and neither could use it. One holds a remember-me choice, a profile row
+ * and the sign-in methods themselves, under `persist`. The other adds `isAnonymous` — and that
+ * one is the reason this takes a `derive` function rather than just letting the caller spread
+ * extra keys in: `isAnonymous` is read off the user, so it has to be rewritten by `setUser` and
+ * `clear`, which are exactly the two writes the product does not own.
+ *
+ * The caller keeps `create`, so middleware, extra actions and the store's own name stay theirs:
+ *
+ * ```ts
+ * const useAuthStore = create<AuthState<User> & { isAnonymous: boolean }>((set) => ({
+ *   ...authSlice<User, { isAnonymous: boolean }>(set, (user) => ({ isAnonymous: !!user?.isAnonymous })),
+ * }));
+ * ```
+ */
+export declare function authSlice<TUser, TExtra extends object>(set: AuthSet<TUser, TExtra>, derive: (user: TUser | null) => TExtra): AuthState<TUser> & TExtra;
+export {};
 //# sourceMappingURL=auth-store.d.ts.map

package/dist/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS,CAAC,KAAK;IAC9B,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC;IACtC,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,yEAAyE;IACzE,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,KAAK,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CASlF"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS,CAAC,KAAK;IAC9B,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC;IACtC,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,yEAAyE;IACzE,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,KAAK,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAElF;AAKD;;;;;;;;GAQG;AACH,KAAK,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,CAC5B,OAAO,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,KAChF,IAAI,CAAC;AAEV;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,SAAS,MAAM,EACpD,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,EAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,MAAM,GACrC,SAAS,CAAC,KAAK,CAAC,GAAG,MAAM,CAW3B"}

package/dist/auth-store.js

@@ -15,13 +15,36 @@ import { create } from "zustand";
  * Only one of the three donors knew this. It is invariant 7.
  */
 export function createAuthStore() {
-    return create((set) => ({
+    return create((set) => authSlice(set, () => ({})));
+}
+/**
+ * The session flags as a plain object, for a product whose store needs more than them.
+ *
+ * `createAuthStore` owns its `create()` call, which means it owns the whole store: a product
+ * cannot wrap it in `persist`, cannot add an action, and cannot add a field. Both adopters that
+ * met it had a superset and neither could use it. One holds a remember-me choice, a profile row
+ * and the sign-in methods themselves, under `persist`. The other adds `isAnonymous` — and that
+ * one is the reason this takes a `derive` function rather than just letting the caller spread
+ * extra keys in: `isAnonymous` is read off the user, so it has to be rewritten by `setUser` and
+ * `clear`, which are exactly the two writes the product does not own.
+ *
+ * The caller keeps `create`, so middleware, extra actions and the store's own name stay theirs:
+ *
+ * ```ts
+ * const useAuthStore = create<AuthState<User> & { isAnonymous: boolean }>((set) => ({
+ *   ...authSlice<User, { isAnonymous: boolean }>(set, (user) => ({ isAnonymous: !!user?.isAnonymous })),
+ * }));
+ * ```
+ */
+export function authSlice(set, derive) {
+    return {
+        ...derive(null),
         user: null,
         isAuthenticated: false,
         isLoading: typeof window !== "undefined",
-        setUser: (user) => set({ user, isAuthenticated: Boolean(user), isLoading: false }),
+        setUser: (user) => set({ ...derive(user), user, isAuthenticated: Boolean(user), isLoading: false }),
         setLoading: (isLoading) => set({ isLoading }),
-        clear: () => set({ user: null, isAuthenticated: false, isLoading: false }),
-    }));
+        clear: () => set({ ...derive(null), user: null, isAuthenticated: false, isLoading: false }),
+    };
 }
 //# sourceMappingURL=auth-store.js.map

package/dist/auth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqC,MAAM,SAAS,CAAC;AAkCpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,KAAK;QACtB,SAAS,EAAE,OAAO,MAAM,KAAK,WAAW;QACxC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAClF,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;QAC7C,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;KAC3E,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqC,MAAM,SAAS,CAAC;AAkCpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAoB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,SAAS,CACvB,GAA2B,EAC3B,MAAsC;IAEtC,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,KAAK;QACtB,SAAS,EAAE,OAAO,MAAM,KAAK,WAAW;QACxC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAChB,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAClF,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;QAC7C,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;KAC5F,CAAC;AACJ,CAAC"}

package/dist/i18n.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,EAC9B,WAAW,EACX,aAAa,EACb,UAAU,EACV,QAAQ,GACT,EAAE,eAAe;;;;;;;;;;;;;;;;EAqBjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAmB/E"}
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,EAC9B,WAAW,EACX,aAAa,EACb,UAAU,EACV,QAAQ,GACT,EAAE,eAAe;;;;;;;;;;;;;;;;EAuBjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAmB/E"}

