@korajs/auth 0.5.0 → 0.6.0

package/dist/chunk-7OXBRSJL.js

@@ -0,0 +1,203 @@
+// src/bindings/create-auth-session.ts
+function createAuthSession(client) {
+  let state = client.state;
+  let isLoading = true;
+  let initError = null;
+  let lastError = null;
+  const listeners = /* @__PURE__ */ new Set();
+  let snapshot = buildSnapshot2();
+  const refreshSnapshot = () => {
+    snapshot = buildSnapshot2();
+  };
+  const notify = () => {
+    refreshSnapshot();
+    for (const listener of listeners) {
+      listener();
+    }
+  };
+  function buildSnapshot2() {
+    return {
+      state,
+      user: client.currentUser,
+      isAuthenticated: state === "authenticated",
+      isLoading,
+      initError,
+      error: lastError
+    };
+  }
+  const captureError = (error) => {
+    lastError = error instanceof Error ? error.message : String(error);
+    notify();
+  };
+  const run = async (action) => {
+    lastError = null;
+    try {
+      await action();
+    } catch (error) {
+      captureError(error);
+    }
+  };
+  const runWithResult = async (action) => {
+    lastError = null;
+    try {
+      return await action();
+    } catch (error) {
+      captureError(error);
+      return null;
+    }
+  };
+  const unsubscribeAuth = client.onAuthChange((nextState) => {
+    state = nextState;
+    notify();
+  });
+  void client.initialize().then(() => {
+    state = client.state;
+    isLoading = false;
+    notify();
+  }).catch((error) => {
+    initError = error instanceof Error ? error : new Error(String(error));
+    isLoading = false;
+    notify();
+  });
+  return {
+    client,
+    getSnapshot: () => snapshot,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    signUp: (params) => run(async () => {
+      await client.signUp(params);
+    }),
+    signIn: (params) => run(async () => {
+      await client.signIn(params);
+    }),
+    signInWithOAuth: async (provider, options) => {
+      lastError = null;
+      try {
+        return await client.signInWithOAuth(provider, options);
+      } catch (error) {
+        captureError(error);
+        throw error instanceof Error ? error : new Error(String(error));
+      }
+    },
+    completeOAuthSignIn: (provider, params) => run(async () => {
+      await client.completeOAuthSignIn(provider, params);
+    }),
+    getOAuthAuthorizationUrl: async (provider, options) => {
+      lastError = null;
+      try {
+        return await client.getOAuthAuthorizationUrl(provider, options);
+      } catch (error) {
+        captureError(error);
+        throw error instanceof Error ? error : new Error(String(error));
+      }
+    },
+    linkOAuth: (provider, params) => runWithResult(async () => client.linkOAuth(provider, params)),
+    listLinkedAccounts: () => runWithResult(async () => client.listLinkedAccounts()).then((value) => value ?? []),
+    unlinkOAuth: (provider) => run(async () => {
+      await client.unlinkOAuth(provider);
+    }),
+    signOut: () => run(async () => {
+      await client.signOut();
+    }),
+    destroy() {
+      unsubscribeAuth();
+      listeners.clear();
+    }
+  };
+}
+
+// src/bindings/create-org-session.ts
+var ROLE_LEVELS = {
+  viewer: 10,
+  billing: 15,
+  member: 20,
+  admin: 30,
+  owner: 40
+};
+function checkOrgPermission(currentRole, requiredRole) {
+  if (!currentRole) return false;
+  const currentLevel = ROLE_LEVELS[currentRole] ?? 0;
+  const requiredLevel = ROLE_LEVELS[requiredRole] ?? 0;
+  return currentLevel >= requiredLevel;
+}
+function createOrgSession(client) {
+  let snapshot = buildSnapshot(client);
+  const listeners = /* @__PURE__ */ new Set();
+  const notify = () => {
+    snapshot = buildSnapshot(client);
+    for (const listener of listeners) {
+      listener();
+    }
+  };
+  const unsubscribeOrgChange = client.onOrgChange(notify);
+  return {
+    client,
