@hanzo/ui-shadcn 5.7.2

package/dist/src/3d/pin.js

@@ -0,0 +1,9 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import * as React from "react";
+import { cn } from "@hanzo/ui-shadcn/lib/utils";
+const Pin3D = React.forwardRef(({ className, title, href, children, ...props }, ref) => {
+    return (_jsxs("div", { ref: ref, className: cn("group/pin relative cursor-pointer", className), ...props, children: [_jsx("div", { className: "pointer-events-none absolute inset-0 z-10 flex h-full w-full items-center justify-center opacity-0 transition duration-500 group-hover/pin:opacity-100", children: _jsx("div", { className: "relative flex h-full w-full items-center justify-center", children: _jsx("div", { className: "absolute inset-0 bg-white opacity-0 transition duration-500 group-hover/pin:opacity-50" }) }) }), _jsx("div", { className: "transform-gpu transition duration-500 group-hover/pin:scale-95", children: children })] }));
+});
+Pin3D.displayName = "Pin3D";
+export { Pin3D };

package/dist/src/auth/AuthGuard.d.ts

@@ -0,0 +1,16 @@
+import React from 'react';
+export interface AuthGuardProps {
+    /** Where to redirect when not authenticated (defaults to IAM login) */
+    loginUrl?: string;
+    /** OAuth client ID for IAM redirect */
+    clientId?: string;
+    /** Show loading state while checking auth */
+    fallback?: React.ReactNode;
+    children: React.ReactNode;
+}
+/**
+ * Wrapper component that redirects to IAM login if user is not authenticated.
+ * Uses useHanzoAuth to check localStorage token.
+ */
+export declare function AuthGuard({ loginUrl, clientId, fallback, children, }: AuthGuardProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=AuthGuard.d.ts.map

package/dist/src/auth/AuthGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthGuard.d.ts","sourceRoot":"","sources":["../../../src/auth/AuthGuard.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAoB,MAAM,OAAO,CAAA;AAIxC,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;IAC1B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,EACxB,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,GACT,EAAE,cAAc,kDA+BhB"}

package/dist/src/auth/AuthGuard.js

@@ -0,0 +1,32 @@
+'use client';
+import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+import { useEffect } from 'react';
+import { useHanzoAuth } from '../navigation/hanzo-shell/useHanzoAuth';
+import { startIamLogin } from './iam';
+/**
+ * Wrapper component that redirects to IAM login if user is not authenticated.
+ * Uses useHanzoAuth to check localStorage token.
+ */
+export function AuthGuard({ loginUrl, clientId, fallback, children, }) {
+    const { user, loading } = useHanzoAuth();
+    useEffect(() => {
+        if (!loading && !user) {
+            if (loginUrl) {
+                window.location.href = loginUrl;
+            }
+            else if (clientId) {
+                // Canonical IAM authorization-code + PKCE-S256 flow (HIP-0111).
+                void startIamLogin({ serverUrl: 'https://hanzo.id', clientId });
+            }
+            else {
+                window.location.href = 'https://hanzo.id';
+            }
+        }
+    }, [loading, user, loginUrl, clientId]);
+    if (loading) {
+        return (_jsx(_Fragment, { children: fallback ?? (_jsx("div", { style: { display: 'flex', alignItems: 'center', justifyContent: 'center', minHeight: '100vh', background: '#09090b', color: '#888' }, children: "Loading..." })) }));
+    }
+    if (!user)
+        return null;
+    return _jsx(_Fragment, { children: children });
+}

package/dist/src/auth/IAMLoginButton.d.ts

@@ -0,0 +1,27 @@
+export interface IAMLoginButtonProps {
+    /** IAM server URL (e.g., https://hanzo.id) */
+    iamUrl?: string;
+    /** OAuth client ID */
+    clientId: string;
+    /** OAuth redirect URI (defaults to current origin + /auth/callback) */
+    redirectUri?: string;
+    /**
+     * Provider hint. Omit for the IAM login page (the default "Sign in" button);
+     * pass `'google'`/`'github'`/… to jump straight to a provider. Prefer
+     * `<SignIn providers>` / `<SocialButton>` for multi-method surfaces.
+     */
+    provider?: string;
+    /** Button label */
+    label?: string;
+    /** Additional CSS classes */
+    className?: string;
+    /** Button variant: 'default' (filled) or 'outline' */
+    variant?: 'default' | 'outline';
+}
+/**
+ * Single "Sign in" button that initiates the canonical IAM authorization-code +
+ * PKCE-S256 flow (HIP-0111). Brand-neutral — colors come from CSS tokens
+ * (`bg-primary`, `border-input`, `bg-background`), never literals.
+ */
+export declare function IAMLoginButton({ iamUrl, clientId, redirectUri, provider, label, className, variant, }: IAMLoginButtonProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=IAMLoginButton.d.ts.map

