@object-ui/auth 17.3.0 → 17.6.0

package/dist/SocialSignInButtons.js

@@ -7,8 +7,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * LICENSE file in the root directory of this source tree.
  */
 import { useEffect, useState } from 'react';
-import { useAuth } from './useAuth';
-import { AuthSpinner } from './authStyles';
+import { useAuth } from './useAuth.js';
+import { AuthSpinner } from './authStyles.js';
 // Brand name overrides for providers whose `name` from the server may be unset
 // or where we want to canonicalize casing.
 const PROVIDER_LABEL = {

package/dist/UserMenu.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useAuth } from './useAuth';
-import { getUserInitials } from './types';
+import { useAuth } from './useAuth.js';
+import { getUserInitials } from './types.js';
 /**
  * User menu component displaying the authenticated user's info.
  * Shows avatar, name, email, and common actions (profile, settings, sign out).

package/dist/createAuthClient.d.ts

@@ -5,16 +5,38 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import type { AuthClient, AuthClientConfig } from './types';
+import type { AuthClient, AuthClientConfig } from './types.js';
 /**
  * Simple token storage backed by localStorage.
  * Falls back to in-memory storage when localStorage is unavailable (SSR, tests).
+ *
+ * ## Rotation notifications (objectui#4467)
+ *
+ * `subscribeRotation` fires when a token WE ALREADY HELD is replaced by a
+ * different one — i.e. the server rotated the session under a request nobody
+ * was watching. That is the only case with no owner: sign-in, sign-up and
+ * sign-out all set/clear this storage from `AuthProvider`, which updates its
+ * own identity state in the same breath, so those transitions deliberately
+ * stay silent (first store: no notify; `clear()`: no notify; re-storing the
+ * same value, as `getSession` does on every boot: no notify).
+ *
+ * A rotation with no owner is exactly what impersonation produces — the
+ * console POSTs `/auth/admin/impersonate-user` through a generic metadata
+ * action, the server hands back a NEW session token in `set-auth-token`, and
+ * nothing in that code path knows the identity just changed. See
+ * `AuthProvider`'s subscription and `__tests__/impersonation-lane-4467.test.tsx`.
  */
 export declare const TokenStorage: {
     _memoryToken: string | null;
+    _rotationListeners: Set<() => void>;
     get(): string | null;
     set(token: string): void;
     clear(): void;
+    /**
+     * Observe session-token ROTATIONS (see the header for what does and does not
+     * count as one). Returns an unsubscribe function.
+     */
+    subscribeRotation(listener: () => void): () => void;
 };
 /**
  * Create an auth client instance backed by the official better-auth client.

package/dist/createAuthClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,SAAS,CAAC;AAIjB;;;GAGG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;WAE5B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aASf,IAAI;CAQd,CAAC;AAmHF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAqrBrE"}
+{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,YAAY,CAAC;AAKpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;kCACD,IAAI;WAE/B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aAkBf,IAAI;IASb;;;OAGG;gCACyB,MAAM,IAAI,GAAG,MAAM,IAAI;CAMpD,CAAC;AA2KF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAqrBrE"}

package/dist/createAuthClient.js

@@ -7,13 +7,31 @@
  */
 import { createAuthClient as createBetterAuthClient } from 'better-auth/client';
 import { organizationClient, twoFactorClient } from 'better-auth/client/plugins';
+import { AUTH_INVITATION_STATUSES, isAuthInvitationStatus } from './invitation-status.js';
 const TOKEN_STORAGE_KEY = 'auth-session-token';
 /**
  * Simple token storage backed by localStorage.
  * Falls back to in-memory storage when localStorage is unavailable (SSR, tests).
+ *
+ * ## Rotation notifications (objectui#4467)
+ *
+ * `subscribeRotation` fires when a token WE ALREADY HELD is replaced by a
+ * different one — i.e. the server rotated the session under a request nobody
+ * was watching. That is the only case with no owner: sign-in, sign-up and
+ * sign-out all set/clear this storage from `AuthProvider`, which updates its
+ * own identity state in the same breath, so those transitions deliberately
+ * stay silent (first store: no notify; `clear()`: no notify; re-storing the
+ * same value, as `getSession` does on every boot: no notify).
