@kanzo-tech/auth 0.2.0

package/dist/store.d.ts

@@ -0,0 +1,52 @@
+import { Session } from './types';
+/**
+ * Where the server keeps what it knows about a signed-in person.
+ *
+ * The default is a cookie and nothing else: the record is sealed into it, and the deployment needs
+ * no database to hold a session. That is the right default and it is not sufficient for everyone —
+ * keasy's `server/src/db/sessions.rs` enforces **one live session per user** and wants a sign-out
+ * to take effect immediately, and a self-contained cookie can do neither. Both are the same
+ * missing ability: a cookie already in someone's hands cannot be taken back.
+ *
+ * So: one interface, one default implementation, and no catalogue. A Redis or SQL store is three
+ * methods a deployment writes; it is not a decision this package should be making on its way past.
+ */
+/**
+ * What the server holds, and the browser never sees.
+ *
+ * The tokens are here rather than on {@link Session} because {@link Session} is the shape the
+ * browser is given. Under the BFF pattern the whole point is that the refresh token stops at the
+ * server, and a type that carried both would make the leak a typo away.
+ */
+export interface SessionRecord {
+    readonly session: Session;
+    /** Rotated on every use, per RFC 10017. The stored one is always the newest issued. */
+    readonly refreshToken?: string;
+    /** Kept for `id_token_hint` at the end-session endpoint; without it the IdP asks who is leaving. */
+    readonly idToken?: string;
+}
+export interface SessionStore {
+    /**
+     * Store a record and return the ticket that identifies it.
+     *
+     * The ticket is what the cookie carries — sealed, so it never travels in the clear. **A store
+     * that enforces one live session per person does it here**, by dropping that person's previous
+     * ticket as it issues this one.
+     */
+    put(record: SessionRecord): Promise<string>;
+    /** The record, or `null` when the ticket is unknown, expired, or has been revoked. */
+    get(ticket: string): Promise<SessionRecord | null>;
+    /** Forget it. Sign-out, and the immediate invalidation a self-contained cookie cannot do. */
+    drop(ticket: string): Promise<void>;
+}
+/**
+ * The default: no server state at all. The ticket *is* the record.
+ *
+ * What it cannot do, stated plainly rather than discovered later: **`drop` does nothing.** Signing
+ * out clears the cookie, which is enough for the person holding the browser and is not enough for
+ * anyone else — a copy of that cookie taken beforehand keeps working until it expires. A session
+ * lifetime is therefore a real security parameter under this store, and "sign out everywhere" is
+ * not implementable on top of it. Give `relyingParty` a store of your own when either matters.
+ */
+export declare function statelessStore(): SessionStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;;;;;;;GAWG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oGAAoG;IACpG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,sFAAsF;IACtF,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnD,6FAA6F;IAC7F,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,YAAY,CAgB7C"}