package/dist/src/auth/IAMLoginButton.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IAMLoginButton.d.ts","sourceRoot":"","sources":["../../../src/auth/IAMLoginButton.tsx"],"names":[],"mappings":"AAMA,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sDAAsD;IACtD,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAC7B,MAA2B,EAC3B,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAiB,EACjB,SAAS,EACT,OAAmB,GACpB,EAAE,mBAAmB,2CA4BrB"}

package/dist/src/auth/IAMLoginButton.js

@@ -0,0 +1,22 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useCallback, useState } from 'react';
+import { cn } from '../utils';
+import { startIamLogin } from './iam';
+/**
+ * Single "Sign in" button that initiates the canonical IAM authorization-code +
+ * PKCE-S256 flow (HIP-0111). Brand-neutral — colors come from CSS tokens
+ * (`bg-primary`, `border-input`, `bg-background`), never literals.
+ */
+export function IAMLoginButton({ iamUrl = 'https://hanzo.id', clientId, redirectUri, provider, label = 'Sign in', className, variant = 'default', }) {
+    const [loading, setLoading] = useState(false);
+    const handleClick = useCallback(() => {
+        setLoading(true);
+        void startIamLogin({ serverUrl: iamUrl, clientId, redirectUri, provider }).catch(() => {
+            setLoading(false);
+        });
+    }, [iamUrl, clientId, redirectUri, provider]);
+    return (_jsx("button", { type: "button", className: cn('inline-flex items-center justify-center gap-2 rounded-md px-4 py-2.5 text-sm font-medium transition-colors', 'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2', 'disabled:pointer-events-none disabled:opacity-50', variant === 'outline'
+            ? 'border border-input bg-background text-foreground hover:bg-accent hover:text-accent-foreground'
+            : 'bg-primary text-primary-foreground hover:bg-primary/90', className), onClick: handleClick, disabled: loading, children: loading ? 'Redirecting…' : label }));
+}

package/dist/src/auth/PasswordForm.d.ts

@@ -0,0 +1,22 @@
+import type { PasswordSubmit } from './types';
+export interface PasswordFormProps {
+    /**
+     * Submit handler. The canonical implementation is the `@hanzo/iam` SDK's
+     * `loginWithPassword` (embedded credential → PKCE-bound code). Kept injected
+     * so `@hanzo/ui` stays dependency-light. When omitted the form is inert.
+     */
+    onSubmit?: PasswordSubmit;
+    /** Optional "forgot password" affordance the host wires. */
+    onForgot?: () => void;
+    /** Submit button label. */
+    submitLabel?: string;
+    className?: string;
+}
+/**
+ * Atomic email + password form. Brand-neutral: borders/text/background come
+ * from CSS tokens (`bg-background`, `border-input`, `text-foreground`,
+ * `bg-primary`), never literals. No token exchange — it just collects the
+ * credential and calls `onSubmit`.
+ */
+export declare function PasswordForm({ onSubmit, onForgot, submitLabel, className, }: PasswordFormProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=PasswordForm.d.ts.map

package/dist/src/auth/PasswordForm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordForm.d.ts","sourceRoot":"","sources":["../../../src/auth/PasswordForm.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;IACrB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,QAAQ,EACR,WAAuB,EACvB,SAAS,GACV,EAAE,iBAAiB,2CAoFnB"}

