@object-ui/auth 17.3.0 → 17.6.0

package/dist/index.js

@@ -19,27 +19,38 @@
  *
  * @packageDocumentation
  */
-export { AuthProvider } from './AuthProvider';
-export { useAuth } from './useAuth';
-export { useIsWorkspaceAdmin } from './useIsWorkspaceAdmin';
-export { AuthGuard } from './AuthGuard';
-export { AuthShell } from './AuthShell';
-export { LoginForm } from './LoginForm';
-export { RegisterForm } from './RegisterForm';
-export { ForgotPasswordForm } from './ForgotPasswordForm';
-export { SocialSignInButtons } from './SocialSignInButtons';
-export { UserMenu } from './UserMenu';
-export { PreviewBanner } from './PreviewBanner';
-export { createAuthClient, TokenStorage } from './createAuthClient';
-export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier';
-export { createAuthenticatedFetch, ActiveOrganizationStorage } from './createAuthenticatedFetch';
-export { getUserInitials } from './types';
+export { AuthProvider } from './AuthProvider.js';
+export { useAuth } from './useAuth.js';
+// objectui#5619 — replaces `useIsWorkspaceAdmin(): boolean`, which had no way
+// to say "not resolved yet" and so answered "not an admin" about an
+// administrator whose adminship lives only in the active member row. The old
+// name is REMOVED rather than kept alongside: a caller that misses the third
+// state is the whole defect, and a deleted export makes that a compile error
+// instead of a silent access-denied screen.
+export { useWorkspaceAdminStatus } from './useWorkspaceAdminStatus.js';
+export { AuthGuard } from './AuthGuard.js';
+export { AuthShell } from './AuthShell.js';
+export { LoginForm } from './LoginForm.js';
+export { RegisterForm } from './RegisterForm.js';
+export { ForgotPasswordForm } from './ForgotPasswordForm.js';
+export { SocialSignInButtons } from './SocialSignInButtons.js';
+export { UserMenu } from './UserMenu.js';
+export { PreviewBanner } from './PreviewBanner.js';
+export { createAuthClient, TokenStorage } from './createAuthClient.js';
+export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier.js';
+export { createAuthenticatedFetch, ActiveOrganizationStorage } from './createAuthenticatedFetch.js';
+export { getUserInitials } from './types.js';
 // Organization membership-role vocabulary — a CLOSED, framework-owned list of
 // four (framework ADR-0108), re-exported from `@objectstack/spec`'s
 // `BUILTIN_MEMBERSHIP_ROLES` so it cannot drift — plus the labels and
 // narrowing helpers every org screen shares, which stay console-owned
 // (see `org-roles.ts` for the boundary).
-export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, } from './org-roles';
+export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, } from './org-roles.js';
+// Invitation lifecycle vocabulary — a CLOSED set of four, bound to better-auth's
+// own `InvitationStatus` so it cannot drift, plus the narrowing guard the wire
+// boundary uses. Exported because a screen switching on `AuthInvitation.status`
+// needs the union by name (objectui#3879).
+export { AUTH_INVITATION_STATUSES, isAuthInvitationStatus, } from './invitation-status.js';
 // Shared auth form primitives — exposed so consumers can build custom forms
 // that match the look of LoginForm / RegisterForm / ForgotPasswordForm.
-export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
+export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles.js';

