@kanzo-tech/auth 0.29.0 → 0.30.0

package/README.md

@@ -1,7 +1,7 @@
 # @kanzo-tech/auth
 
-Authentication over Keycloak: the claim vocabulary read into one session, the role evaluation that
-knows about organizations, and an authenticated `fetch`.
+Authentication over Keycloak: a Backend For Frontend for Next in one object, `kanzoAuth`, the claim
+vocabulary read into one session, and the role evaluation that knows about organizations.
 
 ## What it is not
 
@@ -10,14 +10,15 @@ screen is a logo, a legal line, a privacy notice and a button, and every product
 differently — `@kanzo-tech/ui` has the parts to draw one. What is genuinely shared sits underneath,
 and that is what is here.
 
-**There is no protocol in it either.** PKCE, silent renewal, token storage and cross-tab
-coordination are `oidc-client-ts`'s job, behind `./browser`; the confidential client is
-`openid-client`'s, behind `./server`. Writing either by hand is where mistakes turn into
-vulnerabilities, and neither is what this package is for.
+**There is no protocol in it either.** The confidential client is `openid-client`'s, behind
+`./server`, and the browser holds a cookie and no token — RFC 10017's Backend For Frontend, the
+architecture it recommends for business applications. Writing OAuth by hand is where mistakes turn
+into vulnerabilities, and it is not what this package is for.
 
 What is left after those two subtractions is everything this package is: **Keycloak's claims as one
-`Session`, a role predicate that understands organizations, one `fetch` that stays authenticated,
-and the same session shape across two deployment patterns that otherwise share no code.**
+`Session`, a role predicate that understands organizations, and the session lifecycle around them —
+a proxy that renews and ends sessions, back-channel logout, and a browser half that signs in once
+when a session is over.**
 
 ## Why a package, and not `@kanzo-tech/ui`
 
@@ -47,9 +48,18 @@ prising open a token.
 pnpm add @kanzo-tech/auth
 ```
 
-That is the whole of it for a single-page application: the root barrel carries no engine. The other
-doors each name theirs — `oidc-client-ts` for `./browser`, `openid-client` and `jose` for
-`./server`, `next` for `./next` — and a consumer installs only the one it opens.
+The root barrel carries no engine. The server doors name theirs — `openid-client` and `jose` for
+`./server`, and `next` 16 or later as well for `./next` — and a consumer installs only what it
+opens.
+
+```ts
+// lib/auth.ts
+export const auth = kanzoAuth(async () => ({ issuer, clientId, clientSecret, secret, store }));
+// proxy.ts
+export const proxy = (request: NextRequest) => auth.proxy(request);
+// app/api/auth/[...auth]/route.ts
+export const { GET, POST } = auth.routes;
+```
 
 ## The claims it reads
 
@@ -60,7 +70,8 @@ Nothing here is invented. Every claim is one Keycloak emits without being asked:
 | `sub`, `email`, `name` (or `given_name` + `family_name`), `preferred_username` | `session.user` |
 | `realm_access.roles` ∪ `resource_access.<clientId>.roles` | `session.roles` |
 | `organization` — `{ "acme": { "id": "…", "resource_access": { "<clientId>": { "roles": ["editor"] } } } }` | `session.organizations` |
-| `exp` | `session.expiresAt`, in milliseconds |
+| `sid` | the session record, for back-channel logout |
+| — the token response's `expires_in` | `session.expiresAt`, in milliseconds: when the access token expires |
 
 Inside each organization, `resource_access.<clientId>.roles` is what the person holds **there**:
 the roles an organization admin mapped onto the groups they are in, composites expanded by
@@ -69,35 +80,37 @@ application's roles in the same entry are ignored, so a role held in one applica
 authorises its holder in another. Nor are they merged into `session.roles`: a role in one
 organization says nothing about the next.
 
-Ask Keycloak for `organization:*` to receive every organization the person belongs to. Plain
-`organization` returns the only one when there is one and prompts for a choice when there are
-several, which is the documented behaviour behind more than one bug report about the claim
-"disappearing".
+Every sign-in asks Keycloak for `organization:*`, which returns every organization the person
+belongs to. Plain `organization` returns the only one when there is one and prompts for a choice
+when there are several, which is the documented behaviour behind more than one bug report about the
+claim "disappearing".
 
-## Membership is in the session; the active organization is not
+## Membership is stored; the current organization is resolved per request
 
 ```ts
 interface Session {
   user: AuthUser;
   roles: readonly string[];
   organizations: readonly Organization[];
+  organization?: string; // the tenant this request addresses
   expiresAt: number;
 }
 ```
 
-There is no active organization on it, and the absence is deliberate. Membership is stable and comes
-from the token; which organization you are *looking at* is a property of the request — the URL — and
-deriving it per request is what lets two tabs sit in two organizations at once. A field here would
-be the single shared value they would fight over.
+Membership is stable and comes from the token. Which organization a request is *in* is a property
+of the request — its host, its path, a cookie — so `kanzoAuth`'s `organization` resolver answers it
+per request and it is never stored. That is what lets two tabs sit in two organizations at once.
 
 Roles held inside an organization live on that organization, and are never merged into
 `session.roles`. Being an owner of one organization says nothing about another.
 
 ```ts
-can(session, "auditor");           // a realm or client role
-can(session, "owner", "acme");     // a role inside that organization
+can(session, "editor");            // inside session.organization, the current tenant
+can(session, "owner", "acme");     // inside that organization
 ```
 
+With no current tenant, `can` answers from the realm and client roles.
+
 There is no role hierarchy in the predicate. That `owner` outranks `member` is a fact about a
 product, so a product writes it where it can be seen:
 

package/dist/bff-auth.d.ts

@@ -8,8 +8,7 @@ import { Auth, Session } from './types';
  *
  * So there is no engine on this path — no PKCE, no storage, no renewal — which is why it lives on
  * the root barrel beside the hooks rather than behind a subpath. What it needs from the server is
- * three routes, which `@kanzo-tech/auth/next` provides: a session endpoint, a sign-in and a
- * sign-out.
+ * the routes `kanzoAuth` serves: a session endpoint, a refresh, a sign-in and a sign-out.
  */
 export interface BffAuthConfig {
     /** Where the BFF's auth routes are mounted. Default `/api/auth`. */

package/dist/bff-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bff-auth.d.ts","sourceRoot":"","sources":["../src/bff-auth.ts"],"names":[],"mappings":"AAGA,OAAO,EAAa,KAAK,IAAI,EAAqB,KAAK,OAAO,EAAsB,MAAM,SAAS,CAAC;AAEpG;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAyB1D;AAED,wBAAgB,OAAO,CAAC,MAAM,GAAE,aAAkB,GAAG,IAAI,CA8IxD"}
+{"version":3,"file":"bff-auth.d.ts","sourceRoot":"","sources":["../src/bff-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,KAAK,IAAI,EAAqB,KAAK,OAAO,EAAsB,MAAM,SAAS,CAAC;AAEpG;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AA8BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CA6B1D;AAED,wBAAgB,OAAO,CAAC,MAAM,GAAE,aAAkB,GAAG,IAAI,CAgJxD"}

package/dist/bff-auth.js

@@ -1,116 +1,121 @@
-import { isReplayable as $ } from "./auth-fetch.js";
 import { deadline as p } from "./deadline.js";
-import { singleFlight as y } from "./single-flight.js";
-import { AuthError as A } from "./types.js";
-function v(i) {
-  if (typeof i != "object" || i === null) return null;
-  const t = i, o = t.alias;
+import { singleFlight as b } from "./single-flight.js";
+import { AuthError as v } from "./types.js";
+function z(a, r) {