package/dist/src/auth/PasswordForm.js

@@ -0,0 +1,28 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useState } from 'react';
+import { cn } from '../utils';
+/**
+ * Atomic email + password form. Brand-neutral: borders/text/background come
+ * from CSS tokens (`bg-background`, `border-input`, `text-foreground`,
+ * `bg-primary`), never literals. No token exchange — it just collects the
+ * credential and calls `onSubmit`.
+ */
+export function PasswordForm({ onSubmit, onForgot, submitLabel = 'Sign in', className, }) {
+    const [email, setEmail] = useState('');
+    const [password, setPassword] = useState('');
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState(null);
+    const handleSubmit = useCallback((e) => {
+        e.preventDefault();
+        if (!onSubmit)
+            return;
+        setBusy(true);
+        setError(null);
+        void Promise.resolve(onSubmit({ email, password }))
+            .catch((err) => setError(err instanceof Error ? err.message : 'Sign-in failed'))
+            .finally(() => setBusy(false));
+    }, [onSubmit, email, password]);
+    const fieldCls = cn('w-full rounded-md border border-input bg-background px-3 py-2 text-sm text-foreground', 'placeholder:text-muted-foreground', 'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2');
+    return (_jsxs("form", { onSubmit: handleSubmit, className: cn('flex flex-col gap-3', className), children: [_jsxs("label", { className: "flex flex-col gap-1.5", children: [_jsx("span", { className: "text-sm font-medium text-foreground", children: "Email" }), _jsx("input", { type: "email", autoComplete: "email", required: true, value: email, onChange: (e) => setEmail(e.target.value), placeholder: "you@example.com", className: fieldCls })] }), _jsxs("label", { className: "flex flex-col gap-1.5", children: [_jsxs("span", { className: "flex items-center justify-between text-sm font-medium text-foreground", children: ["Password", onForgot && (_jsx("button", { type: "button", onClick: onForgot, className: "text-xs font-normal text-muted-foreground hover:text-foreground", children: "Forgot?" }))] }), _jsx("input", { type: "password", autoComplete: "current-password", required: true, value: password, onChange: (e) => setPassword(e.target.value), placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", className: fieldCls })] }), error && (_jsx("p", { role: "alert", className: "text-sm text-destructive", children: error })), _jsx("button", { type: "submit", disabled: busy || !onSubmit, className: cn('inline-flex w-full items-center justify-center rounded-md bg-primary px-4 py-2.5', 'text-sm font-medium text-primary-foreground transition-colors hover:bg-primary/90', 'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2', 'disabled:pointer-events-none disabled:opacity-50'), children: busy ? 'Signing in…' : submitLabel })] }));
+}

package/dist/src/auth/SignIn.d.ts

@@ -0,0 +1,37 @@
+import React from 'react';
+import type { SignInConfig, SignInMethod, LoginStarter, PasswordSubmit } from './types';
+export interface SignInProps {
+    /**
+     * The method set to render, in order. `'password'` renders the embedded
+     * form; everything else is a provider hint (`'google'`, `'github'`,
+     * `'web3'`, …). This is the ONLY app-level configuration — apps pass
+     * `brand.providers` and write zero auth code.
+     */
+    providers: SignInMethod[];
+    /** Brand IAM wiring threaded to every social/web3 atom. */
+    config?: SignInConfig;
+    /** Injected login starter (defaults to the embedded `startIamLogin`). */
+    onLogin?: LoginStarter;
+    /** Password submit handler (canonical: the SDK's `loginWithPassword`). */
+    onPasswordSubmit?: PasswordSubmit;
+    /** "Forgot password" affordance. */
+    onForgot?: () => void;
+    /** Optional heading rendered above the methods. */
+    title?: React.ReactNode;
+    className?: string;
+}
+/**
+ * The composable sign-in surface. Renders the chosen method set — a
+ * `<PasswordForm>` and/or one `<SocialButton>` per provider (`<Web3Connect>`
+ * for `'web3'`) — each wired to the SDK. Brand-neutral: all color comes from
+ * the host's CSS tokens, nothing hardcoded. Apps just choose `providers`.
+ *
+ * @example
+ *   <SignIn
+ *     providers={['password', 'google', 'github', 'web3']}
+ *     config={{ serverUrl: 'https://hanzo.id', clientId: 'hanzo-app' }}
+ *     onPasswordSubmit={(c) => iam.loginWithPassword(c.email, c.password)}
+ *   />
+ */
+export declare function SignIn({ providers, config, onLogin, onPasswordSubmit, onForgot, title, className, }: SignInProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SignIn.d.ts.map

package/dist/src/auth/SignIn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../src/auth/SignIn.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,OAAO,CAAA;AAKzB,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAEvF,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,SAAS,EAAE,YAAY,EAAE,CAAA;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,yEAAyE;IACzE,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,cAAc,CAAA;IACjC,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;IACrB,mDAAmD;IACnD,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,MAAM,CAAC,EACrB,SAAS,EACT,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,KAAK,EACL,SAAS,GACV,EAAE,WAAW,2CAkCb"}