+ *
+ * A rotation with no owner is exactly what impersonation produces — the
+ * console POSTs `/auth/admin/impersonate-user` through a generic metadata
+ * action, the server hands back a NEW session token in `set-auth-token`, and
+ * nothing in that code path knows the identity just changed. See
+ * `AuthProvider`'s subscription and `__tests__/impersonation-lane-4467.test.tsx`.
  */
 export const TokenStorage = {
     _memoryToken: null,
+    _rotationListeners: new Set(),
     get() {
         try {
             if (typeof localStorage !== 'undefined') {
@@ -24,6 +42,7 @@ export const TokenStorage = {
         return this._memoryToken;
     },
     set(token) {
+        const previous = this.get();
         this._memoryToken = token;
         try {
             if (typeof localStorage !== 'undefined') {
@@ -31,6 +50,15 @@ export const TokenStorage = {
             }
         }
         catch { /* SSR / test */ }
+        // Rotation = a token we were already using got replaced. See the header.
+        if (previous && previous !== token) {
+            for (const listener of [...this._rotationListeners]) {
+                try {
+                    listener();
+                }
+                catch { /* a listener must never break the write that triggered it */ }
+            }
+        }
     },
     clear() {
         this._memoryToken = null;
@@ -41,19 +69,78 @@ export const TokenStorage = {
         }
         catch { /* SSR / test */ }
     },
+    /**
+     * Observe session-token ROTATIONS (see the header for what does and does not
+     * count as one). Returns an unsubscribe function.
+     */
+    subscribeRotation(listener) {
+        this._rotationListeners.add(listener);
+        return () => {
+            this._rotationListeners.delete(listener);
+        };
+    },
 };
 /**
  * Build an `Error` from a better-auth client error, preserving the machine
- * `code` on the thrown Error so callers (LoginForm/RegisterForm) can map it to
- * a localized message instead of surfacing the raw English server text. Falls
- * back to the server message, then the HTTP status.
+ * `code` on the thrown Error so callers (LoginForm/RegisterForm, and every
+ * organization screen) can map it to a localized message instead of surfacing
+ * the raw English server text. Falls back to the server message, then
+ * `fallbackMessage`, then the HTTP status.
+ *
+ * ## Why every organization route now comes through here (objectui#4474)
+ *
+ * This helper existed for sign-in/sign-up only. Every `organization.*` method
+ * below threw `new Error(error.message ?? '…')` directly and therefore **dropped
+ * `code` at the boundary** — so a console screen holding the rejection had the
+ * English sentence and nothing else to key on. That is what forced the
+ * organization UI to echo better-auth's English verbatim in a zh session: the
+ * only remaining way to localize it would have been matching the English text,
+ * which binds the console to a third party's copy-editing and breaks silently
+ * the day they reword a sentence.
+ *
+ * The repair belongs HERE rather than at the console call sites: the code is
+ * produced at this boundary, and a consumer cannot recover information the
+ * producer discarded. `message` is unchanged for every caller — this only stops
+ * throwing away the half of the pair that was already being computed.
+ * `packages/auth/src/__tests__/org-error-code-4474.test.ts` pins both halves.
  */
-function toAuthError(error) {
-    const err = new Error(error.message ?? `Auth request failed with status ${error.status}`);
+function toAuthError(error, fallbackMessage) {
+    const err = new Error(error.message ?? fallbackMessage ?? `Auth request failed with status ${error.status}`);
     if (error.code)
         err.code = error.code;
     return err;
 }
+/**
+ * The wire boundary for invitations (objectui#3879).
+ *
+ * better-auth's client hands these routes back as `any`, so `as AuthInvitation`
+ * was a claim nothing checked — and with `status` narrowed to a closed union,
+ * an unchecked cast would make that union a comment again the day a backend
+ * stored a fifth value. This is the ONE place the claim is verified.