+    getSnapshot: () => snapshot,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    checkPermission(requiredRole) {
+      return checkOrgPermission(snapshot.role, requiredRole);
+    },
+    destroy() {
+      unsubscribeOrgChange();
+      listeners.clear();
+    }
+  };
+}
+function buildSnapshot(client) {
+  return {
+    orgId: client.activeOrgId,
+    org: client.activeOrg,
+    role: client.activeRole
+  };
+}
+function createOrgMembersActions(client, orgId, onError) {
+  return {
+    async refresh() {
+      await client.listMembers(orgId);
+    },
+    async invite(email, role) {
+      try {
+        return await client.inviteMember(orgId, { email, role });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        onError(message);
+        throw error;
+      }
+    },
+    async removeMember(userId) {
+      try {
+        await client.removeMember(orgId, userId);
+      } catch (error) {
+        onError(error instanceof Error ? error.message : String(error));
+      }
+    },
+    async updateRole(userId, role) {
+      try {
+        await client.updateMemberRole(orgId, userId, role);
+      } catch (error) {
+        onError(error instanceof Error ? error.message : String(error));
+      }
+    }
+  };
+}
+async function loadOrgMembers(client, orgId) {
+  return client.listMembers(orgId);
+}
+
+export {
+  createAuthSession,
+  checkOrgPermission,
+  createOrgSession,
+  createOrgMembersActions,
+  loadOrgMembers
+};
+//# sourceMappingURL=chunk-7OXBRSJL.js.map

package/dist/chunk-7OXBRSJL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bindings/create-auth-session.ts","../src/bindings/create-org-session.ts"],"sourcesContent":["import type {\n\tAuthClient,\n\tAuthState,\n\tAuthUser,\n\tLinkedOAuthAccount,\n\tOAuthAuthorizationOptions,\n\tOAuthAuthorizationResult,\n\tOAuthCallbackParams,\n} from '../client/auth-client'\n\nexport interface AuthSessionSnapshot {\n\tstate: AuthState\n\tuser: AuthUser | null\n\tisAuthenticated: boolean\n\tisLoading: boolean\n\tinitError: Error | null\n\terror: string | null\n}\n\nexport interface AuthSession {\n\treadonly client: AuthClient\n\tgetSnapshot(): AuthSessionSnapshot\n\tsubscribe(listener: () => void): () => void\n\tsignUp(params: {\n\t\temail: string\n\t\tpassword: string\n\t\tname?: string\n\t\tdeviceId?: string\n\t\tdevicePublicKey?: string\n\t}): Promise<void>\n\tsignIn(params: {\n\t\temail: string\n\t\tpassword: string\n\t\tdeviceId?: string\n\t\tdevicePublicKey?: string\n\t}): Promise<void>\n\tsignInWithOAuth(\n\t\tprovider: string,\n\t\toptions?: OAuthAuthorizationOptions,\n\t): Promise<OAuthAuthorizationResult>\n\tcompleteOAuthSignIn(provider: string, params: OAuthCallbackParams): Promise<void>\n\tgetOAuthAuthorizationUrl(\n\t\tprovider: string,\n\t\toptions?: OAuthAuthorizationOptions,\n\t): Promise<OAuthAuthorizationResult>\n\tlinkOAuth(provider: string, params: OAuthCallbackParams): Promise<LinkedOAuthAccount | null>\n\tlistLinkedAccounts(): Promise<LinkedOAuthAccount[]>\n\tunlinkOAuth(provider: string): Promise<void>\n\tsignOut(): Promise<void>\n\tdestroy(): void\n}\n\n/**\n * Framework-agnostic auth session: initialization, reactive snapshot, and client methods.\n */\nexport function createAuthSession(client: AuthClient): AuthSession {\n\tlet state: AuthState = client.state\n\tlet isLoading = true\n\tlet initError: Error | null = null\n\tlet lastError: string | null = null\n\n\tconst listeners = new Set<() => void>()\n\tlet snapshot = buildSnapshot()\n\n\tconst refreshSnapshot = (): void => {\n\t\tsnapshot = buildSnapshot()\n\t}\n\n\tconst notify = (): void => {\n\t\trefreshSnapshot()\n\t\tfor (const listener of listeners) {\n\t\t\tlistener()\n\t\t}\n\t}\n\n\tfunction buildSnapshot(): AuthSessionSnapshot {\n\t\treturn {\n\t\t\tstate,\n\t\t\tuser: client.currentUser,\n\t\t\tisAuthenticated: state === 'authenticated',\n\t\t\tisLoading,\n\t\t\tinitError,\n\t\t\terror: lastError,\n\t\t}\n\t}\n\n\tconst captureError = (error: unknown): void => {\n\t\tlastError = error instanceof Error ? error.message : String(error)\n\t\tnotify()\n\t}\n\n\tconst run = async (action: () => Promise<void>): Promise<void> => {\n\t\tlastError = null\n\t\ttry {\n\t\t\tawait action()\n\t\t} catch (error) {\n\t\t\tcaptureError(error)\n\t\t}\n\t}\n\n\tconst runWithResult = async <T>(action: () => Promise<T>): Promise<T | null> => {\n\t\tlastError = null\n\t\ttry {\n\t\t\treturn await action()\n\t\t} catch (error) {\n\t\t\tcaptureError(error)\n\t\t\treturn null\n\t\t}\n\t}\n\n\tconst unsubscribeAuth = client.onAuthChange((nextState) => {\n\t\tstate = nextState\n\t\tnotify()\n\t})\n\n\tvoid client\n\t\t.initialize()\n\t\t.then(() => {\n\t\t\tstate = client.state\n\t\t\tisLoading = false\n\t\t\tnotify()\n\t\t})\n\t\t.catch((error: unknown) => {\n\t\t\tinitError = error instanceof Error ? error : new Error(String(error))\n\t\t\tisLoading = false\n\t\t\tnotify()\n\t\t})\n\n\treturn {\n\t\tclient,\n\t\tgetSnapshot: () => snapshot,\n\t\tsubscribe(listener) {\n\t\t\tlisteners.add(listener)\n\t\t\treturn () => {\n\t\t\t\tlisteners.delete(listener)\n\t\t\t}\n\t\t},\n\t\tsignUp: (params) =>\n\t\t\trun(async () => {\n\t\t\t\tawait client.signUp(params)\n\t\t\t}),\n\t\tsignIn: (params) =>\n\t\t\trun(async () => {\n\t\t\t\tawait client.signIn(params)\n\t\t\t}),\n\t\tsignInWithOAuth: async (provider, options) => {\n\t\t\tlastError = null\n\t\t\ttry {\n\t\t\t\treturn await client.signInWithOAuth(provider, options)\n\t\t\t} catch (error) {\n\t\t\t\tcaptureError(error)\n\t\t\t\tthrow error instanceof Error ? error : new Error(String(error))\n\t\t\t}\n\t\t},\n\t\tcompleteOAuthSignIn: (provider, params) =>\n\t\t\trun(async () => {\n\t\t\t\tawait client.completeOAuthSignIn(provider, params)\n\t\t\t}),\n\t\tgetOAuthAuthorizationUrl: async (provider, options) => {\n\t\t\tlastError = null\n\t\t\ttry {\n\t\t\t\treturn await client.getOAuthAuthorizationUrl(provider, options)\n\t\t\t} catch (error) {\n\t\t\t\tcaptureError(error)\n\t\t\t\tthrow error instanceof Error ? error : new Error(String(error))\n\t\t\t}\n\t\t},\n\t\tlinkOAuth: (provider, params) =>\n\t\t\trunWithResult(async () => client.linkOAuth(provider, params)),\n\t\tlistLinkedAccounts: () =>\n\t\t\trunWithResult(async () => client.listLinkedAccounts()).then((value) => value ?? []),\n\t\tunlinkOAuth: (provider) =>\n\t\t\trun(async () => {\n\t\t\t\tawait client.unlinkOAuth(provider)\n\t\t\t}),\n\t\tsignOut: () =>\n\t\t\trun(async () => {\n\t\t\t\tawait client.signOut()\n\t\t\t}),\n\t\tdestroy() {\n\t\t\tunsubscribeAuth()\n\t\t\tlisteners.clear()\n\t\t},\n\t}\n}\n","import type {\n\tClientInvitation,\n\tClientMembership,\n\tClientOrganization,\n\tOrgClient,\n} from '../client/org-client'\n\nexport interface OrgSnapshot {\n\torgId: string | null\n\torg: ClientOrganization | null\n\trole: string | null\n}\n\nexport interface OrgSession {\n\treadonly client: OrgClient\n\tgetSnapshot(): OrgSnapshot\n\tsubscribe(listener: () => void): () => void\n\tcheckPermission(requiredRole: string): boolean\n\tdestroy(): void\n}\n\nconst ROLE_LEVELS: Record<string, number> = {\n\tviewer: 10,\n\tbilling: 15,\n\tmember: 20,\n\tadmin: 30,\n\towner: 40,\n}\n\nexport function checkOrgPermission(currentRole: string | null, requiredRole: string): boolean {\n\tif (!currentRole) return false\n\tconst currentLevel = ROLE_LEVELS[currentRole] ?? 0\n\tconst requiredLevel = ROLE_LEVELS[requiredRole] ?? 0\n\treturn currentLevel >= requiredLevel\n}\n\n/**\n * Framework-agnostic org session with reactive snapshot subscription.