package/dist/store.js

@@ -0,0 +1,20 @@
+function t() {
+  return {
+    async put(r) {
+      return JSON.stringify(r);
+    },
+    async get(r) {
+      try {
+        return JSON.parse(r);
+      } catch {
+        return null;
+      }
+    },
+    async drop() {
+    }
+  };
+}
+export {
+  t as statelessStore
+};
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sources":["../src/store.ts"],"sourcesContent":["import type { Session } from \"./types\";\n\n/**\n * Where the server keeps what it knows about a signed-in person.\n *\n * The default is a cookie and nothing else: the record is sealed into it, and the deployment needs\n * no database to hold a session. That is the right default and it is not sufficient for everyone —\n * keasy's `server/src/db/sessions.rs` enforces **one live session per user** and wants a sign-out\n * to take effect immediately, and a self-contained cookie can do neither. Both are the same\n * missing ability: a cookie already in someone's hands cannot be taken back.\n *\n * So: one interface, one default implementation, and no catalogue. A Redis or SQL store is three\n * methods a deployment writes; it is not a decision this package should be making on its way past.\n */\n\n/**\n * What the server holds, and the browser never sees.\n *\n * The tokens are here rather than on {@link Session} because {@link Session} is the shape the\n * browser is given. Under the BFF pattern the whole point is that the refresh token stops at the\n * server, and a type that carried both would make the leak a typo away.\n */\nexport interface SessionRecord {\n  readonly session: Session;\n  /** Rotated on every use, per RFC 10017. The stored one is always the newest issued. */\n  readonly refreshToken?: string;\n  /** Kept for `id_token_hint` at the end-session endpoint; without it the IdP asks who is leaving. */\n  readonly idToken?: string;\n}\n\nexport interface SessionStore {\n  /**\n   * Store a record and return the ticket that identifies it.\n   *\n   * The ticket is what the cookie carries — sealed, so it never travels in the clear. **A store\n   * that enforces one live session per person does it here**, by dropping that person's previous\n   * ticket as it issues this one.\n   */\n  put(record: SessionRecord): Promise<string>;\n  /** The record, or `null` when the ticket is unknown, expired, or has been revoked. */\n  get(ticket: string): Promise<SessionRecord | null>;\n  /** Forget it. Sign-out, and the immediate invalidation a self-contained cookie cannot do. */\n  drop(ticket: string): Promise<void>;\n}\n\n/**\n * The default: no server state at all. The ticket *is* the record.\n *\n * What it cannot do, stated plainly rather than discovered later: **`drop` does nothing.** Signing\n * out clears the cookie, which is enough for the person holding the browser and is not enough for\n * anyone else — a copy of that cookie taken beforehand keeps working until it expires. A session\n * lifetime is therefore a real security parameter under this store, and \"sign out everywhere\" is\n * not implementable on top of it. Give `relyingParty` a store of your own when either matters.\n */\nexport function statelessStore(): SessionStore {\n  return {\n    async put(record) {\n      return JSON.stringify(record);\n    },\n    async get(ticket) {\n      try {\n        return JSON.parse(ticket) as SessionRecord;\n      } catch {\n        return null;\n      }\n    },\n    async drop() {\n      /* Nothing to forget: see above, and mean it. */\n    },\n  };\n}\n"],"names":["statelessStore","record","ticket"],"mappings":"AAsDO,SAASA,IAA+B;AAC7C,SAAO;AAAA,IACL,MAAM,IAAIC,GAAQ;AAChB,aAAO,KAAK,UAAUA,CAAM;AAAA,IAC9B;AAAA,IACA,MAAM,IAAIC,GAAQ;AAChB,UAAI;AACF,eAAO,KAAK,MAAMA,CAAM;AAAA,MAC1B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,MAAM,OAAO;AAAA,IAEb;AAAA,EAAA;AAEJ;"}