+ *
+ * It fails LOUDLY, naming the offending value, rather than degrading: a status
+ * outside better-auth's own `InvitationStatus` is a producer defect, and the
+ * alternatives all hide it — a neutral badge label renders it as UI copy in ten
+ * packs (the objectui#3879 symptom), and dropping the row deletes an invitation
+ * from an administrative ledger without saying so. Both call paths already
+ * render a rejection with a retry (`InvitationsPage`, `AcceptInvitationPage`),
+ * so the throw lands on a designed surface; `resolveOrgErrorMessage` shows the
+ * sentence verbatim, which is that module's own stated preference over
+ * swallowing an error.
+ */
+function asAuthInvitation(raw, method) {
+    const status = raw?.status;
+    if (!isAuthInvitationStatus(status)) {
+        throw new Error(`${method}: unexpected invitation status ${JSON.stringify(status)} — ` +
+            `expected one of ${AUTH_INVITATION_STATUSES.join(' | ')}`);
+    }
+    return raw;
+}
+/** Same boundary, per row, for the list-returning invitation routes. */
+function asAuthInvitations(raw, method) {
+    const rows = Array.isArray(raw) ? raw : [];
+    return rows.map((row) => asAuthInvitation(row, method));
+}
 /**
  * Resolve a baseURL (which may be relative or absolute) into the
  * `{ origin, basePath }` pair required by the better-auth client.
@@ -630,7 +717,7 @@ export function createAuthClient(config) {
         async listOrganizations() {
             const { data, error } = await betterAuth.organization.list();
             if (error)
-                throw new Error(error.message ?? 'Failed to list organizations');
+                throw toAuthError(error, 'Failed to list organizations');
             return (data ?? []);
         },
         async createOrganization(orgData) {
@@ -640,7 +727,7 @@ export function createAuthClient(config) {
                 logo: orgData.logo,
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to create organization');
+                throw toAuthError(error, 'Failed to create organization');
             return data;
         },
         async setActiveOrganization(orgId) {
@@ -648,7 +735,7 @@ export function createAuthClient(config) {
                 organizationId: orgId,
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to set active organization');
+                throw toAuthError(error, 'Failed to set active organization');
             return (data ?? null);
         },
         async getActiveOrganization() {
@@ -677,7 +764,7 @@ export function createAuthClient(config) {
                 query: { organizationId: orgId },
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to get members');
+                throw toAuthError(error, 'Failed to get members');
             const result = data;
             if (Array.isArray(result))
                 return result;
@@ -697,8 +784,8 @@ export function createAuthClient(config) {
                 ...(inviteData.positions?.length ? { positions: inviteData.positions } : {}),
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to invite member');
-            return data;
+                throw toAuthError(error, 'Failed to invite member');
+            return asAuthInvitation(data, 'inviteMember');
         },
         async removeMember(removeData) {
             const { error } = await betterAuth.organization.removeMember({
@@ -706,7 +793,7 @@ export function createAuthClient(config) {
                 memberIdOrUserId: removeData.memberIdOrUserId,
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to remove member');
+                throw toAuthError(error, 'Failed to remove member');
         },
         async updateMemberRole(payload) {
             const { error } = await betterAuth.organization.updateMemberRole({
@@ -715,7 +802,7 @@ export function createAuthClient(config) {
                 role: payload.role,
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to update member role');
+                throw toAuthError(error, 'Failed to update member role');
         },
         async updateOrganization(orgId, orgData) {
             const { data, error } = await betterAuth.organization.update({
@@ -723,7 +810,7 @@ export function createAuthClient(config) {
                 data: orgData,
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to update organization');
+                throw toAuthError(error, 'Failed to update organization');
             return data;
         },
         async deleteOrganization(orgId) {
