@kerne/react 0.1.0 → 0.1.2

package/dist/index.d.cts

@@ -1,87 +1,644 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import * as _kerne_server from '@kerne/server';
-import { KerneConfig, Kerne } from '@kerne/server';
-import React from 'react';
-import { User, AuthResponse } from '@kerne/types';
+import React, { ReactNode, Component, ErrorInfo } from 'react';
+import { KerneConfig, JoinWaitlistParams, ValidateTokenResponse, ValidateCodeResponse } from '@kerne/server';
+export { JoinWaitlistParams, ValidateCodeResponse, ValidateTokenResponse, WaitlistEntry } from '@kerne/server';
+import * as _kerne_types from '@kerne/types';
+import { User, AuthResponse, ActivationContext, AuthConfig, EntitlementCheck, SubscriptionWithPlan, PublicPlan, Entitlements, UsageRecord } from '@kerne/types';
+export { ActivationContext, AuthConfig, AuthResponse, EntitlementCheck, Entitlements, PublicPlan, Subscription, SubscriptionWithPlan, UsageRecord, User } from '@kerne/types';
+import { D as DeepPartial, K as KerneLocalization } from './i18n-Qketn1RF.cjs';
+export { d as defaultLocalization } from './i18n-Qketn1RF.cjs';
 
 interface KerneReactConfig extends Omit<KerneConfig, 'secretKey'> {
     storage?: Storage;
     storageKey?: string;
     onAuthChange?: (user: User | null) => void;
+    /** Auto-refresh session before expiry (default: true) */
+    autoRefresh?: boolean;
+    /** Refresh buffer in seconds before expiry (default: 60) */
+    refreshBuffer?: number;
 }
+
+type Listener = () => void;
 declare class KerneClient {
     private kerne;
     private storage;
     private storageKey;
     private onAuthChange?;
-    private currentUser;
-    private currentToken;
+    private autoRefresh;
+    private refreshBuffer;
+    private refreshTimer;
+    private listeners;
+    private _user;
+    private _token;
+    private _refreshToken;
+    private _expiresAt;
+    private _isLoading;
+    private _authConfigPromise;
+    readonly baseUrl: string;
+    readonly appId: string;
     constructor(config: KerneReactConfig);
-    private loadSession;
-    private saveSession;
-    private clearSession;
+    subscribe(listener: Listener): () => void;
+    private notify;
     get user(): User | null;
     get token(): string | null;
     get isAuthenticated(): boolean;
-    get client(): Kerne;
-    get projects(): _kerne_server.ProjectsResource;
+    get isLoading(): boolean;
+    private loadSession;
+    private getHandoffCodeFromUrl;
+    /**
+     * Strips only `kerne_handoff` from the URL, leaving the rest of the
+     * path/query (e.g. a `return_to` the host app added) untouched - and
+     * without adding a history entry, so back-navigation doesn't resurrect it.
+     */
+    private stripHandoffParamFromUrl;
+    /**
+     * Same shape as `refreshOnLoad`: a bootstrap-only path invoked once from
+     * `loadSession()` when a `kerne_handoff` code is present in the URL,
+     * entirely invisible to the host app - no code on their end required.
+     *
+     * Works no matter which page the browser lands on: `redirectUrl` is a hard
+     * navigation (`window.location.href`), so the destination reloads the SDK
+     * fresh and `loadSession()` reads the code straight off that page's own
+     * URL - there is no dependency on a specific "callback route", as long as
+     * `KerneProvider` wraps whatever the host renders there (normally true when
+     * it is mounted once at the app root).
+     *
+     * One retry on a transient failure (network blip, 5xx) - worth it because
+     * the code was never reached by the server in that case, so it is still
+     * unspent. A 4xx (invalid/expired/already-consumed) is not retried: the
+     * code is gone, retrying only delays the "logged out" outcome.
+     */
+    private exchangeHandoffOnLoad;
+    private refreshOnLoad;
+    /**
+     * `AuthResponse.user` is the minimal `{id, email, role}` claim set the
+     * token endpoint returns, not the full profile (`User`) - so this always
+     * follows up with `users.me()` rather than assigning it directly (that
+     * used to leave `_user` looking like a `User` while actually missing
+     * `email_verified`/`first_name`/`avatar`/etc).