+  if (typeof Request < "u" && a instanceof Request && a.body !== null) return !1;
+  const o = r == null ? void 0 : r.body;
+  return o == null ? !0 : !(typeof ReadableStream < "u" && o instanceof ReadableStream);
+}
+function T(a) {
+  if (typeof a != "object" || a === null) return null;
+  const r = a, o = r.alias;
   return typeof o != "string" || o.length === 0 ? null : {
     alias: o,
-    id: typeof t.id == "string" ? t.id : void 0,
-    roles: Array.isArray(t.roles) ? t.roles.filter((a) => typeof a == "string") : []
+    id: typeof r.id == "string" ? r.id : void 0,
+    roles: Array.isArray(r.roles) ? r.roles.filter((i) => typeof i == "string") : []
   };
 }
-function T(i) {
-  if (typeof i != "object" || i === null) return null;
-  const t = i, o = t.user;
+function S(a) {
+  if (typeof a != "object" || a === null) return null;
+  const r = a, o = r.user;
   if (typeof o != "object" || o === null) return null;
-  const a = o.id;
-  if (typeof a != "string" || a.length === 0) return null;
+  const i = o.id;
+  if (typeof i != "string" || i.length === 0) return null;
   const l = o, c = (s) => typeof l[s] == "string" && l[s] !== "" ? l[s] : void 0;
   return {
-    user: { id: a, email: c("email"), name: c("name"), username: c("username") },
-    roles: Array.isArray(t.roles) ? t.roles.filter((s) => typeof s == "string") : [],
-    organizations: Array.isArray(t.organizations) ? t.organizations.map(v).filter((s) => s !== null) : [],
-    expiresAt: typeof t.expiresAt == "number" ? t.expiresAt : 0
+    user: { id: i, email: c("email"), name: c("name"), username: c("username") },
+    roles: Array.isArray(r.roles) ? r.roles.filter((s) => typeof s == "string") : [],
+    organizations: Array.isArray(r.organizations) ? r.organizations.map(T).filter((s) => s !== null) : [],
+    organization: typeof r.organization == "string" && r.organization !== "" ? r.organization : void 0,
+    expiresAt: typeof r.expiresAt == "number" ? r.expiresAt : 0
   };
 }
-function x(i = {}) {
-  const t = (i.basePath ?? "/api/auth").replace(/\/$/, ""), o = i.fetch ?? ((...r) => globalThis.fetch(...r)), a = i.navigate ?? ((r) => void (globalThis.location.href = r)), l = /* @__PURE__ */ new Set(), c = () => {
-    for (const r of l) r();
+function q(a = {}) {
+  const r = (a.basePath ?? "/api/auth").replace(/\/$/, ""), o = a.fetch ?? ((...e) => globalThis.fetch(...e)), i = a.navigate ?? ((e) => void (globalThis.location.href = e)), l = /* @__PURE__ */ new Set(), c = () => {
+    for (const e of l) e();
   };
-  let s = null, f = !1;
-  const u = (r, e, n) => new A(
+  let s = null, d = !1, g = !1;
+  const f = (e, n, t) => new v(
     "session/unavailable",
-    e === void 0 ? `${r} could not be reached` : `${r} answered ${e}`,
-    e === void 0 ? {} : { status: e },
-    n === void 0 ? void 0 : { cause: n }
-  ), h = async (r, e) => {
-    var n;
+    n === void 0 ? `${e} could not be reached` : `${e} answered ${n}`,
+    n === void 0 ? {} : { status: n },
+    t === void 0 ? void 0 : { cause: t }
+  ), y = async (e, n) => {
+    var t;
     try {
-      return await o(r, e);
-    } catch (d) {
-      throw (n = e.signal) != null && n.aborted ? e.signal.reason : u(r, void 0, d);
+      return await o(e, n);
+    } catch (u) {
+      throw (t = n.signal) != null && t.aborted ? n.signal.reason : f(e, void 0, u);
     }
-  }, m = y(
-    () => p("session/silent", async (r) => {
-      const e = await h(`${t}/session`, { headers: { Accept: "application/json" }, signal: r });
-      if (e.status === 401) return null;
-      if (!e.ok) throw u(`${t}/session`, e.status);
-      let n;
+  }, m = b(
+    () => p("session/silent", async (e) => {
+      const n = await y(`${r}/session`, { headers: { Accept: "application/json" }, signal: e });
+      if (n.status === 401) return null;
+      if (!n.ok) throw f(`${r}/session`, n.status);
+      let t;
       try {
-        n = await e.json();
-      } catch (b) {
-        throw u(`${t}/session`, e.status, b);
+        t = await n.json();
+      } catch (A) {
+        throw f(`${r}/session`, n.status, A);
       }
-      const d = T(n);
-      if (d === null) throw u(`${t}/session`, e.status);
-      return d;
+      const u = S(t);
+      if (u === null) throw f(`${r}/session`, n.status);
+      return u;
     })
-  ), w = y(
-    () => p("session/silent", async (r) => {
-      const e = await h(`${t}/refresh`, {
+  ), w = b(
+    () => p("session/silent", async (e) => {
+      const n = await y(`${r}/refresh`, {
         method: "POST",
         headers: { Accept: "application/json" },
-        signal: r
+        signal: e
       });
-      if (e.status >= 500) throw u(`${t}/refresh`, e.status);
-      return e.ok;
+      if (n.status >= 500) throw f(`${r}/refresh`, n.status);
+      return n.ok;
     })
-  ), g = async () => {
-    const r = s;
-    return s = await m(), f = !0, (r === null != (s === null) || (r == null ? void 0 : r.user.id) !== (s == null ? void 0 : s.user.id)) && c(), s;
+  ), $ = async () => {
+    const e = s;
+    return s = await m(), d = !0, (e === null != (s === null) || (e == null ? void 0 : e.user.id) !== (s == null ? void 0 : s.user.id)) && c(), s;
+  }, h = async (e = {}) => {
+    var t;
+    const n = new URLSearchParams();
+    n.set("returnTo", e.returnTo ?? ((t = globalThis.location) == null ? void 0 : t.href) ?? "/"), e.organization !== void 0 && n.set("organization", e.organization), i(`${r}/signin?${n.toString()}`);
   };
   return {
     async getSession() {
-      return f ? s : g();
-    },
-    subscribe(r) {
-      return l.add(r), () => l.delete(r);
+      return d ? s : $();
     },
-    async signIn(r = {}) {
-      var n;
-      const e = new URLSearchParams();
-      e.set("returnTo", r.returnTo ?? ((n = globalThis.location) == null ? void 0 : n.href) ?? "/"), r.organization !== void 0 && e.set("organization", r.organization), a(`${t}/signin?${e.toString()}`);
+    subscribe(e) {
+      return l.add(e), () => l.delete(e);
     },
-    async signOut(r = {}) {
-      const e = new URLSearchParams();
-      r.returnTo !== void 0 && e.set("returnTo", r.returnTo);
-      const n = e.toString();
-      a(n ? `${t}/signout?${n}` : `${t}/signout`);
+    signIn: h,
+    async signOut(e = {}) {
+      const n = new URLSearchParams();
+      e.returnTo !== void 0 && n.set("returnTo", e.returnTo);
+      const t = n.toString();
+      i(t ? `${r}/signout?${t}` : `${r}/signout`);
     },
     /**
      * No `Authorization` header — the cookie rides along on a same-origin request by itself — and
      * **one** retry, behind one renewal.
      *
-     * A 401 here is ambiguous in a way it is not under `browserAuth`: the cookie was sent and was
-     * accepted, so what expired is the access token *behind* the cookie, which this half of the
-     * pattern cannot see. So the 401 is taken as "renew and try again" first and as "the session
-     * is gone" only when the renewal is refused — at which point re-reading tells the tree, which
-     * is what it did before and all it did before.
+     * A 401 here is ambiguous: the cookie was sent and was accepted, so what expired may be the
+     * access token *behind* the cookie, which this half of the pattern cannot see. So the 401 is
+     * taken as "renew and try again" first, and as "the session is over" only when the renewal is
+     * refused — and then the answer is to sign in, once, coming back to this page. One layer: a
+     * product's data client does not need a 401 branch of its own.
      *
-     * The retry is once, for the reason `authFetch` gives: twice turns an ended session into a
-     * loop against the authorization server. A request whose body cannot be replayed is not
-     * retried at all, and `isReplayable` is the same predicate the bearer-token path uses.
+     * The retry is once: twice turns an ended session into a loop against the authorization server.
+     * A request whose body cannot be replayed is not retried at all.