\n */\nexport function createOrgSession(client: OrgClient): OrgSession {\n\tlet snapshot = buildSnapshot(client)\n\tconst listeners = new Set<() => void>()\n\n\tconst notify = (): void => {\n\t\tsnapshot = buildSnapshot(client)\n\t\tfor (const listener of listeners) {\n\t\t\tlistener()\n\t\t}\n\t}\n\n\tconst unsubscribeOrgChange = client.onOrgChange(notify)\n\n\treturn {\n\t\tclient,\n\t\tgetSnapshot: () => snapshot,\n\t\tsubscribe(listener: () => void): () => void {\n\t\t\tlisteners.add(listener)\n\t\t\treturn () => {\n\t\t\t\tlisteners.delete(listener)\n\t\t\t}\n\t\t},\n\t\tcheckPermission(requiredRole: string): boolean {\n\t\t\treturn checkOrgPermission(snapshot.role, requiredRole)\n\t\t},\n\t\tdestroy(): void {\n\t\t\tunsubscribeOrgChange()\n\t\t\tlisteners.clear()\n\t\t},\n\t}\n}\n\nfunction buildSnapshot(client: OrgClient): OrgSnapshot {\n\treturn {\n\t\torgId: client.activeOrgId,\n\t\torg: client.activeOrg,\n\t\trole: client.activeRole,\n\t}\n}\n\nexport interface UseOrgMembersActions {\n\trefresh: () => Promise<void>\n\tinvite: (email: string, role: string) => Promise<ClientInvitation>\n\tremoveMember: (userId: string) => Promise<void>\n\tupdateRole: (userId: string, role: string) => Promise<void>\n}\n\n/**\n * Shared org member management actions (loading state remains framework-specific).\n */\nexport function createOrgMembersActions(\n\tclient: OrgClient,\n\torgId: string,\n\tonError: (message: string) => void,\n): UseOrgMembersActions {\n\treturn {\n\t\tasync refresh(): Promise<void> {\n\t\t\tawait client.listMembers(orgId)\n\t\t},\n\t\tasync invite(email: string, role: string): Promise<ClientInvitation> {\n\t\t\ttry {\n\t\t\t\treturn await client.inviteMember(orgId, { email, role })\n\t\t\t} catch (error) {\n\t\t\t\tconst message = error instanceof Error ? error.message : String(error)\n\t\t\t\tonError(message)\n\t\t\t\tthrow error\n\t\t\t}\n\t\t},\n\t\tasync removeMember(userId: string): Promise<void> {\n\t\t\ttry {\n\t\t\t\tawait client.removeMember(orgId, userId)\n\t\t\t} catch (error) {\n\t\t\t\tonError(error instanceof Error ? error.message : String(error))\n\t\t\t}\n\t\t},\n\t\tasync updateRole(userId: string, role: string): Promise<void> {\n\t\t\ttry {\n\t\t\t\tawait client.updateMemberRole(orgId, userId, role)\n\t\t\t} catch (error) {\n\t\t\t\tonError(error instanceof Error ? error.message : String(error))\n\t\t\t}\n\t\t},\n\t}\n}\n\nexport async function loadOrgMembers(\n\tclient: OrgClient,\n\torgId: string,\n): Promise<ClientMembership[]> {\n\treturn client.listMembers(orgId)\n}\n"],"mappings":";AAuDO,SAAS,kBAAkB,QAAiC;AAClE,MAAI,QAAmB,OAAO;AAC9B,MAAI,YAAY;AAChB,MAAI,YAA0B;AAC9B,MAAI,YAA2B;AAE/B,QAAM,YAAY,oBAAI,IAAgB;AACtC,MAAI,WAAWA,eAAc;AAE7B,QAAM,kBAAkB,MAAY;AACnC,eAAWA,eAAc;AAAA,EAC1B;AAEA,QAAM,SAAS,MAAY;AAC1B,oBAAgB;AAChB,eAAW,YAAY,WAAW;AACjC,eAAS;AAAA,IACV;AAAA,EACD;AAEA,WAASA,iBAAqC;AAC7C,WAAO;AAAA,MACN;AAAA,MACA,MAAM,OAAO;AAAA,MACb,iBAAiB,UAAU;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACR;AAAA,EACD;AAEA,QAAM,eAAe,CAAC,UAAyB;AAC9C,gBAAY,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,WAAO;AAAA,EACR;AAEA,QAAM,MAAM,OAAO,WAA+C;AACjE,gBAAY;AACZ,QAAI;AACH,YAAM,OAAO;AAAA,IACd,SAAS,OAAO;AACf,mBAAa,KAAK;AAAA,IACnB;AAAA,EACD;AAEA,QAAM,gBAAgB,OAAU,WAAgD;AAC/E,gBAAY;AACZ,QAAI;AACH,aAAO,MAAM,OAAO;AAAA,IACrB,SAAS,OAAO;AACf,mBAAa,KAAK;AAClB,aAAO;AAAA,IACR;AAAA,EACD;AAEA,QAAM,kBAAkB,OAAO,aAAa,CAAC,cAAc;AAC1D,YAAQ;AACR,WAAO;AAAA,EACR,CAAC;AAED,OAAK,OACH,WAAW,EACX,KAAK,MAAM;AACX,YAAQ,OAAO;AACf,gBAAY;AACZ,WAAO;AAAA,EACR,CAAC,EACA,MAAM,CAAC,UAAmB;AAC1B,gBAAY,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACpE,gBAAY;AACZ,WAAO;AAAA,EACR,CAAC;AAEF,SAAO;AAAA,IACN;AAAA,IACA,aAAa,MAAM;AAAA,IACnB,UAAU,UAAU;AACnB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM;AACZ,kBAAU,OAAO,QAAQ;AAAA,MAC1B;AAAA,IACD;AAAA,IACA,QAAQ,CAAC,WACR,IAAI,YAAY;AACf,YAAM,OAAO,OAAO,MAAM;AAAA,IAC3B,CAAC;AAAA,IACF,QAAQ,CAAC,WACR,IAAI,YAAY;AACf,YAAM,OAAO,OAAO,MAAM;AAAA,IAC3B,CAAC;AAAA,IACF,iBAAiB,OAAO,UAAU,YAAY;AAC7C,kBAAY;AACZ,UAAI;AACH,eAAO,MAAM,OAAO,gBAAgB,UAAU,OAAO;AAAA,MACtD,SAAS,OAAO;AACf,qBAAa,KAAK;AAClB,cAAM,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