package/dist/types.d.ts

@@ -0,0 +1,118 @@
+/**
+ * What a session is, and nothing else. No React, no fetch, no Keycloak — those are `claims.ts`'s
+ * problem and the doors'. A consumer reading one file to learn the model should read this one.
+ */
+/** The person. Every field but `id` is optional because a realm decides which scopes it grants. */
+export interface AuthUser {
+    /** The IdP's stable subject (`sub`). Never an email: an email can be reassigned. */
+    readonly id: string;
+    readonly email?: string;
+    readonly name?: string;
+    readonly username?: string;
+}
+/**
+ * One organization the person belongs to, with the roles they hold *inside it*.
+ *
+ * `alias` is the addressable name — the one in a hostname and in a Keycloak scope. `id` is the
+ * stable uuid, present only when the realm's organization mapper is configured to include it, and
+ * is the one to store: an alias can be renamed.
+ */
+export interface Organization {
+    readonly alias: string;
+    readonly id?: string;
+    readonly roles: readonly string[];
+}
+/**
+ * The whole of what the client knows about who is signed in.
+ *
+ * **There is no active organization here, and the absence is the design.** Membership is stable and
+ * comes from the token; which organization you are *looking at* is a property of the request — the
+ * URL — and deriving it per request is what lets two tabs sit in two organizations at once. A field
+ * here would be the single shared value they would fight over.
+ *
+ * `roles` are the realm and client roles: global to the person. Roles held inside an organization
+ * live on that `Organization`. They are kept apart on purpose, because merging them is how a role
+ * granted in one organization comes to authorise something in another.
+ */
+export interface Session {
+    readonly user: AuthUser;
+    readonly roles: readonly string[];
+    readonly organizations: readonly Organization[];
+    /** Epoch milliseconds. The client uses it to refresh early, never to decide access. */
+    readonly expiresAt: number;
+}
+/** Where to come back to, and which organization to ask for, when sending someone to the IdP. */
+export interface SignInOptions {
+    /** Defaults to the current URL. */
+    readonly returnTo?: string;
+    /**
+     * Ask Keycloak for one organization's scope rather than every one the person belongs to.
+     * Omitted, a multi-tenant product should request `organization:*` — `DEFAULT_SCOPE` in
+     * `browser.ts` carries why the star is not optional.
+     */
+    readonly organization?: string;
+}
+/**
+ * What a product holds, and the only seam between the two deployment patterns.
+ *
+ * RFC 10017 names three architectures for browser applications and this package implements two:
+ * a **Backend For Frontend**, where the token never reaches the browser and a cookie carries the
+ * session, and a **browser-based OAuth client** with PKCE, for the SPA that has no server to put a
+ * confidential client in. `bffAuth` and `browserAuth` are those two, and they are interchangeable
+ * here — which is what lets `useSession`, `Gate` and `auth.fetch` be written once.
+ *
+ * A product names its pattern on one line, at startup, and nothing downstream knows which it chose.
+ */
+export interface Auth {
+    /** The session now, or `null`. Answers from cache and renews when near expiry. */
+    getSession(): Promise<Session | null>;
+    /**
+     * Call `onChange` when the session does — signed in, signed out, renewed, or changed in another
+     * tab. Returns the unsubscribe.
+     */
+    subscribe(onChange: () => void): () => void;
+    signIn(options?: SignInOptions): Promise<void>;
+    signOut(options?: {
+        readonly returnTo?: string;
+    }): Promise<void>;
+    /**
+     * A `fetch` that stays authenticated: the bearer token under one pattern, the cookie riding
+     * along by itself under the other, and a single retry after a renewal in both.
+     */
+    readonly fetch: typeof globalThis.fetch;
+}
+/**
+ * Why a credential was refused, as a code a product can route on.
+ *
+ * A boolean cannot be acted upon: "not signed in" sends the person to the IdP, "signed in but not a
+ * member" sends them to a page that says so, and telling them apart is the difference between a
+ * redirect loop and an explanation. The shape is borrowed from `agents/gateway`, which reports
+ * `validity.expired` / `proof.signature-invalid` / `issuer.unexpected` for the same reason.
+ *
+ * **These codes are about a credential, and only about a credential.** A programming or deployment
+ * fault is not one: `useSession` called outside its provider, or a session too large for a cookie,
+ * both throw a plain `Error` on purpose. Giving those codes would invite a product to `catch` them
+ * beside a refusal and route them to a sign-in page, which is the wrong answer to "you wired this
+ * up wrong" — and it would put a deployment mistake in the same type as a user's session expiring.
+ *
+ * *What would reverse it:* a product needing to route on one of those programmatically rather than
+ * read it in a stack trace. None has; both are faults you fix once, not conditions you handle.
+ */
+export type AuthErrorCode = 
+/** The claims carry no `sub`. Not a session at all — a configuration or IdP fault, never a user's. */
+"claims.no-subject"
+/** There is no session. The person has not signed in, or it expired. */
+ | "session.absent"
+/** Signed in, but holds no membership of the organization being addressed. */
+ | "organization.not-a-member"
+/** The callback's `state` is absent, different, or has no transaction to match against. */
+ | "callback.state-mismatch"
+/** The ID token's `nonce` is not the one that was sent — a replay. */
+ | "callback.nonce-mismatch"
+/** The token endpoint refused the code or the refresh token, or returned no ID token. */
+ | "token.exchange-failed";
+export declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    constructor(code: AuthErrorCode, message: string);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,mGAAmG;AACnG,MAAM,WAAW,QAAQ;IACvB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,iGAAiG;AACjG,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,IAAI;IACnB,kFAAkF;IAClF,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACtC;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5C,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa;AACvB,sGAAsG;AACpG,mBAAmB;AACrB,wEAAwE;GACtE,gBAAgB;AAClB,8EAA8E;GAC5E,2BAA2B;AAC7B,2FAA2F;GACzF,yBAAyB;AAC3B,sEAAsE;GACpE,yBAAyB;AAC3B,yFAAyF;GACvF,uBAAuB,CAAC;AAE5B,qBAAa,SAAU,SAAQ,KAAK;IAEhC,QAAQ,CAAC,IAAI,EAAE,aAAa;gBAAnB,IAAI,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM;CAKlB"}