      */
-    fetch: async (r, e) => {
-      const n = await o(r, e);
-      return n.status !== 401 || !f ? n : await w() ? $(r, e) ? o(r, e) : n : (f = !1, await g().catch(c), n);
+    fetch: async (e, n) => {
+      var u;
+      const t = await o(e, n);
+      return t.status !== 401 || !d ? t : await w() ? z(e, n) ? o(e, n) : t : (g || (g = !0, await h({ returnTo: (u = globalThis.location) == null ? void 0 : u.href })), t);
     }
   };
 }
 export {
-  x as bffAuth,
-  T as readSession
+  q as bffAuth,
+  S as readSession
 };
 //# sourceMappingURL=bff-auth.js.map

package/dist/bff-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"bff-auth.js","sources":["../src/bff-auth.ts"],"sourcesContent":["import { isReplayable } from \"./auth-fetch\";\nimport { deadline } from \"./deadline\";\nimport { singleFlight } from \"./single-flight\";\nimport { AuthError, type Auth, type Organization, type Session, type SignInOptions } from \"./types\";\n\n/**\n * The Backend-For-Frontend pattern: the token never reaches the browser.\n *\n * RFC 10017 calls this one *\"strongly recommended for business applications, sensitive\n * applications, and applications that handle personal data\"*. The server holds the confidential\n * client and the tokens; the browser holds a cookie it cannot read, and asks the server who it is.\n *\n * So there is no engine on this path — no PKCE, no storage, no renewal — which is why it lives on\n * the root barrel beside the hooks rather than behind a subpath. What it needs from the server is\n * three routes, which `@kanzo-tech/auth/next` provides: a session endpoint, a sign-in and a\n * sign-out.\n */\n\nexport interface BffAuthConfig {\n  /** Where the BFF's auth routes are mounted. Default `/api/auth`. */\n  readonly basePath?: string;\n  /** Injectable for tests. Defaults to the global. */\n  readonly fetch?: typeof globalThis.fetch;\n  /** Injectable for tests. Defaults to assigning `window.location`. */\n  readonly navigate?: (url: string) => void;\n}\n\nfunction readOrganization(value: unknown): Organization | null {\n  if (typeof value !== \"object\" || value === null) return null;\n  const org = value as Record<string, unknown>;\n  const alias = org[\"alias\"];\n  if (typeof alias !== \"string\" || alias.length === 0) return null;\n  return {\n    alias,\n    id: typeof org[\"id\"] === \"string\" ? org[\"id\"] : undefined,\n    roles: Array.isArray(org[\"roles\"])\n      ? org[\"roles\"].filter((r): r is string => typeof r === \"string\")\n      : [],\n  };\n}\n\n/**\n * The session endpoint's answer, checked rather than cast.\n *\n * It is our own server on the other end, and it is still **data off the wire**: a cast here would\n * make a deploy skew or a proxy's error page arrive as a `Session` whose `user` is undefined, and\n * the failure would surface three components away as a property read on nothing. `null` for\n * anything unrecognisable; `bffAuth` reads a 200 it cannot read as `session/unavailable`, because\n * the endpoint answers \"nobody is signed in\" with a 401 and never with a body.\n */\nexport function readSession(value: unknown): Session | null {\n  if (typeof value !== \"object\" || value === null) return null;\n  const body = value as Record<string, unknown>;\n\n  const user = body[\"user\"];\n  if (typeof user !== \"object\" || user === null) return null;\n  const id = (user as Record<string, unknown>)[\"id\"];\n  if (typeof id !== \"string\" || id.length === 0) return null;\n\n  const person = user as Record<string, unknown>;\n  const str = (key: string) =>\n    typeof person[key] === \"string\" && person[key] !== \"\" ? (person[key] as string) : undefined;\n\n  return {\n    user: { id, email: str(\"email\"), name: str(\"name\"), username: str(\"username\") },\n    roles: Array.isArray(body[\"roles\"])\n      ? body[\"roles\"].filter((r): r is string => typeof r === \"string\")\n      : [],\n    organizations: Array.isArray(body[\"organizations\"])\n      ? body[\"organizations\"]\n          .map(readOrganization)\n          .filter((o): o is Organization => o !== null)\n      : [],\n    expiresAt: typeof body[\"expiresAt\"] === \"number\" ? body[\"expiresAt\"] : 0,\n  };\n}\n\nexport function bffAuth(config: BffAuthConfig = {}): Auth {\n  const base = (config.basePath ?? \"/api/auth\").replace(/\\/$/, \"\");\n  const doFetch = config.fetch ?? ((...args) => globalThis.fetch(...args));\n  const go = config.navigate ?? ((url: string) => void (globalThis.location.href = url));\n\n  const listeners = new Set<() => void>();\n  const announce = () => {\n    for (const listener of listeners) listener();\n  };\n\n  let cached: Session | null = null;\n  let known = false;\n\n  const unavailable = (url: string, status: number | undefined, cause?: unknown) =>\n    new AuthError(\n      \"session/unavailable\",\n      status === undefined ? `${url} could not be reached` : `${url} answered ${status}`,\n      status === undefined ? {} : { status },\n      cause === undefined ? undefined : { cause },\n    );\n\n  const send = async (url: string, init: RequestInit): Promise<Response> => {\n    try {\n      return await doFetch(url, init);\n    } catch (error) {\n      if (init.signal?.aborted) throw init.signal.reason;\n      throw unavailable(url, undefined, error);\n    }\n  };\n\n  // Single-flight for the same reason the token path needs it: a page that mounts six components\n  // asks six times in one tick, and one answer serves them all. Here it costs a request rather\n  // than a revoked token chain, which is a smaller bill for the same mistake.\n  //\n  // A 401 is the documented answer for \"nobody is signed in\". Anything else that is not a session\n  // — a 5xx, a proxy's page, no answer at all — is a failure, and reading it as \"signed out\" would\n  // send the person to sign in over an outage that will still be there when they get back.\n  const read = singleFlight(() =>\n    deadline(\"session/silent\", async (signal): Promise<Session | null> => {\n      const response = await send(`${base}/session`, { headers: { Accept: \"application/json\" }, signal });\n      if (response.status === 401) return null;\n      if (!response.ok) throw unavailable(`${base}/session`, response.status);\n      let body: unknown;\n      try {\n        body = await response.json();\n      } catch (error) {\n        throw unavailable(`${base}/session`, response.status, error);\n      }\n      const session = readSession(body);\n      if (session === null) throw unavailable(`${base}/session`, response.status);\n      return session;\n    }),\n  );\n\n  /**\n   * Ask the BFF to spend the refresh token, once for however many requests noticed at the moment.\n   *\n   * This is the browser end of the renewal, and without it the session cookie's lifetime and the\n   * access token's are two different clocks with nothing between them: a cookie good for eight\n   * hours in front of a token good for one produces seven hours in which `/session` answers 200,\n   * the whole application draws, and every request for data is a 401 that nothing acts on.\n   *\n   * `POST`, because the route only answers `POST` — it spends something, and a `GET` that spends\n   * something is one prefetch away from spending it unasked.\n   */\n  const renew = singleFlight(() =>\n    deadline(\"session/silent\", async (signal): Promise<boolean> => {\n      const response = await send(`${base}/refresh`, {\n        method: \"POST\",\n        headers: { Accept: \"application/json\" },\n        signal,\n      });\n      // A refusal (401, 400) is the end of the session; a 5xx is an outage, not a refusal.