,MAC/D;AAAA,IACD;AAAA,IACA,qBAAqB,CAAC,UAAU,WAC/B,IAAI,YAAY;AACf,YAAM,OAAO,oBAAoB,UAAU,MAAM;AAAA,IAClD,CAAC;AAAA,IACF,0BAA0B,OAAO,UAAU,YAAY;AACtD,kBAAY;AACZ,UAAI;AACH,eAAO,MAAM,OAAO,yBAAyB,UAAU,OAAO;AAAA,MAC/D,SAAS,OAAO;AACf,qBAAa,KAAK;AAClB,cAAM,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,MAC/D;AAAA,IACD;AAAA,IACA,WAAW,CAAC,UAAU,WACrB,cAAc,YAAY,OAAO,UAAU,UAAU,MAAM,CAAC;AAAA,IAC7D,oBAAoB,MACnB,cAAc,YAAY,OAAO,mBAAmB,CAAC,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC,CAAC;AAAA,IACnF,aAAa,CAAC,aACb,IAAI,YAAY;AACf,YAAM,OAAO,YAAY,QAAQ;AAAA,IAClC,CAAC;AAAA,IACF,SAAS,MACR,IAAI,YAAY;AACf,YAAM,OAAO,QAAQ;AAAA,IACtB,CAAC;AAAA,IACF,UAAU;AACT,sBAAgB;AAChB,gBAAU,MAAM;AAAA,IACjB;AAAA,EACD;AACD;;;ACnKA,IAAM,cAAsC;AAAA,EAC3C,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AACR;AAEO,SAAS,mBAAmB,aAA4B,cAA+B;AAC7F,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,eAAe,YAAY,WAAW,KAAK;AACjD,QAAM,gBAAgB,YAAY,YAAY,KAAK;AACnD,SAAO,gBAAgB;AACxB;AAKO,SAAS,iBAAiB,QAA+B;AAC/D,MAAI,WAAW,cAAc,MAAM;AACnC,QAAM,YAAY,oBAAI,IAAgB;AAEtC,QAAM,SAAS,MAAY;AAC1B,eAAW,cAAc,MAAM;AAC/B,eAAW,YAAY,WAAW;AACjC,eAAS;AAAA,IACV;AAAA,EACD;AAEA,QAAM,uBAAuB,OAAO,YAAY,MAAM;AAEtD,SAAO;AAAA,IACN;AAAA,IACA,aAAa,MAAM;AAAA,IACnB,UAAU,UAAkC;AAC3C,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM;AACZ,kBAAU,OAAO,QAAQ;AAAA,MAC1B;AAAA,IACD;AAAA,IACA,gBAAgB,cAA+B;AAC9C,aAAO,mBAAmB,SAAS,MAAM,YAAY;AAAA,IACtD;AAAA,IACA,UAAgB;AACf,2BAAqB;AACrB,gBAAU,MAAM;AAAA,IACjB;AAAA,EACD;AACD;AAEA,SAAS,cAAc,QAAgC;AACtD,SAAO;AAAA,IACN,OAAO,OAAO;AAAA,IACd,KAAK,OAAO;AAAA,IACZ,MAAM,OAAO;AAAA,EACd;AACD;AAYO,SAAS,wBACf,QACA,OACA,SACuB;AACvB,SAAO;AAAA,IACN,MAAM,UAAyB;AAC9B,YAAM,OAAO,YAAY,KAAK;AAAA,IAC/B;AAAA,IACA,MAAM,OAAO,OAAe,MAAyC;AACpE,UAAI;AACH,eAAO,MAAM,OAAO,aAAa,OAAO,EAAE,OAAO,KAAK,CAAC;AAAA,MACxD,SAAS,OAAO;AACf,cAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,gBAAQ,OAAO;AACf,cAAM;AAAA,MACP;AAAA,IACD;AAAA,IACA,MAAM,aAAa,QAA+B;AACjD,UAAI;AACH,cAAM,OAAO,aAAa,OAAO,MAAM;AAAA,MACxC,SAAS,OAAO;AACf,gBAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC/D;AAAA,IACD;AAAA,IACA,MAAM,WAAW,QAAgB,MAA6B;AAC7D,UAAI;AACH,cAAM,OAAO,iBAAiB,OAAO,QAAQ,IAAI;AAAA,MAClD,SAAS,OAAO;AACf,gBAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC/D;AAAA,IACD;AAAA,EACD;AACD;AAEA,eAAsB,eACrB,QACA,OAC8B;AAC9B,SAAO,OAAO,YAAY,KAAK;AAChC;","names":["buildSnapshot"]}

package/dist/{org-client-q2u55qod.d.cts → create-org-session-RsDj9cl4.d.cts}

@@ -490,6 +490,45 @@ declare class AuthClient {
     private request;
 }
 
+interface AuthSessionSnapshot {
+    state: AuthState;
+    user: AuthUser | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    initError: Error | null;
+    error: string | null;
+}
+interface AuthSession {
+    readonly client: AuthClient;
+    getSnapshot(): AuthSessionSnapshot;
+    subscribe(listener: () => void): () => void;
+    signUp(params: {
+        email: string;
+        password: string;
+        name?: string;
+        deviceId?: string;
+        devicePublicKey?: string;
+    }): Promise<void>;
+    signIn(params: {
+        email: string;
+        password: string;
+        deviceId?: string;
+        devicePublicKey?: string;
+    }): Promise<void>;
+    signInWithOAuth(provider: string, options?: OAuthAuthorizationOptions): Promise<OAuthAuthorizationResult>;
+    completeOAuthSignIn(provider: string, params: OAuthCallbackParams): Promise<void>;
+    getOAuthAuthorizationUrl(provider: string, options?: OAuthAuthorizationOptions): Promise<OAuthAuthorizationResult>;
+    linkOAuth(provider: string, params: OAuthCallbackParams): Promise<LinkedOAuthAccount | null>;
+    listLinkedAccounts(): Promise<LinkedOAuthAccount[]>;
+    unlinkOAuth(provider: string): Promise<void>;
+    signOut(): Promise<void>;
+    destroy(): void;
+}
+/**
+ * Framework-agnostic auth session: initialization, reactive snapshot, and client methods.