package/dist/invitation-status.d.ts

@@ -0,0 +1,59 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Invitation status vocabulary — the console's ONE entry point for it.
+ *
+ * ## Why this is a module and not a doc comment
+ *
+ * `AuthInvitation.status` was declared as an open `string` while its own doc
+ * comment enumerated exactly four members (objectui#3879). A comment cannot be
+ * enforced, so every consumer had to be liberal in turn: `InvitationsPage`
+ * carried a `default: 'secondary'` arm in its badge-variant switch and a
+ * `defaultValue: inv.status` that would render the raw wire string as UI copy —
+ * in all ten packs — for any value the enumeration did not cover. Declared =
+ * enforced (AGENTS.md #0.1): the union now lives in the type, and the wire
+ * boundary in `createAuthClient` is the one place an unvalidated string may
+ * become one.
+ *
+ * ## The vocabulary is CLOSED — and derived, not mirrored
+ *
+ * The producer is better-auth's organization plugin, whose own
+ * `InvitationStatus` is `'pending' | 'accepted' | 'rejected' | 'canceled'`
+ * (`better-auth/client/plugins`; the framework stores it in
+ * `sys_invitation.status`). This module BINDS that type instead of restating it,
+ * for the same reason `org-roles.ts` binds the spec's
+ * `BUILTIN_MEMBERSHIP_ROLES`: a member-for-member copy is precisely the state
+ * one upstream release away from drifting silently.
+ *
+ * The runtime list is derived from a total `Record` keyed by that union, so the
+ * compile-time half and the runtime half cannot disagree — a fifth status
+ * upstream fails to compile HERE (the map is missing a key) rather than slipping
+ * past the boundary check and out onto a badge.
+ *
+ * What stays LOCAL, deliberately: everything about *display*. The filter tabs'
+ * `StatusFilter` (which adds an `all` pseudo-member) and the badge variants are
+ * screen concerns and live with the screen — the same boundary `org-roles.ts`
+ * draws for its labels and grade ladder.
+ */
+import type { InvitationStatus } from 'better-auth/client/plugins';
+/**
+ * Status an organization invitation can carry — better-auth's own union, bound
+ * rather than copied.
+ */
+export type AuthInvitationStatus = InvitationStatus;
+/** Every status an invitation can carry, in the order the screens list them. */
+export declare const AUTH_INVITATION_STATUSES: readonly AuthInvitationStatus[];
+/**
+ * Narrow an unvalidated wire value onto the closed status set.
+ *
+ * The ONE place a `string` may become an `AuthInvitationStatus`. Everything
+ * downstream reads the narrowed type and therefore needs no fallback arm — which
+ * is the whole point: a tolerant consumer is where an unexpected value hides.
+ */
+export declare function isAuthInvitationStatus(value: unknown): value is AuthInvitationStatus;
+//# sourceMappingURL=invitation-status.d.ts.map

package/dist/invitation-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation-status.d.ts","sourceRoot":"","sources":["../src/invitation-status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAcpD,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,EAAE,SAAS,oBAAoB,EACrC,CAAC;AAKhC;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF"}

package/dist/invitation-status.js

@@ -0,0 +1,32 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Total map over the union — the compile-time half of the pin. Values are the
+ * members themselves so the runtime list below is DERIVED rather than restated
+ * (one literal list, not two).
+ */
+const STATUS_MEMBERS = {
+    pending: 'pending',
+    accepted: 'accepted',
+    rejected: 'rejected',
+    canceled: 'canceled',
+};
+/** Every status an invitation can carry, in the order the screens list them. */
+export const AUTH_INVITATION_STATUSES = Object.values(STATUS_MEMBERS);
+/** Membership test backing the guard. `Set` so the check stays O(1) per row. */
+const STATUS_LOOKUP = new Set(AUTH_INVITATION_STATUSES);
+/**
+ * Narrow an unvalidated wire value onto the closed status set.
+ *
+ * The ONE place a `string` may become an `AuthInvitationStatus`. Everything
+ * downstream reads the narrowed type and therefore needs no fallback arm — which
+ * is the whole point: a tolerant consumer is where an unexpected value hides.
+ */
+export function isAuthInvitationStatus(value) {
+    return typeof value === 'string' && STATUS_LOOKUP.has(value);
+}