\n      if (response.status >= 500) throw unavailable(`${base}/refresh`, response.status);\n      return response.ok;\n    }),\n  );\n\n  const refresh = async (): Promise<Session | null> => {\n    const next = cached;\n    cached = await read();\n    known = true;\n    // Announce only a change, so a poll does not re-render the tree every time.\n    if ((next === null) !== (cached === null) || next?.user.id !== cached?.user.id) announce();\n    return cached;\n  };\n\n  return {\n    async getSession() {\n      if (known) return cached;\n      return refresh();\n    },\n\n    subscribe(onChange) {\n      listeners.add(onChange);\n      return () => listeners.delete(onChange);\n    },\n\n    async signIn(options: SignInOptions = {}) {\n      const params = new URLSearchParams();\n      params.set(\"returnTo\", options.returnTo ?? globalThis.location?.href ?? \"/\");\n      if (options.organization !== undefined) params.set(\"organization\", options.organization);\n      go(`${base}/signin?${params.toString()}`);\n    },\n\n    async signOut(options = {}) {\n      const params = new URLSearchParams();\n      if (options.returnTo !== undefined) params.set(\"returnTo\", options.returnTo);\n      const query = params.toString();\n      go(query ? `${base}/signout?${query}` : `${base}/signout`);\n    },\n\n    /**\n     * No `Authorization` header — the cookie rides along on a same-origin request by itself — and\n     * **one** retry, behind one renewal.\n     *\n     * A 401 here is ambiguous in a way it is not under `browserAuth`: the cookie was sent and was\n     * accepted, so what expired is the access token *behind* the cookie, which this half of the\n     * pattern cannot see. So the 401 is taken as \"renew and try again\" first and as \"the session\n     * is gone\" only when the renewal is refused — at which point re-reading tells the tree, which\n     * is what it did before and all it did before.\n     *\n     * The retry is once, for the reason `authFetch` gives: twice turns an ended session into a\n     * loop against the authorization server. A request whose body cannot be replayed is not\n     * retried at all, and `isReplayable` is the same predicate the bearer-token path uses.\n     */\n    fetch: async (input, init) => {\n      const response = await doFetch(input, init);\n      if (response.status !== 401 || !known) return response;\n\n      if (await renew()) {\n        if (!isReplayable(input, init)) return response;\n        return doFetch(input, init);\n      }\n\n      known = false;\n      // The caller is owed its own response; a session that cannot be re-read is the provider's to\n      // show, and announcing makes it read again and see the failure itself.\n      await refresh().catch(announce);\n      return response;\n    },\n  };\n}\n"],"names":["readOrganization","value","org","alias","r","readSession","body","user","id","person","str","key","o","bffAuth","config","base","doFetch","args","go","url","listeners","announce","listener","cached","known","unavailable","status","cause","AuthError","send","init","error","_a","read","singleFlight","deadline","signal","response","session","renew","refresh","next","onChange","options","params","query","input","isReplayable"],"mappings":";;;;AA2BA,SAASA,EAAiBC,GAAqC;AAC7D,MAAI,OAAOA,KAAU,YAAYA,MAAU,KAAM,QAAO;AACxD,QAAMC,IAAMD,GACNE,IAAQD,EAAI;AAClB,SAAI,OAAOC,KAAU,YAAYA,EAAM,WAAW,IAAU,OACrD;AAAA,IACL,OAAAA;AAAA,IACA,IAAI,OAAOD,EAAI,MAAU,WAAWA,EAAI,KAAQ;AAAA,IAChD,OAAO,MAAM,QAAQA,EAAI,KAAQ,IAC7BA,EAAI,MAAS,OAAO,CAACE,MAAmB,OAAOA,KAAM,QAAQ,IAC7D,CAAA;AAAA,EAAC;AAET;AAWO,SAASC,EAAYJ,GAAgC;AAC1D,MAAI,OAAOA,KAAU,YAAYA,MAAU,KAAM,QAAO;AACxD,QAAMK,IAAOL,GAEPM,IAAOD,EAAK;AAClB,MAAI,OAAOC,KAAS,YAAYA,MAAS,KAAM,QAAO;AACtD,QAAMC,IAAMD,EAAiC;AAC7C,MAAI,OAAOC,KAAO,YAAYA,EAAG,WAAW,EAAG,QAAO;AAEtD,QAAMC,IAASF,GACTG,IAAM,CAACC,MACX,OAAOF,EAAOE,CAAG,KAAM,YAAYF,EAAOE,CAAG,MAAM,KAAMF,EAAOE,CAAG,IAAe;AAEpF,SAAO;AAAA,IACL,MAAM,EAAE,IAAAH,GAAI,OAAOE,EAAI,OAAO,GAAG,MAAMA,EAAI,MAAM,GAAG,UAAUA,EAAI,UAAU,EAAA;AAAA,IAC5E,OAAO,MAAM,QAAQJ,EAAK,KAAQ,IAC9BA,EAAK,MAAS,OAAO,CAACF,MAAmB,OAAOA,KAAM,QAAQ,IAC9D,CAAA;AAAA,IACJ,eAAe,MAAM,QAAQE,EAAK,aAAgB,IAC9CA,EAAK,cACF,IAAIN,CAAgB,EACpB,OAAO,CAACY,MAAyBA,MAAM,IAAI,IAC9C,CAAA;AAAA,IACJ,WAAW,OAAON,EAAK,aAAiB,WAAWA,EAAK,YAAe;AAAA,EAAA;AAE3E;AAEO,SAASO,EAAQC,IAAwB,IAAU;AACxD,QAAMC,KAAQD,EAAO,YAAY,aAAa,QAAQ,OAAO,EAAE,GACzDE,IAAUF,EAAO,UAAU,IAAIG,MAAS,WAAW,MAAM,GAAGA,CAAI,IAChEC,IAAKJ,EAAO,aAAa,CAACK,MAAgB,MAAM,WAAW,SAAS,OAAOA,KAE3EC,wBAAgB,IAAA,GAChBC,IAAW,MAAM;AACrB,eAAWC,KAAYF,EAAW,CAAAE,EAAA;AAAA,EACpC;AAEA,MAAIC,IAAyB,MACzBC,IAAQ;AAEZ,QAAMC,IAAc,CAACN,GAAaO,GAA4BC,MAC5D,IAAIC;AAAA,IACF;AAAA,IACAF,MAAW,SAAY,GAAGP,CAAG,0BAA0B,GAAGA,CAAG,aAAaO,CAAM;AAAA,IAChFA,MAAW,SAAY,KAAK,EAAE,QAAAA,EAAA;AAAA,IAC9BC,MAAU,SAAY,SAAY,EAAE,OAAAA,EAAA;AAAA,EAAM,GAGxCE,IAAO,OAAOV,GAAaW,MAAyC;;AACxE,QAAI;AACF,aAAO,MAAMd,EAAQG,GAAKW,CAAI;AAAA,IAChC,SAASC,GAAO;AACd,aAAIC,IAAAF,EAAK,WAAL,QAAAE,EAAa,UAAeF,EAAK,OAAO,SACtCL,EAAYN,GAAK,QAAWY,CAAK;AAAA,IACzC;AAAA,EACF,GASME,IAAOC;AAAA,IAAa,MACxBC,EAAS,kBAAkB,OAAOC,MAAoC;AACpE,YAAMC,IAAW,MAAMR,EAAK,GAAGd,CAAI,YAAY,EAAE,SAAS,EAAE,QAAQ,mBAAA,GAAsB,QAAAqB,GAAQ;AAClG,UAAIC,EAAS,WAAW,IAAK,QAAO;AACpC,UAAI,CAACA,EAAS,GAAI,OAAMZ,EAAY,GAAGV,CAAI,YAAYsB,EAAS,MAAM;AACtE,UAAI/B;AACJ,UAAI;AACF,QAAAA,IAAO,MAAM+B,EAAS,KAAA;AAAA,MACxB,SAASN,GAAO;AACd,cAAMN,EAAY,GAAGV,CAAI,YAAYsB,EAAS,QAAQN,CAAK;AAAA,MAC7D;AACA,YAAMO,IAAUjC,EAAYC,CAAI;AAChC,UAAIgC,MAAY,KAAM,OAAMb,EAAY,GAAGV,CAAI,YAAYsB,EAAS,MAAM;AAC1E,aAAOC;AAAA,IACT,CAAC;AAAA,EAAA,GAcGC,IAAQL;AAAA,IAAa,MACzBC,EAAS,kBAAkB,OAAOC,MAA6B;AAC7D,YAAMC,IAAW,MAAMR,EAAK,GAAGd,CAAI,YAAY;AAAA,QAC7C,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,mBAAA;AAAA,QACnB,QAAAqB;AAAA,MAAA,CACD;AAED,UAAIC,EAAS,UAAU,IAAK,OAAMZ,EAAY,GAAGV,CAAI,YAAYsB,EAAS,MAAM;AAChF,aAAOA,EAAS;AAAA,IAClB,CAAC;AAAA,EAAA,GAGGG,IAAU,YAAqC;AACnD,UAAMC,IAAOlB;AACb,WAAAA,IAAS,MAAMU,EAAA,GACfT,IAAQ,KAEHiB,MAAS,SAAWlB,MAAW,UAASkB,KAAA,gBAAAA,EAAM,KAAK,SAAOlB,KAAA,gBAAAA,EAAQ,KAAK,QAAIF,EAAA,GACzEE;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,aAAa;AACjB,aAAIC,IAAcD,IACXiB,EAAA;AAAA,IACT;AAAA,IAEA,UAAUE,GAAU;AAClB,aAAAtB,EAAU,IAAIsB,CAAQ,GACf,MAAMtB,EAAU,OAAOsB,CAAQ;AAAA,IACxC;AAAA,IAEA,MAAM,OAAOC,IAAyB,IAAI;;AACxC,YAAMC,IAAS,IAAI,gBAAA;AACnB,MAAAA,EAAO,IAAI,YAAYD,EAAQ,cAAYX,IAAA,WAAW,aAAX,gBAAAA,EAAqB,SAAQ,GAAG,GACvEW,EAAQ,iBAAiB,YAAkB,IAAI,gBAAgBA,EAAQ,YAAY,GACvFzB,EAAG,GAAGH,CAAI,WAAW6B,EAAO,SAAA,CAAU,EAAE;AAAA,IAC1C;AAAA,IAEA,MAAM,QAAQD,IAAU,IAAI;AAC1B,YAAMC,IAAS,IAAI,gBAAA;AACnB,MAAID,EAAQ,aAAa,YAAkB,IAAI,YAAYA,EAAQ,QAAQ;AAC3E,YAAME,IAAQD,EAAO,SAAA;AACrB,MAAA1B,EAAG2B,IAAQ,GAAG9B,CAAI,YAAY8B,CAAK,KAAK,GAAG9B,CAAI,UAAU;AAAA,IAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAgBA,OAAO,OAAO+B,GAAOhB,MAAS;AAC5B,YAAMO,IAAW,MAAMrB,EAAQ8B,GAAOhB,CAAI;AAC1C,aAAIO,EAAS,WAAW,OAAO,CAACb,IAAca,IAE1C,MAAME,MACHQ,EAAaD,GAAOhB,CAAI,IACtBd,EAAQ8B,GAAOhB,CAAI,IADaO,KAIzCb,IAAQ,IAGR,MAAMgB,EAAA,EAAU,MAAMnB,CAAQ,GACvBgB;AAAA,IACT;AAAA,EAAA;AAEJ;"}