+ */
+declare function createAuthSession(client: AuthClient): AuthSession;
+
 /**
  * Organization info returned by the server.
  */
@@ -662,4 +701,22 @@ declare class OrgClient {
     private request;
 }
 
-export { type AuthClientConfig as A, type ClientInvitation as C, type DeviceKeyStore as D, InMemoryDeviceKeyStore as I, type LinkedOAuthAccount as L, type OAuthAuthorizationOptions as O, type PersistentDeviceIdentityOptions as P, type AuthTokenStorage as a, type AuthKeyValueStorage as b, type AuthDeviceIdentityProvider as c, AuthClient as d, type AuthState as e, type AuthDeviceIdentity as f, AuthDeviceIdentityError as g, AuthError as h, type AuthTokenStorageOptions as i, type AuthUser as j, type ClientMembership as k, type ClientOrganization as l, DeviceKeyStoreError as m, IndexedDBDeviceKeyStore as n, type OAuthAuthorizationResult as o, type OAuthCallbackParams as p, OrgClient as q, type OrgClientConfig as r, OrgClientError as s, createAuthTokenStorage as t, createDeviceKeyStore as u, createMemoryAuthTokenStorage as v, createPersistentDeviceIdentity as w, createWebStorageAuthTokenStorage as x };
+interface OrgSnapshot {
+    orgId: string | null;
+    org: ClientOrganization | null;
+    role: string | null;
+}
+interface OrgSession {
+    readonly client: OrgClient;
+    getSnapshot(): OrgSnapshot;
+    subscribe(listener: () => void): () => void;
+    checkPermission(requiredRole: string): boolean;
+    destroy(): void;
+}
+declare function checkOrgPermission(currentRole: string | null, requiredRole: string): boolean;
+/**
+ * Framework-agnostic org session with reactive snapshot subscription.
+ */
+declare function createOrgSession(client: OrgClient): OrgSession;
+
+export { type AuthClientConfig as A, createDeviceKeyStore as B, type ClientInvitation as C, type DeviceKeyStore as D, createMemoryAuthTokenStorage as E, createOrgSession as F, createPersistentDeviceIdentity as G, createWebStorageAuthTokenStorage as H, InMemoryDeviceKeyStore as I, type LinkedOAuthAccount as L, type OAuthAuthorizationOptions as O, type PersistentDeviceIdentityOptions as P, type AuthTokenStorage as a, type AuthKeyValueStorage as b, type AuthDeviceIdentityProvider as c, AuthClient as d, type AuthState as e, type AuthDeviceIdentity as f, AuthDeviceIdentityError as g, AuthError as h, type AuthSession as i, type AuthSessionSnapshot as j, type AuthTokenStorageOptions as k, type AuthUser as l, type ClientMembership as m, type ClientOrganization as n, DeviceKeyStoreError as o, IndexedDBDeviceKeyStore as p, type OAuthAuthorizationResult as q, type OAuthCallbackParams as r, OrgClient as s, type OrgClientConfig as t, OrgClientError as u, type OrgSession as v, type OrgSnapshot as w, checkOrgPermission as x, createAuthSession as y, createAuthTokenStorage as z };

package/dist/{org-client-q2u55qod.d.ts → create-org-session-RsDj9cl4.d.ts}

@@ -490,6 +490,45 @@ declare class AuthClient {
     private request;
 }
 
+interface AuthSessionSnapshot {
+    state: AuthState;
+    user: AuthUser | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    initError: Error | null;
+    error: string | null;
+}
+interface AuthSession {
+    readonly client: AuthClient;
+    getSnapshot(): AuthSessionSnapshot;
+    subscribe(listener: () => void): () => void;
+    signUp(params: {
+        email: string;
+        password: string;
+        name?: string;
+        deviceId?: string;
+        devicePublicKey?: string;
+    }): Promise<void>;
+    signIn(params: {
+        email: string;
+        password: string;
+        deviceId?: string;
+        devicePublicKey?: string;
+    }): Promise<void>;
+    signInWithOAuth(provider: string, options?: OAuthAuthorizationOptions): Promise<OAuthAuthorizationResult>;
+    completeOAuthSignIn(provider: string, params: OAuthCallbackParams): Promise<void>;
+    getOAuthAuthorizationUrl(provider: string, options?: OAuthAuthorizationOptions): Promise<OAuthAuthorizationResult>;
+    linkOAuth(provider: string, params: OAuthCallbackParams): Promise<LinkedOAuthAccount | null>;
+    listLinkedAccounts(): Promise<LinkedOAuthAccount[]>;
+    unlinkOAuth(provider: string): Promise<void>;
+    signOut(): Promise<void>;
+    destroy(): void;
+}
+/**
+ * Framework-agnostic auth session: initialization, reactive snapshot, and client methods.