package/dist/i18n.js

@@ -26,11 +26,13 @@ export function i18nInitOptions({ fallbackLng, supportedLngs, storageKey, queryK
             lookupLocalStorage: storageKey,
         },
         react: { useSuspense: false },
-        // `nonExplicitSupportedLngs` is omitted deliberately, and both donors say so in the same
-        // words. Enabling it validates the BASE subtag against `supportedLngs`, which rejects a
-        // region-coded "pt-BR" (its base "pt" is not in the list) and silently falls the whole app
-        // back to English. Detected sub-locales like "en-US" already resolve to their base through
-        // i18next's ordinary fallback hierarchy, so the flag buys nothing and breaks pt-BR.
+        // `nonExplicitSupportedLngs` is omitted deliberately. It breaks both shapes a catalog comes in.
+        // Region-coded: it validates the BASE subtag against `supportedLngs`, "pt" is not in a list
+        // that says "pt-BR", and the whole app silently renders English — both donors say so in the
+        // same words. Base codes: an "en-US" browser keeps "en-US" as `i18n.language`. Beside
+        // `currentOnly` no catalog matches it, so the reader gets the fallback language; beside
+        // `languageOnly` the copy is right and every map an app keys by the tag misses — the third
+        // migration shipped English copy as `lang="pt-BR"`. Without the flag "en-US" settles on "en".
     };
 }
 /**

package/dist/i18n.js.map

@@ -1 +1 @@
-{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4BH,MAAM,UAAU,eAAe,CAAC,EAC9B,WAAW,EACX,aAAa,EACb,UAAU,EACV,QAAQ,GACQ;IAChB,OAAO;QACL,WAAW;QACX,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC;QACjC,IAAI,EAAE,aAAsB;QAC5B,aAAa,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,yBAAyB;QAChE,SAAS,EAAE;YACT,KAAK,EAAE,QAAQ;gBACb,CAAC,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC;gBAC9C,CAAC,CAAC,CAAC,cAAc,EAAE,WAAW,CAAC;YACjC,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,kBAAkB,EAAE,UAAU;SAC/B;QACD,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;QAC7B,yFAAyF;QACzF,wFAAwF;QACxF,2FAA2F;QAC3F,2FAA2F;QAC3F,oFAAoF;KACrF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAI,SAAY,EAAE,IAA4B;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,UAAU,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EACvF,GAAG,CACJ,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAE9F,MAAM,IAAI,GAAG,CAAC,KAAc,EAAW,EAAE;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAM,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4BH,MAAM,UAAU,eAAe,CAAC,EAC9B,WAAW,EACX,aAAa,EACb,UAAU,EACV,QAAQ,GACQ;IAChB,OAAO;QACL,WAAW;QACX,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC;QACjC,IAAI,EAAE,aAAsB;QAC5B,aAAa,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,yBAAyB;QAChE,SAAS,EAAE;YACT,KAAK,EAAE,QAAQ;gBACb,CAAC,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC;gBAC9C,CAAC,CAAC,CAAC,cAAc,EAAE,WAAW,CAAC;YACjC,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,kBAAkB,EAAE,UAAU;SAC/B;QACD,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;QAC7B,gGAAgG;QAChG,4FAA4F;QAC5F,4FAA4F;QAC5F,sFAAsF;QACtF,wFAAwF;QACxF,2FAA2F;QAC3F,8FAA8F;KAC/F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAI,SAAY,EAAE,IAA4B;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,UAAU,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EACvF,GAAG,CACJ,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAE9F,MAAM,IAAI,GAAG,CAAC,KAAc,EAAW,EAAE;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAM,CAAC;AAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gusnips/react",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "The headless runtime under a Vite + React SPA: typed fetch client with single-flight refresh, auth store, query defaults, route guards, error boundary, chunk-reload recovery, i18n bootstrap.",
   "type": "module",
   "license": "MIT",