package/dist/types.d.ts

@@ -8,6 +8,7 @@
 import type React from 'react';
 import type { AuthUser as SpecAuthUser, DelegableScope, DelegableAdminScope } from '@objectstack/spec/contracts';
 import type { TenancyPosture } from '@objectstack/spec/security';
+import type { AuthInvitationStatus } from './invitation-status.js';
 /**
  * Authentication types for @object-ui/auth
  */
@@ -55,8 +56,6 @@ export interface AuthUser extends SpecAuthUser {
     image?: string;
     /** Primary role */
     role?: string;
-    /** All assigned roles */
-    roles?: string[];
     /** Email verification status */
     emailVerified?: boolean;
     /** Additional user metadata */
@@ -85,6 +84,18 @@ export interface AuthClientSession {
     expiresAt?: Date;
     /** Refresh token */
     refreshToken?: string;
+    /**
+     * objectui#4467 — set by better-auth's admin plugin while this session is an
+     * IMPERSONATION: the id of the administrator who started it. Present on
+     * `GET /auth/get-session` for the whole life of the impersonated session, so
+     * a console that reads it survives full SPA reboots (it is a property of the
+     * session, not a memory of the click that created it).
+     *
+     * Its presence is what raises the impersonation banner — see
+     * `@object-ui/app-shell`'s `ImpersonationBanner`. Absent on every ordinary
+     * session, which is why the banner costs a normal session nothing.
+     */
+    impersonatedBy?: string;
 }
 /** Authentication state */
 export interface AuthState {
@@ -138,7 +149,36 @@ export interface AuthPublicConfig {
     socialProviders?: AuthSocialProvider[];
     features?: {
         twoFactor?: boolean;
+        /**
+         * RESERVED — declared so the `/auth/config` payload types cleanly, and
+         * consumed by nothing in this repository. Enabling it server-side adds
+         * **no** passkey entry point to the login page, because there is no passkey
+         * sign-in or registration UI for it to gate. Contrast `sso`,
+         * `phoneNumberOtp` and `deviceAuthorization` below, which each gate a real
+         * surface.
+         *
+         * Building the flow is objectui#4179, filed unscheduled. This marking
+         * follows the maintainer's 2026-08-03 ruling on objectui#2514: document the
+         * flag as reserved now, build the UI when the login surface gets roadmap
+         * time (at which point it renders driven by this flag).
+         *
+         * Pinned by `__tests__/reserved-auth-features.test.ts`. That pin fails the
+         * moment a consumer appears, because the declaration, this doc comment and
+         * `README.md`'s reserved section have to retire in one PR — see the pin's
+         * docblock for the retirement checklist.
+         */
         passkeys?: boolean;
+        /**
+         * RESERVED — declared so the `/auth/config` payload types cleanly, and
+         * consumed by nothing in this repository. Enabling it server-side adds
+         * **no** "email me a sign-in link" entry point to the login page: there is
+         * neither a magic-link request step nor a route that consumes the emailed
+         * token.
+         *
+         * Same ruling, same follow-up card and same pin as `passkeys` above
+         * (objectui#2514 / objectui#4179 /
+         * `__tests__/reserved-auth-features.test.ts`).
+         */
         magicLink?: boolean;
         organization?: boolean;
         /**
@@ -401,8 +441,16 @@ export interface AuthInvitation {
     email: string;
     /** Role to be granted upon acceptance */
     role: string;
-    /** Status: 'pending' | 'accepted' | 'rejected' | 'canceled' */
-    status: string;
+    /**
+     * Lifecycle status, as the CLOSED set better-auth stores.
+     *
+     * Was an open `string` with the four members living in this comment, which
+     * left every consumer to be liberal about the fifth value that comment could
+     * not forbid (objectui#3879). The union is `AuthInvitationStatus` now, and
+     * `createAuthClient` narrows the wire value onto it at the boundary — so a
+     * screen reading this field can switch on it exhaustively.
+     */
+    status: AuthInvitationStatus;
     /** Expiration timestamp */
     expiresAt?: string;
     /** ID of the inviting user */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,YAAY,EACxB,cAAc,EACd,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;GAEG;AAEH;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAS,SAAQ,YAAY;IAC5C,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWjG;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,2BAA2B;AAC3B,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sBAAsB;IACtB,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mBAAmB;AACnB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gCAAgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;WAIG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;WAOG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACpG,0FAA0F;IAC1F,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5H,eAAe;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,oFAAoF;IACpF,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACnH,uGAAuG;IACvG,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IAC5H,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,gGAAgG;IAChG,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,gFAAgF;IAChF,SAAS,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG,0DAA0D;IAC1D,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,iFAAiF;IACjF,eAAe,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC9D,qCAAqC;IACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE,yCAAyC;IACzC,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb;;;;;WAKG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,kCAAkC;IAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,6BAA6B;IAC7B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,iEAAiE;IACjE,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,yCAAyC;IACzC,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC5C,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0BAA0B;AAC1B,MAAM,WAAW,sBAAsB;IACrC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC/C,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,YAAY,EACxB,cAAc,EACd,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;GAEG;AAEH;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAS,SAAQ,YAAY;IAC5C,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IAUd,gCAAgC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWjG;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,2BAA2B;AAC3B,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sBAAsB;IACtB,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mBAAmB;AACnB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gCAAgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;;;;;;;;;;;;WAiBG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;;;;;;;WAUG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;WAIG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;WAOG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACpG,0FAA0F;IAC1F,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5H,eAAe;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,oFAAoF;IACpF,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACnH,uGAAuG;IACvG,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IAC5H,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,gGAAgG;IAChG,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,gFAAgF;IAChF,SAAS,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG,0DAA0D;IAC1D,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,iFAAiF;IACjF,eAAe,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC9D,qCAAqC;IACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE,yCAAyC;IACzC,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb;;;;;WAKG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,kCAAkC;IAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,6BAA6B;IAC7B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,iEAAiE;IACjE,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,yCAAyC;IACzC,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC5C,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,MAAM,EAAE,oBAAoB,CAAC;IAC7B,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0BAA0B;AAC1B,MAAM,WAAW,sBAAsB;IACrC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC/C,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/useAuth.d.ts