package/dist/types.js

@@ -0,0 +1,9 @@
+class s extends Error {
+  constructor(r, t) {
+    super(t), this.code = r, this.name = "AuthError";
+  }
+}
+export {
+  s as AuthError
+};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sources":["../src/types.ts"],"sourcesContent":["/**\n * What a session is, and nothing else. No React, no fetch, no Keycloak — those are `claims.ts`'s\n * problem and the doors'. A consumer reading one file to learn the model should read this one.\n */\n\n/** The person. Every field but `id` is optional because a realm decides which scopes it grants. */\nexport interface AuthUser {\n  /** The IdP's stable subject (`sub`). Never an email: an email can be reassigned. */\n  readonly id: string;\n  readonly email?: string;\n  readonly name?: string;\n  readonly username?: string;\n}\n\n/**\n * One organization the person belongs to, with the roles they hold *inside it*.\n *\n * `alias` is the addressable name — the one in a hostname and in a Keycloak scope. `id` is the\n * stable uuid, present only when the realm's organization mapper is configured to include it, and\n * is the one to store: an alias can be renamed.\n */\nexport interface Organization {\n  readonly alias: string;\n  readonly id?: string;\n  readonly roles: readonly string[];\n}\n\n/**\n * The whole of what the client knows about who is signed in.\n *\n * **There is no active organization here, and the absence is the design.** Membership is stable and\n * comes from the token; which organization you are *looking at* is a property of the request — the\n * URL — and deriving it per request is what lets two tabs sit in two organizations at once. A field\n * here would be the single shared value they would fight over.\n *\n * `roles` are the realm and client roles: global to the person. Roles held inside an organization\n * live on that `Organization`. They are kept apart on purpose, because merging them is how a role\n * granted in one organization comes to authorise something in another.\n */\nexport interface Session {\n  readonly user: AuthUser;\n  readonly roles: readonly string[];\n  readonly organizations: readonly Organization[];\n  /** Epoch milliseconds. The client uses it to refresh early, never to decide access. */\n  readonly expiresAt: number;\n}\n\n/** Where to come back to, and which organization to ask for, when sending someone to the IdP. */\nexport interface SignInOptions {\n  /** Defaults to the current URL. */\n  readonly returnTo?: string;\n  /**\n   * Ask Keycloak for one organization's scope rather than every one the person belongs to.\n   * Omitted, a multi-tenant product should request `organization:*` — `DEFAULT_SCOPE` in\n   * `browser.ts` carries why the star is not optional.\n   */\n  readonly organization?: string;\n}\n\n/**\n * What a product holds, and the only seam between the two deployment patterns.\n *\n * RFC 10017 names three architectures for browser applications and this package implements two:\n * a **Backend For Frontend**, where the token never reaches the browser and a cookie carries the\n * session, and a **browser-based OAuth client** with PKCE, for the SPA that has no server to put a\n * confidential client in. `bffAuth` and `browserAuth` are those two, and they are interchangeable\n * here — which is what lets `useSession`, `Gate` and `auth.fetch` be written once.\n *\n * A product names its pattern on one line, at startup, and nothing downstream knows which it chose.\n */\nexport interface Auth {\n  /** The session now, or `null`. Answers from cache and renews when near expiry. */\n  getSession(): Promise<Session | null>;\n  /**\n   * Call `onChange` when the session does — signed in, signed out, renewed, or changed in another\n   * tab. Returns the unsubscribe.\n   */\n  subscribe(onChange: () => void): () => void;\n  signIn(options?: SignInOptions): Promise<void>;\n  signOut(options?: { readonly returnTo?: string }): Promise<void>;\n  /**\n   * A `fetch` that stays authenticated: the bearer token under one pattern, the cookie riding\n   * along by itself under the other, and a single retry after a renewal in both.\n   */\n  readonly fetch: typeof globalThis.fetch;\n}\n\n/**\n * Why a credential was refused, as a code a product can route on.\n *\n * A boolean cannot be acted upon: \"not signed in\" sends the person to the IdP, \"signed in but not a\n * member\" sends them to a page that says so, and telling them apart is the difference between a\n * redirect loop and an explanation. The shape is borrowed from `agents/gateway`, which reports\n * `validity.expired` / `proof.signature-invalid` / `issuer.unexpected` for the same reason.\n *\n * **These codes are about a credential, and only about a credential.** A programming or deployment\n * fault is not one: `useSession` called outside its provider, or a session too large for a cookie,\n * both throw a plain `Error` on purpose. Giving those codes would invite a product to `catch` them\n * beside a refusal and route them to a sign-in page, which is the wrong answer to \"you wired this\n * up wrong\" — and it would put a deployment mistake in the same type as a user's session expiring.\n *\n * *What would reverse it:* a product needing to route on one of those programmatically rather than\n * read it in a stack trace. None has; both are faults you fix once, not conditions you handle.\n */\nexport type AuthErrorCode =\n  /** The claims carry no `sub`. Not a session at all — a configuration or IdP fault, never a user's. */\n  | \"claims.no-subject\"\n  /** There is no session. The person has not signed in, or it expired. */\n  | \"session.absent\"\n  /** Signed in, but holds no membership of the organization being addressed. */\n  | \"organization.not-a-member\"\n  /** The callback's `state` is absent, different, or has no transaction to match against. */\n  | \"callback.state-mismatch\"\n  /** The ID token's `nonce` is not the one that was sent — a replay. */\n  | \"callback.nonce-mismatch\"\n  /** The token endpoint refused the code or the refresh token, or returned no ID token. */\n  | \"token.exchange-failed\";\n\nexport class AuthError extends Error {\n  constructor(\n    readonly code: AuthErrorCode,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"AuthError\";\n  }\n}\n"],"names":["AuthError","code","message"],"mappings":"AAsHO,MAAMA,UAAkB,MAAM;AAAA,EACnC,YACWC,GACTC,GACA;AACA,UAAMA,CAAO,GAHJ,KAAA,OAAAD,GAIT,KAAK,OAAO;AAAA,EACd;AACF;"}