package/dist/src/auth/SignIn.js

@@ -0,0 +1,26 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { cn } from '../utils';
+import { SocialButton } from './SocialButton';
+import { Web3Connect } from './Web3Connect';
+import { PasswordForm } from './PasswordForm';
+const isPassword = (m) => m === 'password';
+/**
+ * The composable sign-in surface. Renders the chosen method set — a
+ * `<PasswordForm>` and/or one `<SocialButton>` per provider (`<Web3Connect>`
+ * for `'web3'`) — each wired to the SDK. Brand-neutral: all color comes from
+ * the host's CSS tokens, nothing hardcoded. Apps just choose `providers`.
+ *
+ * @example
+ *   <SignIn
+ *     providers={['password', 'google', 'github', 'web3']}
+ *     config={{ serverUrl: 'https://hanzo.id', clientId: 'hanzo-app' }}
+ *     onPasswordSubmit={(c) => iam.loginWithPassword(c.email, c.password)}
+ *   />
+ */
+export function SignIn({ providers, config, onLogin, onPasswordSubmit, onForgot, title, className, }) {
+    const social = providers.filter((p) => !isPassword(p));
+    const hasPassword = providers.some(isPassword);
+    const showDivider = hasPassword && social.length > 0;
+    return (_jsxs("div", { className: cn('flex w-full max-w-sm flex-col gap-4', className), children: [title && _jsx("div", { className: "text-lg font-semibold text-foreground", children: title }), hasPassword && (_jsx(PasswordForm, { onSubmit: onPasswordSubmit, onForgot: onForgot })), showDivider && (_jsxs("div", { className: "flex items-center gap-3", "aria-hidden": true, children: [_jsx("span", { className: "h-px flex-1 bg-border" }), _jsx("span", { className: "text-xs uppercase tracking-wide text-muted-foreground", children: "or" }), _jsx("span", { className: "h-px flex-1 bg-border" })] })), social.length > 0 && (_jsx("div", { className: "flex flex-col gap-2", children: social.map((provider) => provider === 'web3' ? (_jsx(Web3Connect, { config: config, onLogin: onLogin }, provider)) : (_jsx(SocialButton, { provider: provider, config: config, onLogin: onLogin }, provider))) }))] }));
+}

package/dist/src/auth/SocialButton.d.ts

@@ -0,0 +1,27 @@
+import React from 'react';
+import type { SignInConfig, LoginStarter } from './types';
+export interface SocialButtonProps {
+    /** Provider hint delegated to IAM's shared OAuth client (e.g. "google"). */
+    provider: string;
+    /** Brand IAM wiring. Required unless an `onLogin` starter is injected. */
+    config?: SignInConfig;
+    /**
+     * Injected login starter (composition over coupling). Defaults to the
+     * `@hanzo/iam`-shaped `startIamLogin`. Pass the SDK's `startLogin` to drop
+     * the embedded copy.
+     */
+    onLogin?: LoginStarter;
+    /** Override the label (default derived from provider). */
+    label?: string;
+    /** Override the glyph (default derived from provider; `currentColor`). */
+    icon?: React.ReactNode;
+    className?: string;
+}
+/**
+ * One social / web3 sign-in method. Atomic and brand-neutral: colors come from
+ * the host's CSS tokens (`bg-background`, `text-foreground`, `border-input`,
+ * `hover:bg-accent`), never literals. Delegates to the login starter with the
+ * `provider` knob — no token exchange here.
+ */
+export declare function SocialButton({ provider, config, onLogin, label, icon, className, }: SocialButtonProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SocialButton.d.ts.map

package/dist/src/auth/SocialButton.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SocialButton.d.ts","sourceRoot":"","sources":["../../../src/auth/SocialButton.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAgC,MAAM,OAAO,CAAA;AAGpD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAiCzD,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,0EAA0E;IAC1E,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,MAAM,EACN,OAAO,EACP,KAAK,EACL,IAAI,EACJ,SAAS,GACV,EAAE,iBAAiB,2CAiCnB"}