@@ -5,7 +5,7 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import { type AuthContextValue } from './AuthContext';
+import { type AuthContextValue } from './AuthContext.js';
 /**
  * Hook to access authentication state and methods.
  * Must be used within an AuthProvider.

package/dist/useAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,CA4D1C"}
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,CAiE1C"}

package/dist/useAuth.js

@@ -6,7 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import { useContext } from 'react';
-import { AuthCtx } from './AuthContext';
+import { AuthCtx } from './AuthContext.js';
 /**
  * Hook to access authentication state and methods.
  * Must be used within an AuthProvider.
@@ -36,6 +36,7 @@ export function useAuth() {
             signIn: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
             signUp: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
             signOut: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
+            refreshSession: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
             updateUser: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
             forgotPassword: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
             sendVerificationEmail: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
@@ -59,6 +60,10 @@ export function useAuth() {
             activeOrganization: null,
             activeMember: null,
             isOrganizationsLoading: false,
+            // Nothing to resolve without a provider — same reasoning as `isLoading`
+            // above, which is `false` here for the same reason. A consumer gating on
+            // this must render through in a provider-less embed, not hang.
+            isMembershipResolved: true,
             switchOrganization: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
             createOrganization: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
             refreshOrganizations: async () => { throw new Error('useAuth must be used within an AuthProvider'); },