+{"version":3,"file":"bff-auth.js","sources":["../src/bff-auth.ts"],"sourcesContent":["import { deadline } from \"./deadline\";\nimport { singleFlight } from \"./single-flight\";\nimport { AuthError, type Auth, type Organization, type Session, type SignInOptions } from \"./types\";\n\n/**\n * The Backend-For-Frontend pattern: the token never reaches the browser.\n *\n * RFC 10017 calls this one *\"strongly recommended for business applications, sensitive\n * applications, and applications that handle personal data\"*. The server holds the confidential\n * client and the tokens; the browser holds a cookie it cannot read, and asks the server who it is.\n *\n * So there is no engine on this path — no PKCE, no storage, no renewal — which is why it lives on\n * the root barrel beside the hooks rather than behind a subpath. What it needs from the server is\n * the routes `kanzoAuth` serves: a session endpoint, a refresh, a sign-in and a sign-out.\n */\n\nexport interface BffAuthConfig {\n  /** Where the BFF's auth routes are mounted. Default `/api/auth`. */\n  readonly basePath?: string;\n  /** Injectable for tests. Defaults to the global. */\n  readonly fetch?: typeof globalThis.fetch;\n  /** Injectable for tests. Defaults to assigning `window.location`. */\n  readonly navigate?: (url: string) => void;\n}\n\n/**\n * Can this request be sent a second time?\n *\n * A body that is a stream can be read once, so a retry would send an empty one — silently, with a\n * misleading error at the far end. Where we cannot prove the body is replayable we do not retry: the\n * 401 reaches the caller, which is honest, rather than a corrupted request reaching the server.\n */\nfunction isReplayable(input: RequestInfo | URL, init?: RequestInit): boolean {\n  if (typeof Request !== \"undefined\" && input instanceof Request && input.body !== null) return false;\n  const body = init?.body;\n  if (body === undefined || body === null) return true;\n  return !(typeof ReadableStream !== \"undefined\" && body instanceof ReadableStream);\n}\n\nfunction readOrganization(value: unknown): Organization | null {\n  if (typeof value !== \"object\" || value === null) return null;\n  const org = value as Record<string, unknown>;\n  const alias = org[\"alias\"];\n  if (typeof alias !== \"string\" || alias.length === 0) return null;\n  return {\n    alias,\n    id: typeof org[\"id\"] === \"string\" ? org[\"id\"] : undefined,\n    roles: Array.isArray(org[\"roles\"])\n      ? org[\"roles\"].filter((r): r is string => typeof r === \"string\")\n      : [],\n  };\n}\n\n/**\n * The session endpoint's answer, checked rather than cast.\n *\n * It is our own server on the other end, and it is still **data off the wire**: a cast here would\n * make a deploy skew or a proxy's error page arrive as a `Session` whose `user` is undefined, and\n * the failure would surface three components away as a property read on nothing. `null` for\n * anything unrecognisable; `bffAuth` reads a 200 it cannot read as `session/unavailable`, because\n * the endpoint answers \"nobody is signed in\" with a 401 and never with a body.\n */\nexport function readSession(value: unknown): Session | null {\n  if (typeof value !== \"object\" || value === null) return null;\n  const body = value as Record<string, unknown>;\n\n  const user = body[\"user\"];\n  if (typeof user !== \"object\" || user === null) return null;\n  const id = (user as Record<string, unknown>)[\"id\"];\n  if (typeof id !== \"string\" || id.length === 0) return null;\n\n  const person = user as Record<string, unknown>;\n  const str = (key: string) =>\n    typeof person[key] === \"string\" && person[key] !== \"\" ? (person[key] as string) : undefined;\n\n  return {\n    user: { id, email: str(\"email\"), name: str(\"name\"), username: str(\"username\") },\n    roles: Array.isArray(body[\"roles\"])\n      ? body[\"roles\"].filter((r): r is string => typeof r === \"string\")\n      : [],\n    organizations: Array.isArray(body[\"organizations\"])\n      ? body[\"organizations\"]\n          .map(readOrganization)\n          .filter((o): o is Organization => o !== null)\n      : [],\n    organization:\n      typeof body[\"organization\"] === \"string\" && body[\"organization\"] !== \"\"\n        ? body[\"organization\"]\n        : undefined,\n    expiresAt: typeof body[\"expiresAt\"] === \"number\" ? body[\"expiresAt\"] : 0,\n  };\n}\n\nexport function bffAuth(config: BffAuthConfig = {}): Auth {\n  const base = (config.basePath ?? \"/api/auth\").replace(/\\/$/, \"\");\n  const doFetch = config.fetch ?? ((...args) => globalThis.fetch(...args));\n  const go = config.navigate ?? ((url: string) => void (globalThis.location.href = url));\n\n  const listeners = new Set<() => void>();\n  const announce = () => {\n    for (const listener of listeners) listener();\n  };\n\n  let cached: Session | null = null;\n  let known = false;\n  /** Set by the one sign-in a refused renewal starts; the page is leaving, so it is never unset. */\n  let leaving = false;\n\n  const unavailable = (url: string, status: number | undefined, cause?: unknown) =>\n    new AuthError(\n      \"session/unavailable\",\n      status === undefined ? `${url} could not be reached` : `${url} answered ${status}`,\n      status === undefined ? {} : { status },\n      cause === undefined ? undefined : { cause },\n    );\n\n  const send = async (url: string, init: RequestInit): Promise<Response> => {\n    try {\n      return await doFetch(url, init);\n    } catch (error) {\n      if (init.signal?.aborted) throw init.signal.reason;\n      throw unavailable(url, undefined, error);\n    }\n  };\n\n  // Single-flight for the same reason the token path needs it: a page that mounts six components\n  // asks six times in one tick, and one answer serves them all. Here it costs a request rather\n  // than a revoked token chain, which is a smaller bill for the same mistake.\n  //\n  // A 401 is the documented answer for \"nobody is signed in\". Anything else that is not a session\n  // — a 5xx, a proxy's page, no answer at all — is a failure, and reading it as \"signed out\" would\n  // send the person to sign in over an outage that will still be there when they get back.\n  const read = singleFlight(() =>\n    deadline(\"session/silent\", async (signal): Promise<Session | null> => {\n      const response = await send(`${base}/session`, { headers: { Accept: \"application/json\" }, signal });\n      if (response.status === 401) return null;\n      if (!response.ok) throw unavailable(`${base}/session`, response.status);\n      let body: unknown;\n      try {\n        body = await response.json();\n      } catch (error) {\n        throw unavailable(`${base}/session`, response.status, error);\n      }\n      const session = readSession(body);\n      if (session === null) throw unavailable(`${base}/session`, response.status);\n      return session;\n    }),\n  );\n\n  /**\n   * Ask the BFF to spend the refresh token, once for however many requests noticed at the moment.\n   *\n   * The proxy renews before every page and the forwarder before every request it forwards, so this\n   * is the last of three: a 401 that reached the browser anyway, from a resource the BFF does not\n   * front or a token that died between the forwarder's check and the upstream's.\n   *\n   * `POST`, because the route only answers `POST` — it spends something, and a `GET` that spends\n   * something is one prefetch away from spending it unasked.\n   */\n  const renew = singleFlight(() =>\n    deadline(\"session/silent\", async (signal): Promise<boolean> => {\n      const response = await send(`${base}/refresh`, {\n        method: \"POST\",\n        headers: { Accept: \"application/json\" },\n        signal,\n      });\n      // A refusal (401, 400) is the end of the session; a 5xx is an outage, not a refusal.