+ */
+declare function createAuthSession(client: AuthClient): AuthSession;
+
 /**
  * Organization info returned by the server.
  */
@@ -662,4 +701,22 @@ declare class OrgClient {
     private request;
 }
 
-export { type AuthClientConfig as A, type ClientInvitation as C, type DeviceKeyStore as D, InMemoryDeviceKeyStore as I, type LinkedOAuthAccount as L, type OAuthAuthorizationOptions as O, type PersistentDeviceIdentityOptions as P, type AuthTokenStorage as a, type AuthKeyValueStorage as b, type AuthDeviceIdentityProvider as c, AuthClient as d, type AuthState as e, type AuthDeviceIdentity as f, AuthDeviceIdentityError as g, AuthError as h, type AuthTokenStorageOptions as i, type AuthUser as j, type ClientMembership as k, type ClientOrganization as l, DeviceKeyStoreError as m, IndexedDBDeviceKeyStore as n, type OAuthAuthorizationResult as o, type OAuthCallbackParams as p, OrgClient as q, type OrgClientConfig as r, OrgClientError as s, createAuthTokenStorage as t, createDeviceKeyStore as u, createMemoryAuthTokenStorage as v, createPersistentDeviceIdentity as w, createWebStorageAuthTokenStorage as x };
+interface OrgSnapshot {
+    orgId: string | null;
+    org: ClientOrganization | null;
+    role: string | null;
+}
+interface OrgSession {
+    readonly client: OrgClient;
+    getSnapshot(): OrgSnapshot;
+    subscribe(listener: () => void): () => void;
+    checkPermission(requiredRole: string): boolean;
+    destroy(): void;
+}
+declare function checkOrgPermission(currentRole: string | null, requiredRole: string): boolean;
+/**
+ * Framework-agnostic org session with reactive snapshot subscription.
+ */
+declare function createOrgSession(client: OrgClient): OrgSession;
+
+export { type AuthClientConfig as A, createDeviceKeyStore as B, type ClientInvitation as C, type DeviceKeyStore as D, createMemoryAuthTokenStorage as E, createOrgSession as F, createPersistentDeviceIdentity as G, createWebStorageAuthTokenStorage as H, InMemoryDeviceKeyStore as I, type LinkedOAuthAccount as L, type OAuthAuthorizationOptions as O, type PersistentDeviceIdentityOptions as P, type AuthTokenStorage as a, type AuthKeyValueStorage as b, type AuthDeviceIdentityProvider as c, AuthClient as d, type AuthState as e, type AuthDeviceIdentity as f, AuthDeviceIdentityError as g, AuthError as h, type AuthSession as i, type AuthSessionSnapshot as j, type AuthTokenStorageOptions as k, type AuthUser as l, type ClientMembership as m, type ClientOrganization as n, DeviceKeyStoreError as o, IndexedDBDeviceKeyStore as p, type OAuthAuthorizationResult as q, type OAuthCallbackParams as r, OrgClient as s, type OrgClientConfig as t, OrgClientError as u, type OrgSession as v, type OrgSnapshot as w, checkOrgPermission as x, createAuthSession as y, createAuthTokenStorage as z };

package/dist/index.cjs

@@ -41,12 +41,15 @@ __export(index_exports, {
   PasskeyUnsupportedError: () => PasskeyUnsupportedError,
   TokenStore: () => TokenStore,
   authenticateWithPasskey: () => authenticateWithPasskey,
+  checkOrgPermission: () => checkOrgPermission,
   computePublicKeyThumbprint: () => computePublicKeyThumbprint,
+  createAuthSession: () => createAuthSession,
   createAuthTokenStorage: () => createAuthTokenStorage,
   createDeviceKeyStore: () => createDeviceKeyStore,
   createKoraAuth: () => createKoraAuth,
   createKoraAuthSync: () => createKoraAuthSync,
   createMemoryAuthTokenStorage: () => createMemoryAuthTokenStorage,
+  createOrgSession: () => createOrgSession,
   createPasskeyCredential: () => createPasskeyCredential,
   createPersistentDeviceIdentity: () => createPersistentDeviceIdentity,
   createWebStorageAuthTokenStorage: () => createWebStorageAuthTokenStorage,
@@ -1243,6 +1246,168 @@ function createKoraAuthSync(options) {
   return binding;
 }
 
+// src/bindings/create-auth-session.ts
+function createAuthSession(client) {
+  let state = client.state;
+  let isLoading = true;
+  let initError = null;
+  let lastError = null;
+  const listeners = /* @__PURE__ */ new Set();
+  let snapshot = buildSnapshot2();
+  const refreshSnapshot = () => {
+    snapshot = buildSnapshot2();
+  };
+  const notify = () => {
+    refreshSnapshot();
+    for (const listener of listeners) {
+      listener();
+    }
+  };
+  function buildSnapshot2() {
+    return {
