@hanzo/rooms 0.1.1 → 0.1.2

package/dist/lib/tiers.js

@@ -33,7 +33,7 @@
 import { useEffect, useState } from 'react';
 import { useIam, useOrganizations } from '@hanzo/iam/react';
 import { api } from './api.js';
-import { superAdmin as isSuperAdmin } from './session.js';
+import { scope, superAdmin as isSuperAdmin } from './session.js';
 /** Every tier, for the callers that are entitled to all of them. */
 const ALL = ['alpha', 'beta'];
 /**
@@ -81,13 +81,13 @@ export function useTiers() {
         }
         const ac = new AbortController();
         // The PostHog-shaped evaluate: a distinct_id and the person's org, answered
-        // with `{ featureFlags: { … } }`. The session cookie carries the principal;
-        // with none the cloud answers 403 and this falls to the empty set, which is
-        // the signed-out room — the safe direction.
+        // with `{ featureFlags: { … } }`. The bearer carries the principal, as on
+        // every other read: no host the rooms are drawn on holds a session cookie
+        // for the API, so a cookie alone was answered 403 on every page. A refusal
+        // still falls to the empty set, the signed-out room — the safe direction.
         fetch(`${api()}/v1/flags`, {
             method: 'POST',
-            credentials: 'include',
-            headers: { 'content-type': 'application/json' },
+            headers: { 'content-type': 'application/json', ...scope() },
             body: JSON.stringify({ distinct_id: id, person_properties: { org: organizations[0]?.name } }),
             signal: ac.signal,
         })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/rooms",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "The workspace rooms — Home, Chat, Inbox, Contacts, Meet, Cal, Drive, Board, Work, Bots — and the frame that holds them, once, for every Hanzo surface.",
   "type": "module",
   "main": "./dist/index.js",