package/dist/src/auth/SocialButton.js

@@ -0,0 +1,37 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useState } from 'react';
+import { cn } from '../utils';
+import { startIamLogin } from './iam';
+/** Built-in provider glyphs. `currentColor` only — the button stays monochrome
+ *  and inherits the brand from CSS tokens. Pass `icon` to override. */
+const GLYPHS = {
+    google: (_jsx("svg", { width: "16", height: "16", viewBox: "0 0 24 24", fill: "none", "aria-hidden": true, children: _jsx("path", { d: "M21.35 11.1h-9.17v2.96h5.27c-.23 1.4-1.66 4.1-5.27 4.1-3.17 0-5.76-2.62-5.76-5.86s2.59-5.86 5.76-5.86c1.8 0 3.01.77 3.7 1.43l2.52-2.43C16.9 3.5 14.76 2.6 12.18 2.6 6.98 2.6 2.8 6.78 2.8 12.3s4.18 9.7 9.38 9.7c5.42 0 9-3.8 9-9.16 0-.62-.07-1.09-.18-1.74z", fill: "currentColor" }) })),
+    github: (_jsx("svg", { width: "16", height: "16", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": true, children: _jsx("path", { d: "M12 2C6.48 2 2 6.58 2 12.25c0 4.53 2.87 8.37 6.84 9.73.5.1.68-.22.68-.49v-1.7c-2.78.62-3.37-1.22-3.37-1.22-.45-1.18-1.11-1.5-1.11-1.5-.91-.64.07-.62.07-.62 1 .07 1.53 1.06 1.53 1.06.9 1.56 2.36 1.11 2.94.85.09-.66.35-1.11.63-1.37-2.22-.26-4.56-1.14-4.56-5.07 0-1.12.39-2.03 1.03-2.75-.1-.26-.45-1.3.1-2.71 0 0 .84-.27 2.75 1.05A9.36 9.36 0 0 1 12 6.84c.85 0 1.71.12 2.51.34 1.91-1.32 2.75-1.05 2.75-1.05.55 1.41.2 2.45.1 2.71.64.72 1.03 1.63 1.03 2.75 0 3.94-2.34 4.81-4.57 5.06.36.32.68.94.68 1.9v2.82c0 .27.18.59.69.49A10.26 10.26 0 0 0 22 12.25C22 6.58 17.52 2 12 2z" }) })),
+    web3: (_jsxs("svg", { width: "16", height: "16", viewBox: "0 0 24 24", fill: "none", "aria-hidden": true, children: [_jsx("path", { d: "M3 7l9-4 9 4-9 4-9-4z", stroke: "currentColor", strokeWidth: "1.6", strokeLinejoin: "round" }), _jsx("path", { d: "M3 12l9 4 9-4M3 17l9 4 9-4", stroke: "currentColor", strokeWidth: "1.6", strokeLinejoin: "round" })] })),
+};
+/** Human label for a provider. Override with `label`. */
+const LABELS = {
+    google: 'Continue with Google',
+    github: 'Continue with GitHub',
+    web3: 'Connect Wallet',
+};
+/**
+ * One social / web3 sign-in method. Atomic and brand-neutral: colors come from
+ * the host's CSS tokens (`bg-background`, `text-foreground`, `border-input`,
+ * `hover:bg-accent`), never literals. Delegates to the login starter with the
+ * `provider` knob — no token exchange here.
+ */
+export function SocialButton({ provider, config, onLogin, label, icon, className, }) {
+    const [loading, setLoading] = useState(false);
+    const handleClick = useCallback(() => {
+        const start = onLogin ??
+            ((opts) => startIamLogin(opts));
+        if (!onLogin && !config) {
+            throw new Error('SocialButton: provide `config` (serverUrl + clientId) or an `onLogin` starter.');
+        }
+        setLoading(true);
+        void Promise.resolve(start({ ...config, provider })).catch(() => setLoading(false));
+    }, [onLogin, config, provider]);
+    return (_jsxs("button", { type: "button", onClick: handleClick, disabled: loading, "data-provider": provider, className: cn('inline-flex w-full items-center justify-center gap-2 rounded-md border border-input bg-background px-4 py-2.5', 'text-sm font-medium text-foreground transition-colors', 'hover:bg-accent hover:text-accent-foreground', 'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2', 'disabled:pointer-events-none disabled:opacity-50', className), children: [icon ?? GLYPHS[provider] ?? null, loading ? 'Redirecting…' : label ?? LABELS[provider] ?? `Continue with ${provider}`] }));
+}

package/dist/src/auth/Web3Connect.d.ts

@@ -0,0 +1,9 @@
+import { type SocialButtonProps } from './SocialButton';
+export type Web3ConnectProps = Omit<SocialButtonProps, 'provider'>;
+/**
+ * Wallet sign-in. Thin specialization of `<SocialButton provider="web3">` — the
+ * web3 hop is just another provider delegated to IAM. Atomic, brand-neutral,
+ * composes freely; no separate flow.
+ */
+export declare function Web3Connect(props: Web3ConnectProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Web3Connect.d.ts.map

package/dist/src/auth/Web3Connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Web3Connect.d.ts","sourceRoot":"","sources":["../../../src/auth/Web3Connect.tsx"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAErE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAA;AAElE;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,2CAElD"}

package/dist/src/auth/Web3Connect.js

@@ -0,0 +1,11 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { SocialButton } from './SocialButton';
+/**
+ * Wallet sign-in. Thin specialization of `<SocialButton provider="web3">` — the
+ * web3 hop is just another provider delegated to IAM. Atomic, brand-neutral,
+ * composes freely; no separate flow.
+ */
+export function Web3Connect(props) {
+    return _jsx(SocialButton, { provider: "web3", ...props });
+}