package/dist/useWorkspaceAdminStatus.d.ts

@@ -0,0 +1,85 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The workspace-admin verdict AND whether it is worth acting on yet.
+ *
+ * These are two different facts and they were one boolean until objectui#5619.
+ * See {@link useWorkspaceAdminStatus} for why collapsing them was a defect.
+ */
+export interface WorkspaceAdminStatus {
+    /**
+     * True only when adminship is CONFIRMED by one of the three legs below.
+     * While `isResolved` is false this is `false` because nothing has said
+     * otherwise yet — NOT because the viewer is known not to be an admin.
+     */
+    isAdmin: boolean;
+    /**
+     * Whether every input `isAdmin` depends on has arrived. Gate any branch
+     * whose wrong side is expensive — a refusal screen, a `<Navigate>`, a nav
+     * entry that would have to be added back — on this being true.
+     */
+    isResolved: boolean;
+}
+/**
+ * Whether the current user has owner/admin privileges, and whether that answer
+ * has finished resolving.
+ *
+ * Sources considered (any one is sufficient):
+ *  - The active organization member row (multi-tenant mode).
+ *  - The top-level `user.role` scalar from the session — legacy deployments
+ *    that still store an admin role on the user row.
+ *  - `user.positions[]` from the session — the canonical identity/position
+ *    names the server derives (ADR-0068 D1/D2, renamed from `roles` by
+ *    ADR-0090 D3). This is the ONLY leg that sees a platform administrator
+ *    whose adminship comes from the `admin_full_access` permission set: on a
+ *    single-tenant deployment there is no member row to read (leg 1), and the
+ *    server deliberately no longer overwrites `user.role` (leg 2), so
+ *    `positions` carrying `platform_admin` is the whole signal. Measured on a
+ *    live protocol-17 server in objectui#5389; pinned by
+ *    `__tests__/workspaceAdminPositions-5389.test.tsx`.
+ *
+ * `positions` is the ONE published spelling. It is deliberately not read
+ * alongside the retired `roles` (ADR-0090 D3 renamed with no deprecation
+ * window and bans resurrecting the old name as a fallback), and not alongside
+ * the derived `user.isPlatformAdmin` either — that flag is computed by the
+ * server as `'platform_admin' in positions` from the same expression, so
+ * reading both would be two spellings for one fact with no way to disagree
+ * usefully and every way to drift.
+ *
+ * In preview-mode / no-auth-enabled mode the provider seeds an admin user,
+ * so this returns `isAdmin: true` for dev/demo setups.
+ *
+ * ## Why this returns a pair and not a boolean (objectui#5619)
+ *
+ * It used to return a bare `boolean`, which gave "not resolved yet" and
+ * "resolved: not an admin" the same answer — `false`. Leg 1 is not settled
+ * when a console page first mounts: `AuthProvider.refreshActiveMember` runs
+ * from its own effect, keyed on `activeOrganization`, which itself appears
+ * only after `listOrganizations()` → `getActiveOrganization()` (→ the ADR-0081
+ * single-membership `setActiveOrganization()` repair) resolve. So an
+ * administrator whose adminship lives ONLY in the member row rendered at least
+ * once as a non-admin, and every gate downstream acted on it: two marketplace
+ * surfaces painted `MarketplaceAccessDenied` at a real administrator, the
+ * console chrome dropped and re-added a nav entry, and `AppContent` fired a
+ * `<Navigate to="/home" replace>` that the later flip cannot undo.
+ *
+ * Legs 2 and 3 DO cover that viewer whenever the session was minted with an
+ * active organization stamped on it — framework `auth-manager.ts` reads
+ * `session.activeOrganizationId` and, when it is set, maps the member row into
+ * `positions[]` as `org_owner`/`org_admin`. The window is therefore not "every
+ * tenant admin" as first reported, but "every session that reaches the console
+ * without that stamp", which is exactly the path `refreshOrganizations`'
+ * ADR-0081 repair exists to serve.
+ *
+ * `isResolved` is deliberately true the moment `isAdmin` is true: a confirmed
+ * admin is a final answer, and the legs still in flight can only agree with it.
+ * Callers therefore never wait on a verdict they already have — an admin
+ * detected through `positions` pays nothing for this gate.
+ */
+export declare function useWorkspaceAdminStatus(): WorkspaceAdminStatus;
+//# sourceMappingURL=useWorkspaceAdminStatus.d.ts.map