@@ -731,14 +818,14 @@ export function createAuthClient(config) {
                 organizationId: orgId,
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to delete organization');
+                throw toAuthError(error, 'Failed to delete organization');
         },
         async leaveOrganization(orgId) {
             const { error } = await betterAuth.organization.leave({
                 organizationId: orgId,
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to leave organization');
+                throw toAuthError(error, 'Failed to leave organization');
         },
         // --- Invitation methods ---
         async listInvitations(orgId) {
@@ -746,37 +833,37 @@ export function createAuthClient(config) {
                 query: { organizationId: orgId },
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to list invitations');
-            return (data ?? []);
+                throw toAuthError(error, 'Failed to list invitations');
+            return asAuthInvitations(data, 'listInvitations');
         },
         async cancelInvitation(invitationId) {
             const { error } = await betterAuth.organization.cancelInvitation({ invitationId });
             if (error)
-                throw new Error(error.message ?? 'Failed to cancel invitation');
+                throw toAuthError(error, 'Failed to cancel invitation');
         },
         async getInvitation(invitationId) {
             const { data, error } = await betterAuth.organization.getInvitation({
                 query: { id: invitationId },
             });
             if (error)
-                throw new Error(error.message ?? 'Failed to load invitation');
-            return data;
+                throw toAuthError(error, 'Failed to load invitation');
+            return asAuthInvitation(data, 'getInvitation');
         },
         async acceptInvitation(invitationId) {
             const { error } = await betterAuth.organization.acceptInvitation({ invitationId });
             if (error)
-                throw new Error(error.message ?? 'Failed to accept invitation');
+                throw toAuthError(error, 'Failed to accept invitation');
         },
         async rejectInvitation(invitationId) {
             const { error } = await betterAuth.organization.rejectInvitation({ invitationId });
             if (error)
-                throw new Error(error.message ?? 'Failed to reject invitation');
+                throw toAuthError(error, 'Failed to reject invitation');
         },
         async listUserInvitations() {
             const { data, error } = await betterAuth.organization.listUserInvitations();
             if (error)
-                throw new Error(error.message ?? 'Failed to list invitations');
-            return (data ?? []);
+                throw toAuthError(error, 'Failed to list invitations');
+            return asAuthInvitations(data, 'listUserInvitations');
         },
     };
 }

package/dist/createAuthenticatedFetch.d.ts

@@ -15,15 +15,13 @@ export interface AuthenticatedAdapterOptions {
     [key: string]: unknown;
 }
 /**
- * Get/set the active organization ID for tenant-scoped API requests.
- * Used by createAuthenticatedFetch to inject X-Tenant-ID header.
+ * Re-exported from its own module so this file stays the WIRE lane and the
+ * storage lane has one home. `ActiveOrganizationStorage` moved out when it
+ * gained per-user scoping (objectui#5664); the export identity is unchanged,
+ * so `@object-ui/auth`'s barrel, this package's tests and every consumer
+ * import the same symbol from the same place they did before.
  */
-export declare const ActiveOrganizationStorage: {
-    _memoryValue: string | null;
-    get(): string | null;
-    set(orgId: string): void;
-    clear(): void;
-};
+export { ActiveOrganizationStorage, SessionUserScope, purgePreviousUserClientState } from './ActiveOrganizationStorage.js';
 export interface CreateAuthenticatedFetchOptions {
     /**
      * When true, requests whose URL resolves to a different origin than the
@@ -39,7 +37,9 @@ export interface CreateAuthenticatedFetchOptions {
 /**
  * Creates an authenticated fetch wrapper that injects the Bearer token
  * from localStorage into every request to the ObjectStack API.
- * Also injects X-Tenant-ID header when an active organization is set.
+ * Also injects X-Tenant-ID header when an active organization is set — see the
+ * "The `X-Tenant-ID` edge contract" section of this package's README for what
+ * that header means, who reads it, and the window in which it is not sent.