+      state,
+      user: client.currentUser,
+      isAuthenticated: state === "authenticated",
+      isLoading,
+      initError,
+      error: lastError
+    };
+  }
+  const captureError = (error) => {
+    lastError = error instanceof Error ? error.message : String(error);
+    notify();
+  };
+  const run = async (action) => {
+    lastError = null;
+    try {
+      await action();
+    } catch (error) {
+      captureError(error);
+    }
+  };
+  const runWithResult = async (action) => {
+    lastError = null;
+    try {
+      return await action();
+    } catch (error) {
+      captureError(error);
+      return null;
+    }
+  };
+  const unsubscribeAuth = client.onAuthChange((nextState) => {
+    state = nextState;
+    notify();
+  });
+  void client.initialize().then(() => {
+    state = client.state;
+    isLoading = false;
+    notify();
+  }).catch((error) => {
+    initError = error instanceof Error ? error : new Error(String(error));
+    isLoading = false;
+    notify();
+  });
+  return {
+    client,
+    getSnapshot: () => snapshot,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    signUp: (params) => run(async () => {
+      await client.signUp(params);
+    }),
+    signIn: (params) => run(async () => {
+      await client.signIn(params);
+    }),
+    signInWithOAuth: async (provider, options) => {
+      lastError = null;
+      try {
+        return await client.signInWithOAuth(provider, options);
+      } catch (error) {
+        captureError(error);
+        throw error instanceof Error ? error : new Error(String(error));
+      }
+    },
+    completeOAuthSignIn: (provider, params) => run(async () => {
+      await client.completeOAuthSignIn(provider, params);
+    }),
+    getOAuthAuthorizationUrl: async (provider, options) => {
+      lastError = null;
+      try {
+        return await client.getOAuthAuthorizationUrl(provider, options);
+      } catch (error) {
+        captureError(error);
+        throw error instanceof Error ? error : new Error(String(error));
+      }
+    },
+    linkOAuth: (provider, params) => runWithResult(async () => client.linkOAuth(provider, params)),
+    listLinkedAccounts: () => runWithResult(async () => client.listLinkedAccounts()).then((value) => value ?? []),
+    unlinkOAuth: (provider) => run(async () => {
+      await client.unlinkOAuth(provider);
+    }),
+    signOut: () => run(async () => {
+      await client.signOut();
+    }),
+    destroy() {
+      unsubscribeAuth();
+      listeners.clear();
+    }
+  };
+}
+
+// src/bindings/create-org-session.ts
+var ROLE_LEVELS = {
+  viewer: 10,
+  billing: 15,
+  member: 20,
+  admin: 30,
+  owner: 40
+};
+function checkOrgPermission(currentRole, requiredRole) {
+  if (!currentRole) return false;
+  const currentLevel = ROLE_LEVELS[currentRole] ?? 0;
+  const requiredLevel = ROLE_LEVELS[requiredRole] ?? 0;
+  return currentLevel >= requiredLevel;
+}
+function createOrgSession(client) {
+  let snapshot = buildSnapshot(client);
+  const listeners = /* @__PURE__ */ new Set();
+  const notify = () => {
+    snapshot = buildSnapshot(client);
+    for (const listener of listeners) {
+      listener();
+    }
+  };
+  const unsubscribeOrgChange = client.onOrgChange(notify);
+  return {
+    client,
+    getSnapshot: () => snapshot,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    checkPermission(requiredRole) {
+      return checkOrgPermission(snapshot.role, requiredRole);
+    },
+    destroy() {
+      unsubscribeOrgChange();
+      listeners.clear();
+    }
+  };
+}
+function buildSnapshot(client) {
+  return {
+    orgId: client.activeOrgId,
+    org: client.activeOrg,
+    role: client.activeRole
+  };
+}
+
 // src/client/org-client.ts
 var import_core6 = require("@korajs/core");
 var OrgClientError = class extends import_core6.KoraError {
@@ -2619,12 +2784,15 @@ function isEncryptedEnvelope(field) {
   PasskeyUnsupportedError,
   TokenStore,
   authenticateWithPasskey,
+  checkOrgPermission,
   computePublicKeyThumbprint,
+  createAuthSession,
   createAuthTokenStorage,
   createDeviceKeyStore,
   createKoraAuth,
   createKoraAuthSync,
   createMemoryAuthTokenStorage,
+  createOrgSession,
   createPasskeyCredential,
   createPersistentDeviceIdentity,
   createWebStorageAuthTokenStorage,