package/dist/useWorkspaceAdminStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useWorkspaceAdminStatus.d.ts","sourceRoot":"","sources":["../src/useWorkspaceAdminStatus.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA8BH;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAgB,uBAAuB,IAAI,oBAAoB,CAgB9D"}

package/dist/useWorkspaceAdminStatus.js

@@ -0,0 +1,102 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+import { useAuth } from './useAuth.js';
+const ADMIN_ROLES = new Set([
+    'owner',
+    'admin',
+    'super_admin',
+    'superadmin',
+    'platform_admin',
+    'system_admin',
+    // ADR-0068 canonical names, emitted into `user.positions[]` by the server's
+    // customSession (raw better-auth owner/admin are normalized to org_owner/
+    // org_admin). Accept both raw and canonical so admin detection survives the
+    // removal of the `user.role = 'admin'` overwrite footgun.
+    'org_owner',
+    'org_admin',
+]);
+/**
+ * One name from any of the three sources below — a membership role, the stored
+ * `user.role` scalar, or an entry of `user.positions[]`. The three draw on one
+ * vocabulary by design (ADR-0068 D2 maps a membership `owner`/`admin` onto the
+ * canonical `org_owner`/`org_admin` that `positions[]` carries), so one
+ * predicate serves all three.
+ */
+function isAdminRole(role) {
+    return typeof role === 'string' && ADMIN_ROLES.has(role.toLowerCase());
+}
+/**
+ * Whether the current user has owner/admin privileges, and whether that answer
+ * has finished resolving.
+ *
+ * Sources considered (any one is sufficient):
+ *  - The active organization member row (multi-tenant mode).
+ *  - The top-level `user.role` scalar from the session — legacy deployments
+ *    that still store an admin role on the user row.
+ *  - `user.positions[]` from the session — the canonical identity/position
+ *    names the server derives (ADR-0068 D1/D2, renamed from `roles` by
+ *    ADR-0090 D3). This is the ONLY leg that sees a platform administrator
+ *    whose adminship comes from the `admin_full_access` permission set: on a
+ *    single-tenant deployment there is no member row to read (leg 1), and the
+ *    server deliberately no longer overwrites `user.role` (leg 2), so
+ *    `positions` carrying `platform_admin` is the whole signal. Measured on a
+ *    live protocol-17 server in objectui#5389; pinned by
+ *    `__tests__/workspaceAdminPositions-5389.test.tsx`.
+ *
+ * `positions` is the ONE published spelling. It is deliberately not read
+ * alongside the retired `roles` (ADR-0090 D3 renamed with no deprecation
+ * window and bans resurrecting the old name as a fallback), and not alongside
+ * the derived `user.isPlatformAdmin` either — that flag is computed by the
+ * server as `'platform_admin' in positions` from the same expression, so
+ * reading both would be two spellings for one fact with no way to disagree
+ * usefully and every way to drift.
+ *
+ * In preview-mode / no-auth-enabled mode the provider seeds an admin user,
+ * so this returns `isAdmin: true` for dev/demo setups.
+ *
+ * ## Why this returns a pair and not a boolean (objectui#5619)
+ *
+ * It used to return a bare `boolean`, which gave "not resolved yet" and
+ * "resolved: not an admin" the same answer — `false`. Leg 1 is not settled
+ * when a console page first mounts: `AuthProvider.refreshActiveMember` runs
+ * from its own effect, keyed on `activeOrganization`, which itself appears
+ * only after `listOrganizations()` → `getActiveOrganization()` (→ the ADR-0081
+ * single-membership `setActiveOrganization()` repair) resolve. So an
+ * administrator whose adminship lives ONLY in the member row rendered at least
+ * once as a non-admin, and every gate downstream acted on it: two marketplace
+ * surfaces painted `MarketplaceAccessDenied` at a real administrator, the