  *
  * @example
  * ```ts

package/dist/createAuthenticatedFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthenticatedFetch.d.ts","sourceRoot":"","sources":["../src/createAuthenticatedFetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;;GAGG;AACH,eAAO,MAAM,yBAAyB;kBACd,MAAM,GAAG,IAAI;WAE5B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aASf,IAAI;CAQd,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,+BAA+B,GACxC,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CA0CrE"}
+{"version":3,"file":"createAuthenticatedFetch.d.ts","sourceRoot":"","sources":["../src/createAuthenticatedFetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE3H,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,+BAA+B,GACxC,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CA+GrE"}

package/dist/createAuthenticatedFetch.js

@@ -5,43 +5,17 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import { TokenStorage } from './createAuthClient';
-import { authGateEvents, detectAuthGate } from './auth-gate-events';
-const ACTIVE_ORG_STORAGE_KEY = 'auth-active-organization-id';
+import { TokenStorage } from './createAuthClient.js';
+import { authGateEvents, detectAuthGate } from './auth-gate-events.js';
+import { ActiveOrganizationStorage } from './ActiveOrganizationStorage.js';
 /**
- * Get/set the active organization ID for tenant-scoped API requests.
- * Used by createAuthenticatedFetch to inject X-Tenant-ID header.
+ * Re-exported from its own module so this file stays the WIRE lane and the
+ * storage lane has one home. `ActiveOrganizationStorage` moved out when it
+ * gained per-user scoping (objectui#5664); the export identity is unchanged,
+ * so `@object-ui/auth`'s barrel, this package's tests and every consumer
+ * import the same symbol from the same place they did before.
  */
-export const ActiveOrganizationStorage = {
-    _memoryValue: null,
-    get() {
-        try {
-            if (typeof localStorage !== 'undefined') {
-                return localStorage.getItem(ACTIVE_ORG_STORAGE_KEY);
-            }
-        }
-        catch { /* SSR / test */ }
-        return this._memoryValue;
-    },
-    set(orgId) {
-        this._memoryValue = orgId;
-        try {
-            if (typeof localStorage !== 'undefined') {
-                localStorage.setItem(ACTIVE_ORG_STORAGE_KEY, orgId);
-            }
-        }
-        catch { /* SSR / test */ }
-    },
-    clear() {
-        this._memoryValue = null;
-        try {
-            if (typeof localStorage !== 'undefined') {
-                localStorage.removeItem(ACTIVE_ORG_STORAGE_KEY);
-            }
-        }
-        catch { /* SSR / test */ }
-    },
-};
+export { ActiveOrganizationStorage, SessionUserScope, purgePreviousUserClientState } from './ActiveOrganizationStorage.js';
 /** True when `url` resolves to a different origin than the current page. */
 function isCrossOrigin(url) {
     if (typeof window === 'undefined' || !window.location)
@@ -56,7 +30,9 @@ function isCrossOrigin(url) {
 /**
  * Creates an authenticated fetch wrapper that injects the Bearer token
  * from localStorage into every request to the ObjectStack API.
- * Also injects X-Tenant-ID header when an active organization is set.
+ * Also injects X-Tenant-ID header when an active organization is set — see the
+ * "The `X-Tenant-ID` edge contract" section of this package's README for what
+ * that header means, who reads it, and the window in which it is not sent.
  *
  * @example
  * ```ts
@@ -83,7 +59,43 @@ export function createAuthenticatedFetch(options) {
         if (token && isApiCall) {
             headers.set('Authorization', `Bearer ${token}`);
         }
-        // Inject tenant header for multi-tenant routing
+        // ── `X-Tenant-ID` — the edge routing contract (objectui#5279) ────────
+        //
+        // WHAT IT MEANS. A routing hint for the hosting edge: "this request belongs
+        // to tenant <id>". The value is the better-auth `activeOrganizationId` the
+        // session already carries. It is NOT an identity claim, NOT an
+        // authorization input, and NOT what scopes rows.