package/dist/use-organization.d.ts

@@ -0,0 +1,22 @@
+import { Organization } from './types';
+/**
+ * Which organization this view is *in*, resolved per render rather than stored.
+ *
+ * The session says which organizations you belong to; the URL says which one you are looking at.
+ * `Session` in `types.ts` carries why the second is never stored.
+ *
+ * `alias` names the organization explicitly; omitted, it is read from the hostname. A hostname
+ * naming an organization this person does not belong to yields `organization: undefined` and
+ * `isMember: false` — never a throw, and **never the first organization instead**. Falling back
+ * is how someone ends up reading another customer's data believing it is their own.
+ *
+ * `isMember` answers about the *candidate*, so it is a different question from
+ * `organizations.length > 0`: a product with one membership addressed at the wrong host is a member
+ * of something and a member of nothing here.
+ */
+export declare function useOrganization(alias?: string): {
+    readonly organization: Organization | undefined;
+    readonly organizations: readonly Organization[];
+    readonly isMember: boolean;
+};
+//# sourceMappingURL=use-organization.d.ts.map

package/dist/use-organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-organization.d.ts","sourceRoot":"","sources":["../src/use-organization.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG5C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAC/C,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAmBA"}

package/dist/use-organization.js

@@ -0,0 +1,20 @@
+"use client";
+import { useMemo as r } from "react";
+import { organizationOf as a } from "./can.js";
+import { organizationFromHost as e } from "./host.js";
+import { useSession as m } from "./use-session.js";
+function c(i) {
+  const { session: o } = m();
+  return r(() => {
+    const n = i ?? (typeof window > "u" ? void 0 : e(window.location.hostname)), t = n === void 0 ? void 0 : a(o, n);
+    return {
+      organization: t,
+      organizations: (o == null ? void 0 : o.organizations) ?? [],
+      isMember: t !== void 0
+    };
+  }, [i, o]);
+}
+export {
+  c as useOrganization
+};
+//# sourceMappingURL=use-organization.js.map