+     */
+    private saveSession;
+    private clearSession;
+    private scheduleRefresh;
+    private cancelRefresh;
+    private silentRefresh;
     register(params: {
         email: string;
         password: string;
         name?: string;
+        invitationToken?: string;
+        invitationCode?: string;
     }): Promise<AuthResponse>;
     login(params: {
         email: string;
         password: string;
     }): Promise<AuthResponse>;
+    /** Manually trigger a token refresh - normally handled automatically by `autoRefresh`. */
     refreshToken(): Promise<AuthResponse | null>;
     logout(): void;
     refreshUser(): Promise<User | null>;
-    checkEntitlement(featureKey: string, requested?: number): Promise<boolean>;
-    createCheckout(planId: string, options?: {
+    updateProfile(params: {
+        first_name?: string;
+        last_name?: string;
+    }): Promise<User>;
+    updatePassword(params: {
+        currentPassword: string;
+        newPassword: string;
+    }): Promise<void>;
+    /** Soft-deletes (deactivates) the caller's own account, then clears the local session. */
+    requestAccountDeletion(): Promise<void>;
+    /** Forgot-password flow (logged out) - sends the reset email. */
+    requestPasswordReset(email: string, callbackUrl?: string): Promise<void>;
+    /** Confirms a password reset with the token from the email. */
+    confirmPasswordReset(token: string, password: string): Promise<void>;
+    /**
+     * Sends a magic-link email (logged out). Anti-enumeration: always resolves,
+     * regardless of whether the email is registered.
+     */
+    startPasswordless(email: string, callbackUrl?: string, invitation?: {
+        invitationToken?: string;
+        invitationCode?: string;
+    }): Promise<void>;
+    /** Completes a magic-link login using the `token` query param from the emailed link. */
+    loginWithMagicLink(token: string): Promise<AuthResponse>;
+    /** Read-only: which UI to render for an activation token, without consuming it. */
+    getActivationContext(token: string): Promise<ActivationContext>;
+    /** Completes activation (sets a password or confirms magic-link mode), then logs the user in. */
+    completeActivation(token: string, password?: string): Promise<AuthResponse>;
+    /**
+     * Mints a handoff code for the current session and redirects the browser
+     * to `url` with it attached (`?kerne_handoff=...`) - never the real
+     * token/refresh_token, which would otherwise leak into server logs,
+     * browser history, and third-party `Referer` headers on the landing page.
+     */
+    redirectWithSession(url: string): Promise<void>;
+    /**
+     * The tenant's public auth config - which sign-in methods to render, whether
+     * registration is open, whether to show Kerne branding.
+     *
+     * Deduped on the in-flight promise rather than the resolved value: the
+     * prebuilt forms all read this on mount, and two of them mounted together
+     * (a login screen with a register link prefetching) would otherwise fire two
+     * identical requests before either resolved. Cached for the client's
+     * lifetime - this config changes on the order of "the owner edited their
+     * settings", not per render.
+     */
+    getAuthConfig(): Promise<AuthConfig>;
+    /**
+     * Errors are not swallowed here (unlike the old implementation, which
+     * caught everything and returned `false`) - a 401/500 must not be
+     * indistinguishable from a real denial, that's exactly what let the
+     * `has_access`/`allowed` mismatch below ship unnoticed. Callers that want
+     * a fail-closed boolean regardless of the reason (e.g. `<Allows>`)
+     * catch around this themselves.