package/dist/src/auth/iam.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Canonical Hanzo IAM OIDC wiring for the zero-dependency `@hanzo/ui` auth
+ * components (HIP-0111).
+ *
+ * The full `@hanzo/iam` SDK is the canonical client everywhere it can be a
+ * dependency. `@hanzo/ui` is intentionally dependency-light, so this module
+ * mirrors the SDK's contract for the two things these components need —
+ * the OIDC endpoint paths and a PKCE-S256 authorize redirect — and nothing
+ * else. The paths below are byte-for-byte the SDK's `OIDC_PATHS`.
+ *
+ * There is no `/api/` prefix, no legacy `/oauth/*` or `/login/oauth/*`, and
+ * PKCE (S256) is always on. A bare authorize redirect without PKCE is a
+ * security gap, not just a path nit.
+ */
+/** OIDC endpoint paths, relative to the brand `serverUrl`. Mirrors `@hanzo/iam` `OIDC_PATHS`. */
+export declare const IAM_OIDC_PATHS: {
+    readonly authorize: "/v1/iam/oauth/authorize";
+    readonly token: "/v1/iam/oauth/token";
+    readonly userinfo: "/v1/iam/oauth/userinfo";
+    readonly jwks: "/v1/iam/.well-known/jwks";
+    readonly logout: "/v1/iam/oauth/logout";
+};
+/** Absolute IAM endpoint URL from a brand origin and a path key. */
+export declare function iamUrl(serverUrl: string, key: keyof typeof IAM_OIDC_PATHS): string;
+export interface StartIamLoginOptions {
+    /** Brand IAM origin, e.g. https://hanzo.id. */
+    serverUrl: string;
+    /** OAuth client id (`<org>-<app>`). */
+    clientId: string;
+    /** Redirect URI; defaults to the current origin + `/auth/callback`. */
+    redirectUri?: string;
+    /** Scopes; defaults to `openid profile email`. */
+    scope?: string;
+    /**
+     * Social/web3 provider hint (e.g. "google", "github", "web3"). The ONE knob
+     * that selects a method — omit it for the IAM login page, or name a provider
+     * to delegate the social hop to IAM's shared org-level OAuth client. It rides
+     * as `&provider=<name>` on `/v1/iam/oauth/authorize`; the app NEVER registers
+     * a per-app Google/GitHub client. Same shape as `@hanzo/iam`'s `startLogin`.
+     */
+    provider?: string;
+}
+/**
+ * Build the canonical IAM authorization-code + PKCE-S256 authorize URL and
+ * stash the verifier + state in `sessionStorage` for the callback. Returned
+ * without redirecting — useful for `<a href>` or tests. `provider` (if given)
+ * rides as `&provider=<name>`; one flow, parameterized.
+ */
+export declare function buildIamAuthorizeUrl(opts: StartIamLoginOptions): Promise<string>;
+/**
+ * Begin the canonical IAM authorization-code + PKCE-S256 flow by redirecting
+ * the browser to `/v1/iam/oauth/authorize`. The verifier + state are stashed in
+ * `sessionStorage` for the callback to consume. `provider` selects the method.
+ */
+export declare function startIamLogin(opts: StartIamLoginOptions): Promise<void>;
+//# sourceMappingURL=iam.d.ts.map

package/dist/src/auth/iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../../../src/auth/iam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iGAAiG;AACjG,eAAO,MAAM,cAAc;;;;;;CAMjB,CAAA;AAIV,oEAAoE;AACpE,wBAAgB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,cAAc,GAAG,MAAM,CAElF;AAuBD,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBtF;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E"}