package/dist/use-organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-organization.js","sources":["../src/use-organization.ts"],"sourcesContent":["\"use client\";\n\nimport { useMemo } from \"react\";\nimport { organizationOf } from \"./can\";\nimport { organizationFromHost } from \"./host\";\nimport type { Organization } from \"./types\";\nimport { useSession } from \"./use-session\";\n\n/**\n * Which organization this view is *in*, resolved per render rather than stored.\n *\n * The session says which organizations you belong to; the URL says which one you are looking at.\n * `Session` in `types.ts` carries why the second is never stored.\n *\n * `alias` names the organization explicitly; omitted, it is read from the hostname. A hostname\n * naming an organization this person does not belong to yields `organization: undefined` and\n * `isMember: false` — never a throw, and **never the first organization instead**. Falling back\n * is how someone ends up reading another customer's data believing it is their own.\n *\n * `isMember` answers about the *candidate*, so it is a different question from\n * `organizations.length > 0`: a product with one membership addressed at the wrong host is a member\n * of something and a member of nothing here.\n */\nexport function useOrganization(alias?: string): {\n  readonly organization: Organization | undefined;\n  readonly organizations: readonly Organization[];\n  readonly isMember: boolean;\n} {\n  const { session } = useSession();\n\n  return useMemo(() => {\n    // Read at render, and undefined on a server. There is no hydration mismatch to manage: the\n    // session itself arrives in the provider's effect, so the server render and the first client\n    // render both resolve against `null` and agree whatever the hostname says.\n    const candidate =\n      alias ??\n      (typeof window === \"undefined\" ? undefined : organizationFromHost(window.location.hostname));\n\n    const organization = candidate === undefined ? undefined : organizationOf(session, candidate);\n\n    return {\n      organization,\n      organizations: session?.organizations ?? [],\n      isMember: organization !== undefined,\n    };\n  }, [alias, session]);\n}\n"],"names":[],"mappings":";;;;;AAuBO;AAKL;AAEA;AAIE;AAMA;AAAO;AACL;AACyC;AACd;AAAA;AAGjC;;;;"}

package/dist/use-session.d.ts

@@ -0,0 +1,13 @@
+import { AuthContextValue } from './auth-context';
+/**
+ * Who is signed in, and the two things you can do about it.
+ *
+ * `status` is the field to branch on, not `session === null`: those are the same answer for
+ * "anonymous" and "we have not looked yet", and drawing a sign-in prompt during the second is the
+ * flicker every application with a session has shipped at least once.
+ */
+export declare function useSession(): AuthContextValue & {
+    readonly signIn: AuthContextValue["auth"]["signIn"];
+    readonly signOut: AuthContextValue["auth"]["signOut"];
+};
+//# sourceMappingURL=use-session.d.ts.map

package/dist/use-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-session.d.ts","sourceRoot":"","sources":["../src/use-session.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEpE;;;;;;GAMG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,GAAG;IAC/C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;CACvD,CAcA"}

package/dist/use-session.js

@@ -0,0 +1,19 @@
+"use client";
+import { useContext as e } from "react";
+import { AuthContext as n } from "./auth-context.js";
+function s() {
+  const t = e(n);
+  if (t === null)
+    throw new Error(
+      "useSession() was called outside <AuthProvider>. Wrap the application in one, passing the auth it should use — browserAuth() for a SPA, bffAuth() where there is a server."
+    );
+  return {
+    ...t,
+    signIn: t.auth.signIn,
+    signOut: t.auth.signOut
+  };
+}
+export {
+  s as useSession
+};
+//# sourceMappingURL=use-session.js.map

package/dist/use-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-session.js","sources":["../src/use-session.ts"],"sourcesContent":["\"use client\";\n\nimport { useContext } from \"react\";\nimport { AuthContext, type AuthContextValue } from \"./auth-context\";\n\n/**\n * Who is signed in, and the two things you can do about it.\n *\n * `status` is the field to branch on, not `session === null`: those are the same answer for\n * \"anonymous\" and \"we have not looked yet\", and drawing a sign-in prompt during the second is the\n * flicker every application with a session has shipped at least once.\n */\nexport function useSession(): AuthContextValue & {\n  readonly signIn: AuthContextValue[\"auth\"][\"signIn\"];\n  readonly signOut: AuthContextValue[\"auth\"][\"signOut\"];\n} {\n  const context = useContext(AuthContext);\n  if (context === null) {\n    throw new Error(\n      \"useSession() was called outside <AuthProvider>. Wrap the application in one, passing the \" +\n        \"auth it should use — browserAuth() for a SPA, bffAuth() where there is a server.\",\n    );\n  }\n\n  return {\n    ...context,\n    signIn: context.auth.signIn,\n    signOut: context.auth.signOut,\n  };\n}\n"],"names":[],"mappings":";;;AAYO;AAIL;AACA;AACE;AAAU;AACR;AAKJ;AAAO;AACF;AACkB;AACC;AAE1B;;;;"}