\n      if (response.status >= 500) throw unavailable(`${base}/refresh`, response.status);\n      return response.ok;\n    }),\n  );\n\n  const refresh = async (): Promise<Session | null> => {\n    const next = cached;\n    cached = await read();\n    known = true;\n    // Announce only a change, so a poll does not re-render the tree every time.\n    if ((next === null) !== (cached === null) || next?.user.id !== cached?.user.id) announce();\n    return cached;\n  };\n\n  const signIn = async (options: SignInOptions = {}) => {\n    const params = new URLSearchParams();\n    params.set(\"returnTo\", options.returnTo ?? globalThis.location?.href ?? \"/\");\n    if (options.organization !== undefined) params.set(\"organization\", options.organization);\n    go(`${base}/signin?${params.toString()}`);\n  };\n\n  return {\n    async getSession() {\n      if (known) return cached;\n      return refresh();\n    },\n\n    subscribe(onChange) {\n      listeners.add(onChange);\n      return () => listeners.delete(onChange);\n    },\n\n    signIn,\n\n    async signOut(options = {}) {\n      const params = new URLSearchParams();\n      if (options.returnTo !== undefined) params.set(\"returnTo\", options.returnTo);\n      const query = params.toString();\n      go(query ? `${base}/signout?${query}` : `${base}/signout`);\n    },\n\n    /**\n     * No `Authorization` header — the cookie rides along on a same-origin request by itself — and\n     * **one** retry, behind one renewal.\n     *\n     * A 401 here is ambiguous: the cookie was sent and was accepted, so what expired may be the\n     * access token *behind* the cookie, which this half of the pattern cannot see. So the 401 is\n     * taken as \"renew and try again\" first, and as \"the session is over\" only when the renewal is\n     * refused — and then the answer is to sign in, once, coming back to this page. One layer: a\n     * product's data client does not need a 401 branch of its own.\n     *\n     * The retry is once: twice turns an ended session into a loop against the authorization server.\n     * A request whose body cannot be replayed is not retried at all.\n     */\n    fetch: async (input, init) => {\n      const response = await doFetch(input, init);\n      if (response.status !== 401 || !known) return response;\n\n      if (await renew()) {\n        if (!isReplayable(input, init)) return response;\n        return doFetch(input, init);\n      }\n\n      if (!leaving) {\n        leaving = true;\n        await signIn({ returnTo: globalThis.location?.href });\n      }\n      return response;\n    },\n  };\n}\n"],"names":["isReplayable","input","init","body","readOrganization","value","org","alias","r","readSession","user","id","person","str","key","o","bffAuth","config","base","doFetch","args","go","url","listeners","announce","listener","cached","known","leaving","unavailable","status","cause","AuthError","send","error","_a","read","singleFlight","deadline","signal","response","session","renew","refresh","next","signIn","options","params","onChange","query"],"mappings":";;;AAgCA,SAASA,EAAaC,GAA0BC,GAA6B;AAC3E,MAAI,OAAO,UAAY,OAAeD,aAAiB,WAAWA,EAAM,SAAS,KAAM,QAAO;AAC9F,QAAME,IAAOD,KAAA,gBAAAA,EAAM;AACnB,SAA0BC,KAAS,OAAa,KACzC,EAAE,OAAO,iBAAmB,OAAeA,aAAgB;AACpE;AAEA,SAASC,EAAiBC,GAAqC;AAC7D,MAAI,OAAOA,KAAU,YAAYA,MAAU,KAAM,QAAO;AACxD,QAAMC,IAAMD,GACNE,IAAQD,EAAI;AAClB,SAAI,OAAOC,KAAU,YAAYA,EAAM,WAAW,IAAU,OACrD;AAAA,IACL,OAAAA;AAAA,IACA,IAAI,OAAOD,EAAI,MAAU,WAAWA,EAAI,KAAQ;AAAA,IAChD,OAAO,MAAM,QAAQA,EAAI,KAAQ,IAC7BA,EAAI,MAAS,OAAO,CAACE,MAAmB,OAAOA,KAAM,QAAQ,IAC7D,CAAA;AAAA,EAAC;AAET;AAWO,SAASC,EAAYJ,GAAgC;AAC1D,MAAI,OAAOA,KAAU,YAAYA,MAAU,KAAM,QAAO;AACxD,QAAMF,IAAOE,GAEPK,IAAOP,EAAK;AAClB,MAAI,OAAOO,KAAS,YAAYA,MAAS,KAAM,QAAO;AACtD,QAAMC,IAAMD,EAAiC;AAC7C,MAAI,OAAOC,KAAO,YAAYA,EAAG,WAAW,EAAG,QAAO;AAEtD,QAAMC,IAASF,GACTG,IAAM,CAACC,MACX,OAAOF,EAAOE,CAAG,KAAM,YAAYF,EAAOE,CAAG,MAAM,KAAMF,EAAOE,CAAG,IAAe;AAEpF,SAAO;AAAA,IACL,MAAM,EAAE,IAAAH,GAAI,OAAOE,EAAI,OAAO,GAAG,MAAMA,EAAI,MAAM,GAAG,UAAUA,EAAI,UAAU,EAAA;AAAA,IAC5E,OAAO,MAAM,QAAQV,EAAK,KAAQ,IAC9BA,EAAK,MAAS,OAAO,CAACK,MAAmB,OAAOA,KAAM,QAAQ,IAC9D,CAAA;AAAA,IACJ,eAAe,MAAM,QAAQL,EAAK,aAAgB,IAC9CA,EAAK,cACF,IAAIC,CAAgB,EACpB,OAAO,CAACW,MAAyBA,MAAM,IAAI,IAC9C,CAAA;AAAA,IACJ,cACE,OAAOZ,EAAK,gBAAoB,YAAYA,EAAK,iBAAoB,KACjEA,EAAK,eACL;AAAA,IACN,WAAW,OAAOA,EAAK,aAAiB,WAAWA,EAAK,YAAe;AAAA,EAAA;AAE3E;AAEO,SAASa,EAAQC,IAAwB,IAAU;AACxD,QAAMC,KAAQD,EAAO,YAAY,aAAa,QAAQ,OAAO,EAAE,GACzDE,IAAUF,EAAO,UAAU,IAAIG,MAAS,WAAW,MAAM,GAAGA,CAAI,IAChEC,IAAKJ,EAAO,aAAa,CAACK,MAAgB,MAAM,WAAW,SAAS,OAAOA,KAE3EC,wBAAgB,IAAA,GAChBC,IAAW,MAAM;AACrB,eAAWC,KAAYF,EAAW,CAAAE,EAAA;AAAA,EACpC;AAEA,MAAIC,IAAyB,MACzBC,IAAQ,IAERC,IAAU;AAEd,QAAMC,IAAc,CAACP,GAAaQ,GAA4BC,MAC5D,IAAIC;AAAA,IACF;AAAA,IACAF,MAAW,SAAY,GAAGR,CAAG,0BAA0B,GAAGA,CAAG,aAAaQ,CAAM;AAAA,IAChFA,MAAW,SAAY,KAAK,EAAE,QAAAA,EAAA;AAAA,IAC9BC,MAAU,SAAY,SAAY,EAAE,OAAAA,EAAA;AAAA,EAAM,GAGxCE,IAAO,OAAOX,GAAapB,MAAyC;;AACxE,QAAI;AACF,aAAO,MAAMiB,EAAQG,GAAKpB,CAAI;AAAA,IAChC,SAASgC,GAAO;AACd,aAAIC,IAAAjC,EAAK,WAAL,QAAAiC,EAAa,UAAejC,EAAK,OAAO,SACtC2B,EAAYP,GAAK,QAAWY,CAAK;AAAA,IACzC;AAAA,EACF,GASME,IAAOC;AAAA,IAAa,MACxBC,EAAS,kBAAkB,OAAOC,MAAoC;AACpE,YAAMC,IAAW,MAAMP,EAAK,GAAGf,CAAI,YAAY,EAAE,SAAS,EAAE,QAAQ,mBAAA,GAAsB,QAAAqB,GAAQ;AAClG,UAAIC,EAAS,WAAW,IAAK,QAAO;AACpC,UAAI,CAACA,EAAS,GAAI,OAAMX,EAAY,GAAGX,CAAI,YAAYsB,EAAS,MAAM;AACtE,UAAIrC;AACJ,UAAI;AACF,QAAAA,IAAO,MAAMqC,EAAS,KAAA;AAAA,MACxB,SAASN,GAAO;AACd,cAAML,EAAY,GAAGX,CAAI,YAAYsB,EAAS,QAAQN,CAAK;AAAA,MAC7D;AACA,YAAMO,IAAUhC,EAAYN,CAAI;AAChC,UAAIsC,MAAY,KAAM,OAAMZ,EAAY,GAAGX,CAAI,YAAYsB,EAAS,MAAM;AAC1E,aAAOC;AAAA,IACT,CAAC;AAAA,EAAA,GAaGC,IAAQL;AAAA,IAAa,MACzBC,EAAS,kBAAkB,OAAOC,MAA6B;AAC7D,YAAMC,IAAW,MAAMP,EAAK,GAAGf,CAAI,YAAY;AAAA,QAC7C,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,mBAAA;AAAA,QACnB,QAAAqB;AAAA,MAAA,CACD;AAED,UAAIC,EAAS,UAAU,IAAK,OAAMX,EAAY,GAAGX,CAAI,YAAYsB,EAAS,MAAM;AAChF,aAAOA,EAAS;AAAA,IAClB,CAAC;AAAA,EAAA,GAGGG,IAAU,YAAqC;AACnD,UAAMC,IAAOlB;AACb,WAAAA,IAAS,MAAMU,EAAA,GACfT,IAAQ,KAEHiB,MAAS,SAAWlB,MAAW,UAASkB,KAAA,gBAAAA,EAAM,KAAK,SAAOlB,KAAA,gBAAAA,EAAQ,KAAK,QAAIF,EAAA,GACzEE;AAAA,EACT,GAEMmB,IAAS,OAAOC,IAAyB,OAAO;;AACpD,UAAMC,IAAS,IAAI,gBAAA;AACnB,IAAAA,EAAO,IAAI,YAAYD,EAAQ,cAAYX,IAAA,WAAW,aAAX,gBAAAA,EAAqB,SAAQ,GAAG,GACvEW,EAAQ,iBAAiB,YAAkB,IAAI,gBAAgBA,EAAQ,YAAY,GACvFzB,EAAG,GAAGH,CAAI,WAAW6B,EAAO,SAAA,CAAU,EAAE;AAAA,EAC1C;AAEA,SAAO;AAAA,IACL,MAAM,aAAa;AACjB,aAAIpB,IAAcD,IACXiB,EAAA;AAAA,IACT;AAAA,IAEA,UAAUK,GAAU;AAClB,aAAAzB,EAAU,IAAIyB,CAAQ,GACf,MAAMzB,EAAU,OAAOyB,CAAQ;AAAA,IACxC;AAAA,IAEA,QAAAH;AAAA,IAEA,MAAM,QAAQC,IAAU,IAAI;AAC1B,YAAMC,IAAS,IAAI,gBAAA;AACnB,MAAID,EAAQ,aAAa,YAAkB,IAAI,YAAYA,EAAQ,QAAQ;AAC3E,YAAMG,IAAQF,EAAO,SAAA;AACrB,MAAA1B,EAAG4B,IAAQ,GAAG/B,CAAI,YAAY+B,CAAK,KAAK,GAAG/B,CAAI,UAAU;AAAA,IAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAeA,OAAO,OAAOjB,GAAOC,MAAS;;AAC5B,YAAMsC,IAAW,MAAMrB,EAAQlB,GAAOC,CAAI;AAC1C,aAAIsC,EAAS,WAAW,OAAO,CAACb,IAAca,IAE1C,MAAME,MACH1C,EAAaC,GAAOC,CAAI,IACtBiB,EAAQlB,GAAOC,CAAI,IADasC,KAIpCZ,MACHA,IAAU,IACV,MAAMiB,EAAO,EAAE,WAAUV,IAAA,WAAW,aAAX,gBAAAA,EAAqB,MAAM,IAE/CK;AAAA,IACT;AAAA,EAAA;AAEJ;"}

package/dist/can.d.ts

@@ -10,17 +10,21 @@ import { Organization, Session } from './types';
 /** The organization by that alias, or `undefined` for one this person does not belong to. */
 export declare function organizationOf(session: Session | null | undefined, alias: string): Organization | undefined;
 /**
- * Does this session hold `role`?