+     */
+    allows(featureKey: string, requested?: number): Promise<boolean>;
+    /** Full entitlement detail (limit/used/remaining/overage) - use `allows()` for a plain boolean. */
+    check(featureKey: string, requested?: number): Promise<EntitlementCheck>;
+    createCheckout(planPriceId: string, options?: {
         successUrl?: string;
         cancelUrl?: string;
     }): Promise<string>;
-    openCheckout(planId: string, options?: {
+    openCheckout(planPriceId: string, options?: {
         successUrl?: string;
         cancelUrl?: string;
     }): Promise<void>;
     createPortal(returnUrl?: string): Promise<string>;
     openPortal(returnUrl?: string): Promise<void>;
+    getSubscription(productSlug?: string): Promise<SubscriptionWithPlan | null>;
+    /** Public pricing data - omit `productIdOrSlug` for the tenant's default product. */
+    getPlans(productIdOrSlug?: string): Promise<PublicPlan[]>;
+    /** Every entitlement for the current user in one call - for a "your plan" screen. */
+    getEntitlements(): Promise<Entitlements>;
+    /** Usage for the current user - all QUOTA features, or one via `featureKey`. */
+    getUsage(featureKey?: string): Promise<UsageRecord[]>;
+    joinWaitlist(params: JoinWaitlistParams): Promise<{
+        success: boolean;
+    }>;
+    /** Validate an invitation token before showing the registration form. */
+    validateInvitationToken(token: string): Promise<ValidateTokenResponse>;
+    /** Validate an invitation code before showing the registration form. */
+    validateInvitationCode(code: string): Promise<ValidateCodeResponse>;
+    sendVerificationEmail(verificationType?: 'code' | 'link', callbackUrl?: string): Promise<void>;
+    verifyEmailWithCode(code: string): Promise<{
+        success: boolean;
+        needsTokenRefresh: boolean;
+    }>;
+    verifyEmailWithLink(token: string): Promise<{
+        success: boolean;
+        needsTokenRefresh: boolean;
+    }>;
+    getVerificationStatus(): Promise<{
+        emailVerified: boolean;
+        needsVerification: boolean;
+        email: string;
+    }>;
 }
-declare function createKerneClient(config: KerneReactConfig): KerneClient;
+declare const KerneContext: React.Context<KerneClient | null>;
 interface KerneProviderProps extends KerneReactConfig {
     children: React.ReactNode;
+    /**
+     * Overrides for the prebuilt components' copy, including the error-code
+     * messages. Set once here rather than per component - the strings are shared,
+     * and a per-component prop would mean re-passing the same dictionary to every
+     * screen. Merged group-by-group over the English defaults, so a partial
+     * override keeps everything it does not mention.
+     */
+    localization?: DeepPartial<KerneLocalization>;
 }
-declare function KerneProvider({ children, ...config }: KerneProviderProps): react_jsx_runtime.JSX.Element;
-declare function useKerne(): KerneClient;
+declare function KerneProvider({ children, localization, ...config }: KerneProviderProps): react_jsx_runtime.JSX.Element;
+
+/**
+ * Access the Kerne client instance
+ */
+declare function useClient(): KerneClient;
+/**
+ * Authentication hook with optimized re-renders
+ *
+ * @example
+ * ```tsx
+ * const { user, isAuthenticated, login, logout } = useAuth();
+ * ```
+ */
 declare function useAuth(): {
-    user: User | null;
+    user: _kerne_types.User | null;
+    token: string | null;
     isAuthenticated: boolean;
+    isLoading: boolean;
     login: (params: {
         email: string;
         password: string;
-    }) => Promise<AuthResponse>;
+    }) => Promise<_kerne_types.AuthResponse>;
     register: (params: {
         email: string;
         password: string;
         name?: string;
-    }) => Promise<AuthResponse>;
+        invitationToken?: string;
+        invitationCode?: string;
+    }) => Promise<_kerne_types.AuthResponse>;
     logout: () => void;
-    refreshUser: () => Promise<User | null>;
+    refreshUser: () => Promise<_kerne_types.User | null>;
+    refreshToken: () => Promise<_kerne_types.AuthResponse | null>;
+    updateProfile: (params: {
+        first_name?: string;
+        last_name?: string;
+        avatar?: string;
+    }) => Promise<_kerne_types.User>;
+    updatePassword: (params: {
+        currentPassword: string;
+        newPassword: string;
+    }) => Promise<void>;
+    requestAccountDeletion: () => Promise<void>;
+    requestPasswordReset: (email: string, callbackUrl?: string) => Promise<void>;
+    confirmPasswordReset: (token: string, password: string) => Promise<void>;
+    startPasswordless: (email: string, callbackUrl?: string, invitation?: {
+        invitationToken?: string;
+        invitationCode?: string;
+    }) => Promise<void>;
+    loginWithMagicLink: (token: string) => Promise<_kerne_types.AuthResponse>;
+    sendVerificationEmail: (verificationType?: "code" | "link", callbackUrl?: string) => Promise<void>;
+    verifyEmailWithCode: (code: string) => Promise<{
+        success: boolean;
+        needsTokenRefresh: boolean;
+    }>;
+    verifyEmailWithLink: (token: string) => Promise<{
+        success: boolean;
+        needsTokenRefresh: boolean;
+    }>;
+    getVerificationStatus: () => Promise<{
+        emailVerified: boolean;
+        needsVerification: boolean;
+        email: string;
+    }>;
+    getActivationContext: (token: string) => Promise<_kerne_types.ActivationContext>;
+    completeActivation: (token: string, password?: string) => Promise<_kerne_types.AuthResponse>;
+    redirectWithSession: (url: string) => Promise<void>;
 };
-declare function useBilling(): {
-    checkEntitlement: (featureKey: string, requested?: number) => Promise<boolean>;
-    createCheckout: (planId: string, options?: {
+/**
+ * Checkout hook - starts a Stripe/Polar checkout session for a plan price.