+        //
+        // DO NOT DELETE THIS ON THE STRENGTH OF A GREP. The framework
+        // (`objectstack`) does not read it: `resolveAuthzContext` takes `tenantId`
+        // from the API-key principal or `session.activeOrganizationId` and never
+        // from a header, and environment routing reads the hostname and
+        // `X-Environment-Id`. So a search confined to this repo plus the framework
+        // finds zero consumers and reads as "dead stamp" — which is the false
+        // premise objectui#5279 was filed on. The consumer is in the CLOUD repo,
+        // which neither checkout contains: `service-tenant`'s `tenant-context.ts`
+        // resolves the header, and `tenant-router`'s `turso-multi-tenant.zod.ts`
+        // configures that resolution. The configuration contract IS readable from
+        // here — `TenantRoutingConfigSchema` in `@objectstack/spec/cloud` defaults
+        // `tenantHeaderName` to `X-Tenant-ID` and ranks `header` SECOND of six
+        // identification sources, behind `subdomain`.
+        //
+        // THE UNSTAMPED-FIRST-REQUEST GAP. `ActiveOrganizationStorage` is filled
+        // only after AuthProvider's async organization chain resolves, so early
+        // requests go out with the header ABSENT — never present-and-empty. A
+        // reader must fall through to its next identification source rather than
+        // fail closed. Nothing about row visibility rides on this: the framework
+        // scopes from the session, so a response computed inside the window is
+        // still computed for the right tenant.
+        //
+        // Not gated on `isApiCall`, unlike `Authorization` and `Accept-Language`
+        // above — recorded as the behaviour that ships, not endorsed; the
+        // asymmetry is reported on objectui#5279 for triage to route. A wrapper
+        // built with `sameOriginOnly` short-circuits every cross-origin request
+        // before this line.
+        //
+        // Full contract, including what a reader may and may not assume: this
+        // package's README, "The `X-Tenant-ID` edge contract".
         const activeOrgId = ActiveOrganizationStorage.get();
         if (activeOrgId) {
             headers.set('X-Tenant-ID', activeOrgId);
@@ -103,6 +115,39 @@ export function createAuthenticatedFetch(options) {
             }
         }
         const response = await fetch(input, { ...init, headers });
+        // Adopt a session rotation the server declares on the response, exactly as
+        // the auth lane already does (`createBearerFetch` in createAuthClient.ts).
+        //
+        // ## Why this lane needs it too (objectui#4467)
+        //
+        // The console injects the same localStorage bearer from two places: the
+        // AUTH lane (sign-in / get-session / the auth endpoints) and THIS one — the
+        // adapter, `provider: 'api'` data sources, and every metadata `type: 'api'`
+        // action (`useConsoleActionRuntime`'s `apiHandler`). better-auth's
+        // server-side bearer plugin hands a rotated session token back in
+        // `set-auth-token` on whichever lane the call arrived over. Only the auth
+        // lane read it, so a rotation issued to a data-lane call was dropped on the
+        // floor and the browser kept sending the OLD token.
+        //
+        // Impersonation is exactly that call: `POST /auth/admin/impersonate-user`
+        // runs as an ordinary metadata action, so the impersonated session token
+        // arrived here and was discarded — while the server's bearer plugin kept
+        // overwriting the impersonation cookie with the admin bearer we kept
+        // sending. Impersonation was a complete no-op in the console, not merely an
+        // invisible one.
+        //
+        // The rule is the server's declared contract and carries no knowledge of
+        // which endpoint rotated: one contract, one answer, on both lanes. Gated on
+        // `isApiCall` — the same condition that decided we authenticated this
+        // request at all — so a response we never sent the bearer to cannot rotate
+        // the session. Untrusted targets are the `sameOriginOnly` option's job (it
+        // short-circuits above, before any header work).
