@luxfi/ui 7.4.3 → 7.4.5

package/dist/iam.cjs

@@ -134,7 +134,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/iam.js

@@ -132,7 +132,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/identity.cjs

@@ -160,7 +160,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/identity.js

@@ -139,7 +139,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/index.cjs

@@ -288,7 +288,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/index.js

@@ -260,7 +260,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@luxfi/ui",
-  "version": "7.4.3",
+  "version": "7.4.5",
   "description": "Cross-platform DeFi UI components built on @hanzo/gui (Tamagui). Native mobile + web.",
   "type": "module",
   "license": "MIT",
@@ -313,7 +313,6 @@
     "@radix-ui/react-slider": "^1.3.6",
     "@radix-ui/react-switch": "^1.2.6",
     "@radix-ui/react-tabs": "^1.1.13",
-    "@tanstack/react-query": "^5.76.0",
     "@uidotdev/usehooks": "^2.4.1",
     "clsx": "^2.1.1",
     "es-toolkit": "^1.31.0",
@@ -322,6 +321,7 @@
     "tailwind-merge": "^3.0.0"
   },
   "peerDependencies": {
+    "@tanstack/react-query": "^5.76.0",
     "@hanzo/gui": "^7.3.0",
     "@hanzogui/colors": "^7.3.0",
     "@hanzogui/config": "^7.3.0",

package/src/iam.ts

@@ -70,11 +70,25 @@ export class IamError extends Error {
   }
 }
 
-/** IAM answers 401, or 200 with a sign-in message. Both mean "no session". */
+/**
+ * "No session" — as opposed to "a session that may not do this".
+ *
+ * IAM says it two ways: 401, and (measured against lux.id) HTTP **200** with
+ * `{"status":"error","msg":"please sign in first"}`, which is what both a
+ * missing and a malformed bearer get. So the message has to be read, not just
+ * the status.
+ *
+ * 403 is deliberately NOT here. `get-organizations` answers 403 to an ordinary
+ * signed-in user — listing the tenant table is a super-admin read — and folding
+ * that into "signed out" logged the user out of the chrome: get-account had
+ * already succeeded, then the org read's 403 wiped the account and every
+ * switcher offered "Sign in" to somebody who was signed in. Forbidden means
+ * signed in and not allowed; the caller falls back to the org it can see.
+ */
 const SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 
 function isSignedOut(status: number, msg: string): boolean {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 
 /** The IAM API root for a host — `lux.cloud` → `https://lux.id/v1/iam`. */

package/src/identity.tsx

@@ -181,8 +181,12 @@ export const IdentityProvider = ({
           return;
         }
         setAccount(me);
-        // A member who cannot list the tenant table still has their OWN org:
-        // fall back to the one the account names rather than showing nothing.
+        // A member who cannot list the tenant table still has their OWN org.
+        // `get-organizations` is a super-admin read and answers 403 to everyone
+        // else (measured on lux.id with a real z@lux.network bearer), so this is
+        // the COMMON path, not an edge case: fall back to the org the account
+        // itself names rather than showing an empty switcher — or, worse,
+        // treating the refusal as "not signed in".
         const rows = await iam.organizations(call).catch((e: unknown) => {
           if (e instanceof IamError && !e.unauthenticated) return [ { owner: 'admin', name: me.owner } ];
           throw e;

package/src/provider.tsx

@@ -88,6 +88,13 @@ interface AppProviderProps {
 
 // AppProvider wraps GuiProvider (the @hanzogui engine, fed the Lux config) +
 // tanstack QueryClientProvider. One provider for every Lux surface.
+//
+// @tanstack/react-query is a PEER, not a dependency: it hands out a React
+// context, and a second physical copy is a second context. When this package
+// carried its own, a surface that also used wagmi got two — AppProvider
+// published a client into one context and `useAccount` read the other, and the
+// page died with "No QueryClient set" under a provider that was plainly there.
+// A context library belongs to the app, once.
 export const AppProvider = ({
   children,
   queryClient,