+ *
+ * @example
+ * ```tsx
+ * const { openCheckout } = useCheckout();
+ * <button onClick={() => openCheckout(planPriceId)}>Upgrade</button>
+ * ```
+ */
+declare function useCheckout(): {
+    createCheckout: (planPriceId: string, options?: {
         successUrl?: string;
         cancelUrl?: string;
     }) => Promise<string>;
-    openCheckout: (planId: string, options?: {
+    openCheckout: (planPriceId: string, options?: {
         successUrl?: string;
         cancelUrl?: string;
     }) => Promise<void>;
+};
+/**
+ * Billing portal hook - lets a user manage their subscription/payment method.
+ *
+ * @example
+ * ```tsx
+ * const { openPortal } = usePortal();
+ * <button onClick={() => openPortal()}>Manage billing</button>
+ * ```
+ */
+declare function usePortal(): {
     createPortal: (returnUrl?: string) => Promise<string>;
     openPortal: (returnUrl?: string) => Promise<void>;
 };
+/**
+ * Whether the current scope has access to one feature - the single entry
+ * point for a live, per-feature decision. Deliberately not named after what
+ * it checks TODAY: this gates entitlements for now, but the same shape is
+ * meant to answer for a future access-rule engine (custom RBAC, feature
+ * flags) without a rename - "access" is the word that survives that.
+ * `details` (not `entitlement`) follows the same logic on the return value.
+ *
+ * Not `useCheck` either - too close to `useCheckout` to skim safely, and
+ * unrelated to it in every other way. Not folded into `useEntitlements()`
+ * (the cached list, for display): the two hit different endpoints with
+ * different consistency guarantees, and merging them would make the network
+ * behavior branch silently on whether a key was passed.
+ *
+ * Replaces the former `useAllows`/`useCheck` pair, which were two names for
+ * one request: `client.allows()` is literally `check().allowed`, hitting the
+ * same endpoint and discarding the rest.
+ *
+ * @example
+ * ```tsx
+ * const { allowed } = useAccess('advanced_analytics');
+ * const { details } = useAccess('api_calls');
+ * // details?.remaining, details?.limit, details?.overage_behavior
+ * ```
+ */
+declare function useAccess(featureKey: string, requested?: number): {
+    details: EntitlementCheck | null;
+    allowed: boolean;
+    isLoading: boolean;
+    error: Error | null;
+};
+/**
+ * Hook for subscription state
+ *
+ * @example
+ * ```tsx
+ * const { subscription, isLoading, isPro } = useSubscription();
+ * ```
+ */
+declare function useSubscription(productSlug?: string): {
+    isActive: boolean;
+    planSlug: string | undefined;
+    subscription: SubscriptionWithPlan | null;
+    isLoading: boolean;
+    error: Error | null;
+};
+/**
+ * Public pricing data for a pricing/checkout page - omit `productIdOrSlug`
+ * for the tenant's default product.
+ *
+ * @example
+ * ```tsx
+ * const { plans, isLoading } = usePlans();
+ * ```
+ */
+declare function usePlans(productIdOrSlug?: string): {
+    plans: PublicPlan[];
+    isLoading: boolean;
+    error: Error | null;
+};
+/**
+ * The tenant's public auth config - which sign-in methods are enabled, whether
+ * registration is open, whether to show Kerne branding. Drives what the
+ * prebuilt forms render, so a tenant that turns magic link on gets the button
+ * without shipping any code.