+ * Does this session hold `role` — in the organization this request addresses, unless told which?
  *
- * With an `organization`, the question is asked *inside* it — the person's roles there, which is a
- * different set from their realm and client roles and is deliberately not merged with them. A role
- * held in one organization says nothing about another, and the day those two sets are unioned for
- * convenience is the day one organization's owner is every organization's owner.
+ * The organization defaults to `session.organization`, the current tenant the product's resolver
+ * named, so `can(session, "editor")` asks the question a page means: *here*. Clerk's
+ * `auth().has()` binds to the active organization the same way. Named explicitly, the question is
+ * asked inside that one instead. Inside an organization the answer comes from the person's roles
+ * there, which is a different set from their realm and client roles and is deliberately not
+ * merged with them: a role held in one organization says nothing about another, and the day those
+ * two sets are unioned for convenience is the day one organization's owner is every
+ * organization's owner. With no tenant at all, the realm and client roles answer.
  *
- * Closed by default: no session, or no membership of the named organization, is `false` rather than
- * an error. There is no hierarchy here either: that `admin` contains `editor` is a fact about a
+ * Closed by default: no session, or no membership of the organization, is `false` rather than an
+ * error. There is no hierarchy here either: that `admin` contains `editor` is a fact about a
  * product, declared once as Keycloak composite roles where the product registers its client, and
- * the token carries the expanded set — so `can(s, "editor", org)` is true for an admin.
+ * the token carries the expanded set — so `can(s, "editor")` is true for an admin.
  */
-export declare function can(session: Session | null | undefined, role: string, organization?: string): boolean;
+export declare function can(session: Session | null | undefined, role: string, organization?: string | undefined): boolean;
 //# sourceMappingURL=can.d.ts.map

package/dist/can.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"can.d.ts","sourceRoot":"","sources":["../src/can.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAErD;;;;;;;GAOG;AAEH,6FAA6F;AAC7F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EACnC,KAAK,EAAE,MAAM,GACZ,YAAY,GAAG,SAAS,CAE1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,GAAG,CACjB,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EACnC,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAIT"}
+{"version":3,"file":"can.d.ts","sourceRoot":"","sources":["../src/can.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAErD;;;;;;;GAOG;AAEH,6FAA6F;AAC7F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EACnC,KAAK,EAAE,MAAM,GACZ,YAAY,GAAG,SAAS,CAE1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,GAAG,CACjB,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EACnC,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,MAAM,GAAG,SAAiC,GACvD,OAAO,CAIT"}

package/dist/can.js

@@ -1,12 +1,12 @@
-function u(r, f) {
-  return r == null ? void 0 : r.organizations.find((n) => n.alias === f);
+function u(r, a) {
+  return r == null ? void 0 : r.organizations.find((t) => t.alias === a);
 }
-function a(r, f, n) {
-  var t;
-  return r ? n === void 0 ? r.roles.includes(f) : ((t = u(r, n)) == null ? void 0 : t.roles.includes(f)) ?? !1 : !1;
+function l(r, a, t = r == null ? void 0 : r.organization) {
+  var f;
+  return r ? t === void 0 ? r.roles.includes(a) : ((f = u(r, t)) == null ? void 0 : f.roles.includes(a)) ?? !1 : !1;
 }
 export {
-  a as can,
+  l as can,
   u as organizationOf
 };
 //# sourceMappingURL=can.js.map

package/dist/can.js.map

@@ -1 +1 @@
-{"version":3,"file":"can.js","sources":["../src/can.ts"],"sourcesContent":["import type { Organization, Session } from \"./types\";\n\n/**\n * The role predicate, and the lookup underneath it.\n *\n * **What this decides is what to draw, never what to allow.** The roles a client holds are a copy,\n * and a copy is something an attacker controls the moment it reaches the browser: `can` hides a\n * button, and the resource server — validating the access token it was sent — is what actually\n * refuses the request behind it. A product that gates only here has not gated anything.\n */\n\n/** The organization by that alias, or `undefined` for one this person does not belong to. */\nexport function organizationOf(\n  session: Session | null | undefined,\n  alias: string,\n): Organization | undefined {\n  return session?.organizations.find((org) => org.alias === alias);\n}\n\n/**\n * Does this session hold `role`?\n *\n * With an `organization`, the question is asked *inside* it — the person's roles there, which is a\n * different set from their realm and client roles and is deliberately not merged with them. A role\n * held in one organization says nothing about another, and the day those two sets are unioned for\n * convenience is the day one organization's owner is every organization's owner.\n *\n * Closed by default: no session, or no membership of the named organization, is `false` rather than\n * an error. There is no hierarchy here either: that `admin` contains `editor` is a fact about a\n * product, declared once as Keycloak composite roles where the product registers its client, and\n * the token carries the expanded set — so `can(s, \"editor\", org)` is true for an admin.\n */\nexport function can(\n  session: Session | null | undefined,\n  role: string,\n  organization?: string,\n): boolean {\n  if (!session) return false;\n  if (organization === undefined) return session.roles.includes(role);\n  return organizationOf(session, organization)?.roles.includes(role) ?? false;\n}\n"],"names":["organizationOf","session","alias","org","can","role","organization","_a"],"mappings":"AAYO,SAASA,EACdC,GACAC,GAC0B;AAC1B,SAAOD,KAAA,gBAAAA,EAAS,cAAc,KAAK,CAACE,MAAQA,EAAI,UAAUD;AAC5D;AAeO,SAASE,EACdH,GACAI,GACAC,GACS;AAxBJ,MAAAC;AAyBL,SAAKN,IACDK,MAAiB,SAAkBL,EAAQ,MAAM,SAASI,CAAI,MAC3DE,IAAAP,EAAeC,GAASK,CAAY,MAApC,gBAAAC,EAAuC,MAAM,SAASF,OAAS,KAFjD;AAGvB;"}
+{"version":3,"file":"can.js","sources":["../src/can.ts"],"sourcesContent":["import type { Organization, Session } from \"./types\";\n\n/**\n * The role predicate, and the lookup underneath it.\n *\n * **What this decides is what to draw, never what to allow.** The roles a client holds are a copy,\n * and a copy is something an attacker controls the moment it reaches the browser: `can` hides a\n * button, and the resource server — validating the access token it was sent — is what actually\n * refuses the request behind it. A product that gates only here has not gated anything.\n */\n\n/** The organization by that alias, or `undefined` for one this person does not belong to. */\nexport function organizationOf(\n  session: Session | null | undefined,\n  alias: string,\n): Organization | undefined {\n  return session?.organizations.find((org) => org.alias === alias);\n}\n\n/**\n * Does this session hold `role` — in the organization this request addresses, unless told which?\n *\n * The organization defaults to `session.organization`, the current tenant the product's resolver\n * named, so `can(session, \"editor\")` asks the question a page means: *here*. Clerk's\n * `auth().has()` binds to the active organization the same way. Named explicitly, the question is\n * asked inside that one instead. Inside an organization the answer comes from the person's roles\n * there, which is a different set from their realm and client roles and is deliberately not\n * merged with them: a role held in one organization says nothing about another, and the day those\n * two sets are unioned for convenience is the day one organization's owner is every\n * organization's owner. With no tenant at all, the realm and client roles answer.\n *\n * Closed by default: no session, or no membership of the organization, is `false` rather than an\n * error. There is no hierarchy here either: that `admin` contains `editor` is a fact about a\n * product, declared once as Keycloak composite roles where the product registers its client, and\n * the token carries the expanded set — so `can(s, \"editor\")` is true for an admin.\n */\nexport function can(\n  session: Session | null | undefined,\n  role: string,\n  organization: string | undefined = session?.organization,\n): boolean {\n  if (!session) return false;\n  if (organization === undefined) return session.roles.includes(role);\n  return organizationOf(session, organization)?.roles.includes(role) ?? false;\n}\n"],"names":["organizationOf","session","alias","org","can","role","organization","_a"],"mappings":"AAYO,SAASA,EACdC,GACAC,GAC0B;AAC1B,SAAOD,KAAA,gBAAAA,EAAS,cAAc,KAAK,CAACE,MAAQA,EAAI,UAAUD;AAC5D;AAmBO,SAASE,EACdH,GACAI,GACAC,IAAmCL,KAAA,gBAAAA,EAAS,cACnC;AA5BJ,MAAAM;AA6BL,SAAKN,IACDK,MAAiB,SAAkBL,EAAQ,MAAM,SAASI,CAAI,MAC3DE,IAAAP,EAAeC,GAASK,CAAY,MAApC,gBAAAC,EAAuC,MAAM,SAASF,OAAS,KAFjD;AAGvB;"}

package/dist/gate.d.ts

@@ -1,11 +1,11 @@
 /**
  * Show `children` to someone who holds `role`, and `fallback` to everyone else.