package/src/auth-store.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it } from "vitest";
+import { create } from "zustand";
+import { authSlice, createAuthStore, type AuthState } from "./auth-store.ts";
+
+interface User {
+  id: string;
+  email: string;
+  isAnonymous?: boolean;
+}
+
+describe("createAuthStore", () => {
+  it("ends the loading state when it learns who the user is", () => {
+    const store = createAuthStore<User>();
+
+    store.getState().setUser({ id: "1", email: "a@b.c" });
+
+    expect(store.getState().isAuthenticated).toBe(true);
+    expect(store.getState().isLoading).toBe(false);
+  });
+});
+
+/**
+ * The shape an adopter actually has: an anonymous flag read off the user, plus state and an
+ * action of its own. Both halves have to survive `setUser` and `clear`, which is the whole
+ * reason `authSlice` exists — a store built on `createAuthStore` could hold neither.
+ */
+type Extra = { isAnonymous: boolean };
+
+const useAuthStore = create<AuthState<User> & Extra & { restored: boolean; restore: () => void }>(
+  (set) => ({
+    ...authSlice<User, Extra>(set, (user) => ({ isAnonymous: Boolean(user?.isAnonymous) })),
+    restored: false,
+    restore: () => set({ restored: true }),
+  }),
+);
+
+describe("authSlice", () => {
+  it("keeps a derived field in step with the user it is read from", () => {
+    useAuthStore.getState().setUser({ id: "1", email: "a@b.c", isAnonymous: true });
+    expect(useAuthStore.getState().isAnonymous).toBe(true);
+
+    useAuthStore.getState().setUser({ id: "2", email: "d@e.f" });
+    expect(useAuthStore.getState().isAnonymous).toBe(false);
+
+    useAuthStore.getState().setUser({ id: "3", email: "g@h.i", isAnonymous: true });
+    // Signing out must not leave the flag behind: the next visitor is not anonymous, they are
+    // nobody, and a stale `true` here reads as "signed in anonymously" to every guard.
+    useAuthStore.getState().clear();
+    expect(useAuthStore.getState().isAnonymous).toBe(false);
+    expect(useAuthStore.getState().isAuthenticated).toBe(false);
+  });
+
+  it("leaves the product's own state alone", () => {
+    useAuthStore.getState().restore();
+    useAuthStore.getState().setUser({ id: "1", email: "a@b.c" });
+    useAuthStore.getState().clear();
+
+    expect(useAuthStore.getState().restored).toBe(true);
+  });
+});

package/src/auth-store.ts

@@ -48,12 +48,56 @@ export interface AuthState<TUser> {
  * Only one of the three donors knew this. It is invariant 7.
  */
 export function createAuthStore<TUser>(): UseBoundStore<StoreApi<AuthState<TUser>>> {
-  return create<AuthState<TUser>>((set) => ({
+  return create<AuthState<TUser>>((set) => authSlice<TUser, EmptyExtra>(set, () => ({})));
+}
+
+/** What `authSlice` derives when a product adds nothing of its own. */
+type EmptyExtra = Record<never, never>;
+
+/**
+ * zustand's `set`, narrowed to the two writes this slice makes.
+ *
+ * Not `Partial<AuthState<TUser> & TExtra>`, which is what it means and what a caller passes:
+ * inside a generic function TypeScript cannot check `{ isLoading }` against a partial of an
+ * unresolved type parameter, because `TExtra` might yet declare an `isLoading` of its own. The
+ * union says the same thing in terms it can check at both ends. Any real store's setter
+ * satisfies it, where `TExtra` is a concrete type.
+ */
+type AuthSet<TUser, TExtra> = (
+  partial: (TExtra & Partial<AuthState<TUser>>) | Pick<AuthState<TUser>, "isLoading">,
+) => void;
+
+/**
+ * The session flags as a plain object, for a product whose store needs more than them.
+ *
+ * `createAuthStore` owns its `create()` call, which means it owns the whole store: a product
+ * cannot wrap it in `persist`, cannot add an action, and cannot add a field. Both adopters that
+ * met it had a superset and neither could use it. One holds a remember-me choice, a profile row
+ * and the sign-in methods themselves, under `persist`. The other adds `isAnonymous` — and that
+ * one is the reason this takes a `derive` function rather than just letting the caller spread
+ * extra keys in: `isAnonymous` is read off the user, so it has to be rewritten by `setUser` and
+ * `clear`, which are exactly the two writes the product does not own.
+ *
+ * The caller keeps `create`, so middleware, extra actions and the store's own name stay theirs:
+ *
+ * ```ts
+ * const useAuthStore = create<AuthState<User> & { isAnonymous: boolean }>((set) => ({
+ *   ...authSlice<User, { isAnonymous: boolean }>(set, (user) => ({ isAnonymous: !!user?.isAnonymous })),
+ * }));
+ * ```
+ */
+export function authSlice<TUser, TExtra extends object>(
+  set: AuthSet<TUser, TExtra>,
+  derive: (user: TUser | null) => TExtra,
+): AuthState<TUser> & TExtra {
+  return {
+    ...derive(null),
     user: null,
     isAuthenticated: false,
     isLoading: typeof window !== "undefined",
-    setUser: (user) => set({ user, isAuthenticated: Boolean(user), isLoading: false }),
+    setUser: (user) =>
+      set({ ...derive(user), user, isAuthenticated: Boolean(user), isLoading: false }),
     setLoading: (isLoading) => set({ isLoading }),
-    clear: () => set({ user: null, isAuthenticated: false, isLoading: false }),
-  }));
+    clear: () => set({ ...derive(null), user: null, isAuthenticated: false, isLoading: false }),
+  };
 }