+ *
+ * @example
+ * ```tsx
+ * const { config, isLoading } = useAuthConfig();
+ * ```
+ */
+declare function useAuthConfig(): {
+    config: AuthConfig | null;
+    isLoading: boolean;
+    error: Error | null;
+};
+/**
+ * Every entitlement for the current user in one call - for a "your plan"
+ * screen. Use `useAccess` instead for a single feature - this response
+ * never carries `allowed` (see docs: the list is cached, a stale verdict
+ * would be unsafe).
+ *
+ * @example
+ * ```tsx
+ * const { entitlements, isLoading } = useEntitlements();
+ * ```
+ */
+declare function useEntitlements(): {
+    entitlements: Entitlements | null;
+    isLoading: boolean;
+    error: Error | null;
+};
+/**
+ * Usage for the current user - every QUOTA feature, or one via `featureKey`.
+ *
+ * @example
+ * ```tsx
+ * const { usage, isLoading } = useUsage('api_calls');
+ * ```
+ */
+declare function useUsage(featureKey?: string): {
+    usage: UsageRecord[];
+    isLoading: boolean;
+    error: Error | null;
+};
+/**
+ * Waitlist signup form - a mutation, not a data fetch, same shape as
+ * `useCheckout`/`usePortal`.
+ *
+ * @example
+ * ```tsx
+ * const { join } = useWaitlist();
+ * await join({ email });
+ * ```
+ */
+declare function useWaitlist(): {
+    join: (params: JoinWaitlistParams) => Promise<{
+        success: boolean;
+    }>;
+};
+/**
+ * Validates an invitation token/code before showing the registration form -
+ * pass whichever one is present in the URL.
+ *
+ * @example
+ * ```tsx
+ * const { result, isLoading } = useInvitation({ token });
+ * if (!isLoading && !result?.valid) return <InvalidInvite />;
+ * ```
+ */
+declare function useInvitation(params: {
+    token?: string;
+    code?: string;
+}): {
+    result: ValidateTokenResponse | ValidateCodeResponse | null;
+    isLoading: boolean;
+    error: Error | null;
+};
+/**
+ * Hook for user profile data
+ *
+ * @example
+ * ```tsx
+ * const { user, isLoading, update } = useUser();
+ * ```
+ */
+declare function useUser(): {
+    user: _kerne_types.User | null;
+    isLoading: boolean;
+    update: (params: {
+        first_name?: string;
+        last_name?: string;
+        avatar?: string;
+    }) => Promise<_kerne_types.User>;
+    fullName: string | null;
+    initials: string | null;
+    email: string | null;
+    emailVerified: boolean;
+};
+
+/**
+ * Guardian Components
+ *
+ * Conditional rendering based on auth/billing state.
+ * Inspired by Clerk's <SignedIn>, <SignedOut> pattern.
+ */
+
+interface AuthGuardProps {
+    children: ReactNode;
+    /** Fallback content when condition is not met */
+    fallback?: ReactNode;
+}
+/**
+ * Renders children only when user is authenticated
+ *
+ * @example
+ * ```tsx
+ * <Authenticated>
+ *   <Dashboard />
+ * </Authenticated>
+ * ```
+ */
+declare function Authenticated({ children, fallback }: AuthGuardProps): ReactNode;
+/**
+ * Renders children only when user is NOT authenticated
+ *
+ * @example
+ * ```tsx
+ * <Unauthenticated>
+ *   <LoginPrompt />
+ * </Unauthenticated>
+ * ```
+ */
+declare function Unauthenticated({ children, fallback }: AuthGuardProps): ReactNode;
+/**
+ * Renders children while auth state is loading
+ *
+ * @example
+ * ```tsx
+ * <AuthLoading>
+ *   <Spinner />
+ * </AuthLoading>
+ * ```
+ */
+declare function AuthLoading({ children }: {
+    children: ReactNode;
+}): ReactNode;
+interface SubscriptionGuardProps {
+    children: ReactNode;
+    /** Fallback content when there's no active subscription */
+    fallback?: ReactNode;
+}
+/**
+ * Renders children only when user has an active subscription
+ *
+ * @example
+ * ```tsx
+ * <HasSubscription fallback={<UpgradePrompt />}>
+ *   <PremiumFeature />
+ * </HasSubscription>
+ * ```
+ */
+declare function HasSubscription({ children, fallback }: SubscriptionGuardProps): ReactNode;
+interface EntitlementGuardProps {
+    children: ReactNode;
+    /**
+     * Capability key to check.