package/dist/src/auth/iam.js

@@ -0,0 +1,78 @@
+/**
+ * Canonical Hanzo IAM OIDC wiring for the zero-dependency `@hanzo/ui` auth
+ * components (HIP-0111).
+ *
+ * The full `@hanzo/iam` SDK is the canonical client everywhere it can be a
+ * dependency. `@hanzo/ui` is intentionally dependency-light, so this module
+ * mirrors the SDK's contract for the two things these components need —
+ * the OIDC endpoint paths and a PKCE-S256 authorize redirect — and nothing
+ * else. The paths below are byte-for-byte the SDK's `OIDC_PATHS`.
+ *
+ * There is no `/api/` prefix, no legacy `/oauth/*` or `/login/oauth/*`, and
+ * PKCE (S256) is always on. A bare authorize redirect without PKCE is a
+ * security gap, not just a path nit.
+ */
+/** OIDC endpoint paths, relative to the brand `serverUrl`. Mirrors `@hanzo/iam` `OIDC_PATHS`. */
+export const IAM_OIDC_PATHS = {
+    authorize: '/v1/iam/oauth/authorize',
+    token: '/v1/iam/oauth/token',
+    userinfo: '/v1/iam/oauth/userinfo',
+    jwks: '/v1/iam/.well-known/jwks',
+    logout: '/v1/iam/oauth/logout',
+};
+const trim = (s) => s.replace(/\/+$/, '');
+/** Absolute IAM endpoint URL from a brand origin and a path key. */
+export function iamUrl(serverUrl, key) {
+    return `${trim(serverUrl)}${IAM_OIDC_PATHS[key]}`;
+}
+const PKCE_VERIFIER_KEY = 'hanzo_iam_pkce_verifier';
+const PKCE_STATE_KEY = 'hanzo_iam_state';
+function base64UrlEncode(bytes) {
+    const b = new Uint8Array(bytes);
+    let s = '';
+    for (const x of b)
+        s += String.fromCharCode(x);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function randomVerifier() {
+    const a = new Uint8Array(48);
+    crypto.getRandomValues(a);
+    return base64UrlEncode(a.buffer);
+}
+async function challengeFor(verifier) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return base64UrlEncode(digest);
+}
+/**
+ * Build the canonical IAM authorization-code + PKCE-S256 authorize URL and
+ * stash the verifier + state in `sessionStorage` for the callback. Returned
+ * without redirecting — useful for `<a href>` or tests. `provider` (if given)
+ * rides as `&provider=<name>`; one flow, parameterized.
+ */
+export async function buildIamAuthorizeUrl(opts) {
+    const redirectUri = opts.redirectUri || `${window.location.origin}/auth/callback`;
+    const verifier = randomVerifier();
+    const challenge = await challengeFor(verifier);
+    const state = crypto.randomUUID();
+    sessionStorage.setItem(PKCE_VERIFIER_KEY, verifier);
+    sessionStorage.setItem(PKCE_STATE_KEY, state);
+    const url = new URL(iamUrl(opts.serverUrl, 'authorize'));
+    url.searchParams.set('client_id', opts.clientId);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('scope', opts.scope || 'openid profile email');
+    url.searchParams.set('state', state);
+    url.searchParams.set('code_challenge', challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    if (opts.provider)
+        url.searchParams.set('provider', opts.provider);
+    return url.toString();
+}
+/**
+ * Begin the canonical IAM authorization-code + PKCE-S256 flow by redirecting
+ * the browser to `/v1/iam/oauth/authorize`. The verifier + state are stashed in
+ * `sessionStorage` for the callback to consume. `provider` selects the method.
+ */
+export async function startIamLogin(opts) {
+    window.location.href = await buildIamAuthorizeUrl(opts);
+}

package/dist/src/auth/index.d.ts

@@ -0,0 +1,19 @@
+export { SignIn } from './SignIn';
+export type { SignInProps } from './SignIn';
+export { SocialButton } from './SocialButton';
+export type { SocialButtonProps } from './SocialButton';
+export { PasswordForm } from './PasswordForm';
+export type { PasswordFormProps } from './PasswordForm';
+export { Web3Connect } from './Web3Connect';
+export type { Web3ConnectProps } from './Web3Connect';
+export { IAMLoginButton } from './IAMLoginButton';
+export type { IAMLoginButtonProps } from './IAMLoginButton';
+export { AuthGuard } from './AuthGuard';
+export type { AuthGuardProps } from './AuthGuard';
+export { startIamLogin, buildIamAuthorizeUrl, iamUrl, IAM_OIDC_PATHS } from './iam';
+export type { StartIamLoginOptions } from './iam';
+export type { SignInConfig, SignInMethod, LoginStarter, PasswordSubmit } from './types';
+export { useHanzoAuth } from '../navigation/hanzo-shell/useHanzoAuth';
+export { UserOrgDropdown } from '../navigation/hanzo-shell/UserOrgDropdown';
+export type { HanzoUser, HanzoOrg } from '../navigation/hanzo-shell/types';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,OAAO,CAAA;AACnF,YAAY,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAA;AACjD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAGvF,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAA;AAC3E,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA"}