  *
- * **This hides UI and protects nothing**, for the reason {@link can} carries: a product gated only
- * here is ungated.
+ * **This hides UI and protects nothing**, for the reason `can` carries: a product gated only here is
+ * ungated.
  *
- * `organization` asks the question inside that organization rather than against the realm roles,
- * and {@link can} does not merge the two.
+ * The question is asked inside the current tenant, `session.organization`, unless `organization`
+ * names another — the same default as `useSession().can`.
  */
 export declare function Gate({ role, organization, fallback, children, }: {
     readonly role: string;

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.tsx"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAAC,EACnB,IAAI,EACJ,YAAY,EACZ,QAAe,EACf,QAAQ,GACT,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CACrC,sCAUA"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.tsx"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAAC,EACnB,IAAI,EACJ,YAAY,EACZ,QAAe,EACf,QAAQ,GACT,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CACrC,sCAUA"}

package/dist/gate.js

@@ -1,17 +1,16 @@
 "use client";
-import { jsx as s, Fragment as l } from "react/jsx-runtime";
-import { can as m } from "./can.js";
+import { jsx as l, Fragment as s } from "react/jsx-runtime";
 import { useSession as u } from "./use-session.js";
-function p({
+function m({
   role: r,
-  organization: o,
-  fallback: t = null,
-  children: e
+  organization: t,
+  fallback: e = null,
+  children: o
 }) {
-  const { session: i, status: n } = u();
-  return n === "loading" || n === "failed" ? null : /* @__PURE__ */ s(l, { children: m(i, r, o) ? e : t });
+  const { can: i, status: n } = u();
+  return n === "loading" || n === "failed" ? null : /* @__PURE__ */ l(s, { children: i(r, t) ? o : e });
 }
 export {
-  p as Gate
+  m as Gate
 };
 //# sourceMappingURL=gate.js.map

package/dist/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sources":["../src/gate.tsx"],"sourcesContent":["\"use client\";\n\nimport { can } from \"./can\";\nimport { useSession } from \"./use-session\";\n\n/**\n * Show `children` to someone who holds `role`, and `fallback` to everyone else.\n *\n * **This hides UI and protects nothing**, for the reason {@link can} carries: a product gated only\n * here is ungated.\n *\n * `organization` asks the question inside that organization rather than against the realm roles,\n * and {@link can} does not merge the two.\n */\nexport function Gate({\n  role,\n  organization,\n  fallback = null,\n  children,\n}: {\n  readonly role: string;\n  readonly organization?: string;\n  readonly fallback?: React.ReactNode;\n  readonly children?: React.ReactNode;\n}) {\n  const { session, status } = useSession();\n\n  // While the session is still being read, or could not be, neither answer is known to be true, so\n  // neither is drawn. Rendering the fallback here is the flicker worth avoiding — \"you cannot do\n  // this\" shown to someone who can, for as long as the session endpoint takes — and rendering the\n  // children is worse, because it flashes a control and then retracts it.\n  if (status === \"loading\" || status === \"failed\") return null;\n\n  return <>{can(session, role, organization) ? children : fallback}</>;\n}\n"],"names":[],"mappings":";;;;AAcO;AAAc;AACnB;AACA;AACW;AAEb;AAME;AAMA;AAGF;;;;"}
+{"version":3,"file":"gate.js","sources":["../src/gate.tsx"],"sourcesContent":["\"use client\";\n\nimport { useSession } from \"./use-session\";\n\n/**\n * Show `children` to someone who holds `role`, and `fallback` to everyone else.\n *\n * **This hides UI and protects nothing**, for the reason `can` carries: a product gated only here is\n * ungated.\n *\n * The question is asked inside the current tenant, `session.organization`, unless `organization`\n * names another — the same default as `useSession().can`.\n */\nexport function Gate({\n  role,\n  organization,\n  fallback = null,\n  children,\n}: {\n  readonly role: string;\n  readonly organization?: string;\n  readonly fallback?: React.ReactNode;\n  readonly children?: React.ReactNode;\n}) {\n  const { can, status } = useSession();\n\n  // While the session is still being read, or could not be, neither answer is known to be true, so\n  // neither is drawn. Rendering the fallback here is the flicker worth avoiding — \"you cannot do\n  // this\" shown to someone who can, for as long as the session endpoint takes — and rendering the\n  // children is worse, because it flashes a control and then retracts it.\n  if (status === \"loading\" || status === \"failed\") return null;\n\n  return <>{can(role, organization) ? children : fallback}</>;\n}\n"],"names":[],"mappings":";;;AAaO;AAAc;AACnB;AACA;AACW;AAEb;AAME;AAMA;AAGF;;;;"}

package/dist/index.d.ts

@@ -15,9 +15,10 @@
  * those differently. What is genuinely shared sits underneath — reading Keycloak's claims into one
  * session, evaluating a role inside an organization, and keeping a `fetch` authenticated.
  *
- * **There is no protocol in it either.** PKCE, silent renewal, storage and cross-tab coordination
- * are `oidc-client-ts`'s, behind `./browser`; the confidential client is `openid-client`'s, behind
- * `./server`. Writing either by hand is where mistakes become vulnerabilities.
+ * **There is no protocol in it either.** The confidential client is `openid-client`'s, behind
+ * `./server`, and the browser holds no token at all — RFC 10017's Backend For Frontend, the one
+ * architecture it recommends for business applications. Writing OAuth by hand is where mistakes
+ * become vulnerabilities.
  *
  * ## The one rule to read before using it
  *
@@ -27,21 +28,15 @@
  *
  * ## What a name means here
  *
- * Three families, and the shape of the name says which one a thing is. Written down because four
- * of these were added in parallel and drifted into two conventions and one exception:
+ * Two families, and the shape of the name says which one a thing is:
  *
- * - **`<pattern>Auth`** returns an {@link Auth} — `browserAuth`, `bffAuth`. Both patterns RFC 10017
- *   names, one interface, which is what lets `useSession` and `Gate` be written once.
- * - **`auth<Thing>`** returns an auth-flavoured *thing* — `authFetch` a `fetch`, and on `./next`
- *   `authRoutes`, `authSession`, `authMiddleware`.
+ * - **`<where>Auth`** is a whole side of the BFF in one object — `bffAuth` in the browser, an
+ *   {@link Auth}; `kanzoAuth` on `./next`, the server half for an App Router product.
  * - **Everything else is named for what it is**: `relyingParty`, `issuer`, `sealedCookie`, `claims`,
- *   `can`. The first of those used to be `serverAuth`, which wore the suffix without returning an
- *   `Auth` — the server half's job is `begin`/`complete`/`read`/`refresh`/`end`, not
- *   `getSession`/`signIn`/`fetch`. A name that promises an interface it does not return is worse
- *   than a long one, and *relying party* is the term the specification already uses for it.
- *
- * *What would reverse it:* a fourth family. Two exist because two patterns exist; a third convention
- * would mean the vocabulary has outgrown the rule rather than that the rule needs an exception.
+ *   `can`. The first of those used to be `serverAuth`, which wore the suffix without being a side
+ *   of anything — its job is `begin`/`complete`/`read`/`refresh`/`end`, the protocol's verbs. A
+ *   name that promises an interface it does not return is worse than a long one, and *relying
+ *   party* is the term the specification already uses for it.
  *
  * ## This door carries no engine
  *
@@ -50,16 +45,13 @@
  * server there is no protocol left in the browser, only a `fetch` to a session endpoint.
  */
 export { accountUrl, type AccountPage } from './account';
-export { authFetch, type TokenSource } from './auth-fetch';
 export type { AuthContextValue, AuthStatus } from './auth-context';
 export { AuthProvider } from './auth-provider';
 export { bffAuth, readSession, type BffAuthConfig } from './bff-auth';
 export { can, organizationOf } from './can';
 export { claims, type ClaimsConfig } from './claims';
 export { Gate } from './gate';
-export { organizationFromHost } from './host';
 export { singleFlight } from './single-flight';
 export { AuthError, type Auth, type AuthErrorCode, type AuthUser, type Organization, type Session, type SignInOptions, } from './types';
-export { useOrganization } from './use-organization';
 export { useSession } from './use-session';
 //# sourceMappingURL=index.d.ts.map