+     *
+     * NOT named `key`: React reserves that prop for reconciliation and strips it
+     * before the component sees it, so the previous `key="..."` signature could
+     * only ever read `undefined` - the check then failed and the guard rendered
+     * its fallback forever. Same name as `useAccess(featureKey)` and
+     * `UpgradePrompt`, so the whole entitlement surface reads alike.
+     */
+    featureKey: string;
+    /** Minimum value required (for limit features) */
+    minimum?: number;
+    /** Fallback content when entitlement is not met */
+    fallback?: ReactNode;
+}
+/**
+ * Renders children only when the scope is entitled to a capability. Checks the
+ * entitlement itself, never a plan name - a plan can be renamed or restructured
+ * without breaking every place that gated on its slug.
+ *
+ * @example
+ * ```tsx
+ * <Allows featureKey="advanced_analytics" fallback={<UpgradePrompt featureKey="advanced_analytics" />}>
+ *   <AnalyticsDashboard />
+ * </Allows>
+ * ```
+ */
+declare function Allows({ children, featureKey, minimum, fallback, }: EntitlementGuardProps): ReactNode;
+interface ProtectedProps {
+    children: ReactNode;
+    /** Require authentication */
+    auth?: boolean;
+    /** Require a specific capability. Not `key` - React reserves that prop name. */
+    featureKey?: string;
+    /** Fallback for unauthenticated */
+    authFallback?: ReactNode;
+    /** Fallback for missing feature */
+    billingFallback?: ReactNode;
+}
+/**
+ * Combined guard for auth + entitlement requirements
+ *
+ * @example
+ * ```tsx
+ * <Protected auth featureKey="advanced_analytics" authFallback={<Login />} billingFallback={<Upgrade />}>
+ *   <ProFeature />
+ * </Protected>
+ * ```
+ */
+declare function Protected({ children, auth, featureKey, authFallback, billingFallback, }: ProtectedProps): ReactNode;
+
+/**
+ * Kerne Error Boundary
+ *
+ * Catches auth/billing errors and provides recovery UI
+ */
+
+interface KerneError extends Error {
+    code?: string;
+    statusCode?: number;
+    details?: Record<string, any>;
+}
+interface ErrorBoundaryProps {
+    children: ReactNode;
+    /** Custom fallback UI */
+    fallback?: ReactNode | ((error: KerneError, reset: () => void) => ReactNode);
+    /** Called when error is caught */
+    onError?: (error: KerneError, errorInfo: ErrorInfo) => void;
+    /** Called when user clicks reset */
+    onReset?: () => void;
+}
+interface ErrorBoundaryState {
+    error: KerneError | null;
+    hasError: boolean;
+}
+/**
+ * Error boundary for Kerne SDK errors
+ *
+ * @example
+ * ```tsx
+ * <KerneErrorBoundary
+ *   fallback={(error, reset) => (
+ *     <div>
+ *       <p>Something went wrong: {error.message}</p>
+ *       <button onClick={reset}>Try again</button>
+ *     </div>
+ *   )}
+ *   onError={(error) => console.error('Kerne error:', error)}
+ * >
+ *   <App />
+ * </KerneErrorBoundary>
+ * ```
+ */
+declare class KerneErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundaryState> {
+    constructor(props: ErrorBoundaryProps);
+    static getDerivedStateFromError(error: Error): ErrorBoundaryState;
+    componentDidCatch(error: Error, errorInfo: ErrorInfo): void;
+    reset: () => void;
+    render(): ReactNode;
+}
+/**
+ * Hook version for functional components that need error state
+ */
+declare function useKerneError(): {
+    error: KerneError | null;
+    hasError: boolean;
+    handleError: (err: Error | KerneError) => void;
+    clearError: () => void;
+};
 
-export { KerneClient, KerneProvider, type KerneProviderProps, type KerneReactConfig, createKerneClient, useAuth, useBilling, useKerne };
+export { Allows, AuthLoading, Authenticated, HasSubscription, KerneClient, KerneContext, type KerneError, KerneErrorBoundary, KerneLocalization, KerneProvider, type KerneProviderProps, type KerneReactConfig, Protected, Unauthenticated, useAccess, useAuth, useAuthConfig, useCheckout, useClient, useEntitlements, useInvitation, useKerneError, usePlans, usePortal, useSubscription, useUsage, useUser, useWaitlist };