+        if (isApiCall) {
+            const rotatedToken = response.headers.get('set-auth-token');
+            if (rotatedToken) {
+                TokenStorage.set(rotatedToken);
+            }
+        }
         // ADR-0069 — surface an auth-policy gate (expired password / required MFA)
         // to the remediation overlay. Clone so the caller still reads the body.
         if (isApiCall && response.status === 403) {

package/dist/index.d.ts

@@ -19,23 +19,24 @@
  *
  * @packageDocumentation
  */
-export { AuthProvider, type AuthProviderProps } from './AuthProvider';
-export { useAuth } from './useAuth';
-export { useIsWorkspaceAdmin } from './useIsWorkspaceAdmin';
-export { AuthGuard, type AuthGuardProps } from './AuthGuard';
-export { AuthShell, type AuthShellProps, type AuthShellBrandPanel } from './AuthShell';
-export { LoginForm, type LoginFormProps, type LoginFormLabels } from './LoginForm';
-export { RegisterForm, type RegisterFormProps, type RegisterFormLabels } from './RegisterForm';
-export { ForgotPasswordForm, type ForgotPasswordFormProps, type ForgotPasswordFormLabels } from './ForgotPasswordForm';
-export { SocialSignInButtons, type SocialSignInButtonsProps } from './SocialSignInButtons';
-export { UserMenu, type UserMenuProps } from './UserMenu';
-export { PreviewBanner, type PreviewBannerProps } from './PreviewBanner';
-export { createAuthClient, TokenStorage } from './createAuthClient';
-export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier';
-export { createAuthenticatedFetch, ActiveOrganizationStorage, type AuthenticatedAdapterOptions } from './createAuthenticatedFetch';
-export { getUserInitials } from './types';
-export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, type OrgRole, } from './org-roles';
-export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
-export type { AuthUser, AuthClientSession, AuthState, AuthClient, AuthClientConfig, AuthLinkComponentProps, AuthProviderOptions, PreviewModeOptions, SignInCredentials, SignUpData, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthSocialProvider, AuthPublicConfig, SignInWithProviderOptions, TenancyPosture, DelegableScope, } from './types';
-export type { AuthContextValue } from './AuthContext';
+export { AuthProvider, type AuthProviderProps } from './AuthProvider.js';
+export { useAuth } from './useAuth.js';
+export { useWorkspaceAdminStatus, type WorkspaceAdminStatus } from './useWorkspaceAdminStatus.js';
+export { AuthGuard, type AuthGuardProps } from './AuthGuard.js';
+export { AuthShell, type AuthShellProps, type AuthShellBrandPanel } from './AuthShell.js';
+export { LoginForm, type LoginFormProps, type LoginFormLabels } from './LoginForm.js';
+export { RegisterForm, type RegisterFormProps, type RegisterFormLabels } from './RegisterForm.js';
+export { ForgotPasswordForm, type ForgotPasswordFormProps, type ForgotPasswordFormLabels } from './ForgotPasswordForm.js';
+export { SocialSignInButtons, type SocialSignInButtonsProps } from './SocialSignInButtons.js';
+export { UserMenu, type UserMenuProps } from './UserMenu.js';
+export { PreviewBanner, type PreviewBannerProps } from './PreviewBanner.js';
+export { createAuthClient, TokenStorage } from './createAuthClient.js';
+export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier.js';
+export { createAuthenticatedFetch, ActiveOrganizationStorage, type AuthenticatedAdapterOptions } from './createAuthenticatedFetch.js';
+export { getUserInitials } from './types.js';
+export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, type OrgRole, } from './org-roles.js';
+export { AUTH_INVITATION_STATUSES, isAuthInvitationStatus, type AuthInvitationStatus, } from './invitation-status.js';
+export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles.js';
+export type { AuthUser, AuthClientSession, AuthState, AuthClient, AuthClientConfig, AuthLinkComponentProps, AuthProviderOptions, PreviewModeOptions, SignInCredentials, SignUpData, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthSocialProvider, AuthPublicConfig, SignInWithProviderOptions, TenancyPosture, DelegableScope, } from './types.js';
+export type { AuthContextValue } from './AuthContext.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACnI,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAO1C,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,OAAO,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,cAAc,EACd,cAAc,GACf,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAOvC,OAAO,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC1H,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AACtI,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,OAAO,GACb,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}