package/package.json

@@ -0,0 +1,135 @@
+{
+  "name": "@kanzo-tech/auth",
+  "version": "0.2.0",
+  "description": "Kanzo authentication over Keycloak — the claim vocabulary read into one Session, the role evaluation that knows about organizations, and an authenticated fetch. Sibling of @kanzo-tech/ui, not part of it: the admission rules exclude auth from the generic vocabulary by name.",
+  "type": "module",
+  "license": "MIT",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./browser": {
+      "types": "./dist/browser.d.ts",
+      "import": "./dist/browser.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "import": "./dist/next.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "//peers": "react is REQUIRED: the root barrel exports a provider and hooks, and two copies of React are two context trees. Everything else is optional and lives behind a subpath, because the two deployment patterns in RFC 10017 need different engines and no consumer needs both — oidc-client-ts is the browser protocol behind `./browser`, openid-client and jose are the confidential client behind `./server`, and next is behind `./next`. A SPA installs this package alone. Deliberately absent: tailwind-variants, because nothing here draws — which is also what keeps this package out of the appearance guards, whose corpus in packages/ui/src/guard-corpus.ts selects on exactly that dependency. The day this package grows a screen the dependency arrives with it and the guards pick it up unasked; no list anywhere needs editing.",
+  "peerDependencies": {
+    "jose": "^6",
+    "next": ">=15",
+    "oidc-client-ts": "^3",
+    "openid-client": "^6",
+    "react": ">=19"
+  },
+  "peerDependenciesMeta": {
+    "jose": {
+      "optional": true
+    },
+    "next": {
+      "optional": true
+    },
+    "oidc-client-ts": {
+      "optional": true
+    },
+    "openid-client": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@testing-library/dom": "^10.4.1",
+    "@testing-library/react": "^16.3.2",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "jose": "^6.2.12",
+    "jsdom": "^29.1.1",
+    "next": "^16.2.7",
+    "oidc-client-ts": "^3.5.0",
+    "openid-client": "^6.8.8",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "rollup-plugin-preserve-directives": "^0.4.0"
+  },
+  "//size-limit": "The root barrel was 677 B at the first commit — the claim reader, the role predicate and the types — against a 1 kB budget set deliberately tight, with a note saying the raise would be a line in the commit that landed the hooks rather than a quiet edit. This is that line: 677 B -> 2.19 kB, and the budget goes to 2.5 kB. What grew is the provider, three hooks, `Gate` and `bffAuth`, which is the whole of what a consumer imports to have a session. Every budget here is set just above its first measurement for the same reason: one with 70% headroom detects nothing. Each subpath ignores its own engine, because the consumer installs that explicitly and what is being measured is our adapter over it. What these numbers are really watching for is a door reaching through another: the root barrel must never learn a protocol, and the two Node doors must never learn React. A jump of kilobytes on any of them means one of those happened, and `scripts/smoke-install.mjs` reads the built bytes to say which.",
+  "size-limit": [
+    {
+      "name": "root barrel (JS)",
+      "path": "dist/index.js",
+      "limit": "2.5 kB",
+      "ignore": [
+        "react",
+        "react-dom",
+        "react/jsx-runtime"
+      ]
+    },
+    {
+      "name": "browser subpath (JS)",
+      "path": "dist/browser.js",
+      "limit": "2 kB",
+      "ignore": [
+        "react",
+        "react-dom",
+        "react/jsx-runtime",
+        "oidc-client-ts"
+      ]
+    },
+    {
+      "name": "server subpath (JS)",
+      "path": "dist/server.js",
+      "limit": "3.2 kB",
+      "ignore": [
+        "react",
+        "react-dom",
+        "react/jsx-runtime",
+        "openid-client",
+        "jose"
+      ]
+    },
+    {
+      "name": "next subpath (JS)",
+      "path": "dist/next.js",
+      "limit": "4 kB",
+      "ignore": [
+        "react",
+        "react-dom",
+        "react/jsx-runtime",
+        "openid-client",
+        "jose",
+        "next",
+        "next/server",
+        "next/headers"
+      ]
+    }
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Kanzo-Tech/ui.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://kanzo-tech.github.io/ui",
+  "bugs": {
+    "url": "https://github.com/Kanzo-Tech/ui/issues"
+  },
+  "scripts": {
+    "build": "vite build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "size": "size-limit"
+  }
+}