package/dist/src/auth/index.js

@@ -0,0 +1,14 @@
+// Composable sign-in surface — atoms + the <SignIn> composer.
+// Brand-neutral (CSS tokens), each wired to the canonical IAM PKCE flow.
+export { SignIn } from './SignIn';
+export { SocialButton } from './SocialButton';
+export { PasswordForm } from './PasswordForm';
+export { Web3Connect } from './Web3Connect';
+// Single-button entry + guard (kept for the "Sign in with Hanzo" affordance).
+export { IAMLoginButton } from './IAMLoginButton';
+export { AuthGuard } from './AuthGuard';
+// Mechanism mirror (paths + PKCE authorize) — same contract as `@hanzo/iam`.
+export { startIamLogin, buildIamAuthorizeUrl, iamUrl, IAM_OIDC_PATHS } from './iam';
+// Re-export auth-related navigation components for convenience
+export { useHanzoAuth } from '../navigation/hanzo-shell/useHanzoAuth';
+export { UserOrgDropdown } from '../navigation/hanzo-shell/UserOrgDropdown';

package/dist/src/auth/types.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Shared types for the composable `@hanzo/ui` sign-in surface.
+ *
+ * The presentation layer knows nothing of token exchange — it only knows how
+ * to START a login for a given method. `provider` is the one knob; everything
+ * else is brand config the host supplies once.
+ */
+import type { StartIamLoginOptions } from './iam';
+/**
+ * A sign-in method. `'password'` renders the embedded credential form; any
+ * other string is a provider hint delegated to IAM's shared org-level OAuth
+ * client (`'google'`, `'github'`, `'web3'`, …). One union, parameterized —
+ * never a component per provider.
+ */
+export type SignInMethod = 'password' | 'google' | 'github' | 'web3' | (string & {});
+/** Brand IAM wiring the host supplies once and threads to every atom. */
+export interface SignInConfig {
+    /** Brand IAM origin, e.g. https://hanzo.id. */
+    serverUrl: string;
+    /** OAuth client id (`<org>-<app>`). */
+    clientId: string;
+    /** OAuth callback; defaults to the current origin + `/auth/callback`. */
+    redirectUri?: string;
+    /** Scopes; defaults to `openid profile email`. */
+    scope?: string;
+}
+/**
+ * The injected login starter — composition over coupling. Defaults to the
+ * `@hanzo/iam`-shaped `startIamLogin`, but a host can pass its own (e.g. the
+ * `@hanzo/iam` SDK's `startLogin`) so `@hanzo/ui` stays dependency-light.
+ */
+export type LoginStarter = (opts: StartIamLoginOptions) => void | Promise<void>;
+/**
+ * Submit handler for the embedded password form. Defaults to undefined, in
+ * which case `<PasswordForm>` is inert until a host wires it (the SDK's
+ * `loginWithPassword` is the canonical implementation). Kept out of the
+ * dependency-light core deliberately.
+ */
+export type PasswordSubmit = (creds: {
+    email: string;
+    password: string;
+}) => void | Promise<void>;
+//# sourceMappingURL=types.d.ts.map

package/dist/src/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAA;AAEjD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEpF,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA"}

package/dist/src/auth/types.js

@@ -0,0 +1,8 @@
+/**
+ * Shared types for the composable `@hanzo/ui` sign-in surface.
+ *
+ * The presentation layer knows nothing of token exchange — it only knows how
+ * to START a login for a given method. `provider` is the one knob; everything
+ * else is brand config the host supplies once.
+ */
+export {};

package/dist/src/avatar.d.ts

@@ -0,0 +1,2 @@
+export * from '../primitives/avatar';
+//# sourceMappingURL=avatar.d.ts.map

package/dist/src/avatar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatar.d.ts","sourceRoot":"","sources":["../../src/avatar.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA"}

package/dist/src/avatar.js

@@ -0,0 +1 @@
+export * from '../primitives/avatar';

package/dist/src/badge.d.ts

@@ -0,0 +1,2 @@
+export * from '../primitives/badge';
+//# sourceMappingURL=badge.d.ts.map

package/dist/src/badge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge.d.ts","sourceRoot":"","sources":["../../src/badge.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA"}

package/dist/src/badge.js

@@ -0,0 +1 @@
+export * from '../primitives/badge';

package/dist/src/billing/components/account-members.d.ts

@@ -0,0 +1,10 @@
+import type { BillingAccountMember, BillingRole } from '../types';
+export interface AccountMembersProps {
+    members: BillingAccountMember[];
+    userRole: BillingRole;
+    onInvite?: (email: string, role: BillingRole) => Promise<void>;
+    onChangeRole?: (memberId: string, role: BillingRole) => Promise<void>;
+    onRemove?: (memberId: string) => Promise<void>;
+}
+export declare function AccountMembers({ members, userRole, onInvite, onChangeRole, onRemove }: AccountMembersProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=account-members.d.ts.map