package/src/i18n.test.ts

@@ -1,5 +1,6 @@
+import { createInstance } from "i18next";
 import { describe, expect, it } from "vitest";
-import { applyBrandVars, i18nInitOptions } from "./i18n.ts";
+import { applyBrandVars, i18nInitOptions, type I18nInitOptions } from "./i18n.ts";
 
 describe("applyBrandVars", () => {
   it("fills placeholders anywhere in the tree and leaves the input alone", () => {
@@ -27,17 +28,34 @@ describe("applyBrandVars", () => {
   });
 });
 
+/** For a browser saying `lng`: the app's `i18n.language`, and the catalog that answers. */
+async function settle(
+  options: Omit<I18nInitOptions, "storageKey">,
+  lng: string,
+): Promise<[language: string, catalog: string]> {
+  const i18n = createInstance();
+  const resources = Object.fromEntries(
+    options.supportedLngs.map((tag) => [tag, { translation: { tag } }]),
+  );
+  await i18n.init({ ...i18nInitOptions({ ...options, storageKey: "app.locale" }), resources, lng });
+  return [i18n.language, i18n.t("tag")];
+}
+
 describe("i18nInitOptions", () => {
-  // The comment in both donors names the bug: `nonExplicitSupportedLngs` validates the BASE
-  // subtag, which rejects "pt-BR" (its base "pt" is not listed) and silently falls the whole
-  // app back to English. Its absence is load-bearing.
-  it("does not set nonExplicitSupportedLngs", () => {
-    const options = i18nInitOptions({
-      fallbackLng: "en",
-      supportedLngs: ["en", "pt-BR"],
-      storageKey: "app.locale",
-    });
-    expect(options).not.toHaveProperty("nonExplicitSupportedLngs");
+  // `nonExplicitSupportedLngs` breaks both catalog shapes, and this pins both. Region-coded, the
+  // app renders English for a pt-BR reader — the bug both donors' comments name. Base codes, an
+  // "en-US" browser keeps "en-US" as `i18n.language`, which is what an app keys `<html lang>` and
+  // `og:locale` by: the third migration's site missed its lookup and shipped English copy as
+  // `lang="pt-BR"`.
+  it("settles a browser's regional tag on a language the catalogs have", async () => {
+    const baseCodes = { fallbackLng: "pt", supportedLngs: ["pt", "es", "en"] };
+    expect(await settle(baseCodes, "en-US")).toEqual(["en", "en"]);
+    expect(await settle(baseCodes, "es-419")).toEqual(["es", "es"]);
+    expect(await settle(baseCodes, "fr-FR")).toEqual(["pt", "pt"]);
+
+    const regionCoded = { fallbackLng: "en", supportedLngs: ["en", "pt-BR"] };
+    expect(await settle(regionCoded, "pt-BR")).toEqual(["pt-BR", "pt-BR"]);
+    expect(await settle(regionCoded, "en-GB")).toEqual(["en", "en"]);
   });
 
   // Only one donor had the query parameter, and it is the only detection source somebody chose

package/src/i18n.ts

@@ -58,11 +58,13 @@ export function i18nInitOptions({
       lookupLocalStorage: storageKey,
     },
     react: { useSuspense: false },
-    // `nonExplicitSupportedLngs` is omitted deliberately, and both donors say so in the same
-    // words. Enabling it validates the BASE subtag against `supportedLngs`, which rejects a
-    // region-coded "pt-BR" (its base "pt" is not in the list) and silently falls the whole app
-    // back to English. Detected sub-locales like "en-US" already resolve to their base through
-    // i18next's ordinary fallback hierarchy, so the flag buys nothing and breaks pt-BR.
+    // `nonExplicitSupportedLngs` is omitted deliberately. It breaks both shapes a catalog comes in.
+    // Region-coded: it validates the BASE subtag against `supportedLngs`, "pt" is not in a list
+    // that says "pt-BR", and the whole app silently renders English — both donors say so in the
+    // same words. Base codes: an "en-US" browser keeps "en-US" as `i18n.language`. Beside
+    // `currentOnly` no catalog matches it, so the reader gets the fallback language; beside
+    // `languageOnly` the copy is right and every map an app keys by the tag misses — the third
+    // migration shipped English copy as `lang="pt-BR"`. Without the flag "en-US" settles on "en".
   };
 }