+ * console chrome dropped and re-added a nav entry, and `AppContent` fired a
+ * `<Navigate to="/home" replace>` that the later flip cannot undo.
+ *
+ * Legs 2 and 3 DO cover that viewer whenever the session was minted with an
+ * active organization stamped on it — framework `auth-manager.ts` reads
+ * `session.activeOrganizationId` and, when it is set, maps the member row into
+ * `positions[]` as `org_owner`/`org_admin`. The window is therefore not "every
+ * tenant admin" as first reported, but "every session that reaches the console
+ * without that stamp", which is exactly the path `refreshOrganizations`'
+ * ADR-0081 repair exists to serve.
+ *
+ * `isResolved` is deliberately true the moment `isAdmin` is true: a confirmed
+ * admin is a final answer, and the legs still in flight can only agree with it.
+ * Callers therefore never wait on a verdict they already have — an admin
+ * detected through `positions` pays nothing for this gate.
+ */
+export function useWorkspaceAdminStatus() {
+    const { activeMember, user, isLoading, isMembershipResolved } = useAuth();
+    const positions = user?.positions;
+    const isAdmin = isAdminRole(activeMember?.role) ||
+        isAdminRole(user?.role) ||
+        (Array.isArray(positions) && positions.some(isAdminRole));
+    if (isAdmin)
+        return { isAdmin: true, isResolved: true };
+    // Legs 2 and 3 are settled once the session has landed (`isLoading`); leg 1
+    // is settled once the organization/member pipeline has reached a terminal
+    // state (`isMembershipResolved`). Both, because a viewer can be an admin
+    // through either.
+    return { isAdmin: false, isResolved: !isLoading && isMembershipResolved };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/auth",
-  "version": "17.3.0",
+  "version": "17.6.0",
   "type": "module",
   "license": "MIT",
   "description": "Authentication system for Object UI with AuthProvider, useAuth hook, AuthGuard, and form components.",
@@ -30,9 +30,9 @@
     "react": "^18.0.0 || ^19.0.0"
   },
   "dependencies": {
-    "@objectstack/spec": "^17.0.0-rc.2",
-    "better-auth": "^1.6.25",
-    "@object-ui/types": "17.3.0"
+    "@objectstack/spec": "^17.0.0",
+    "better-auth": "^1.6.28",
+    "@object-ui/types": "17.6.0"
   },
   "devDependencies": {
     "@types/react": "19.2.18",
@@ -65,7 +65,7 @@
     "build": "tsc",
     "clean": "rm -rf dist",
     "test": "vitest run",
-    "type-check": "tsc --noEmit && tsc -p tsconfig.typetests.json",
+    "type-check": "tsc --noEmit && tsc -p tsconfig.test.json",
     "lint": "eslint ."
   }
 }

package/dist/useIsWorkspaceAdmin.d.ts

@@ -1,21 +0,0 @@
-/**
- * ObjectUI
- * Copyright (c) 2024-present ObjectStack Inc.
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- */
-/**
- * Returns true when the current user has owner/admin privileges.
- *
- * Sources considered (any one is sufficient):
- *  - The active organization member row (multi-tenant mode).
- *  - The top-level `user.role` / `user.roles` from the session — this covers
- *    platform / system administrators in single-tenant deployments where
- *    there is no `activeMember` row to read a role from.
- *
- * In preview-mode / no-auth-enabled mode the provider seeds an admin user,
- * so this returns `true` for dev/demo setups.
- */
-export declare function useIsWorkspaceAdmin(): boolean;
-//# sourceMappingURL=useIsWorkspaceAdmin.d.ts.map

package/dist/useIsWorkspaceAdmin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useIsWorkspaceAdmin.d.ts","sourceRoot":"","sources":["../src/useIsWorkspaceAdmin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAM7C"}

package/dist/useIsWorkspaceAdmin.js

@@ -1,47 +0,0 @@
-/**
- * ObjectUI
- * Copyright (c) 2024-present ObjectStack Inc.
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- */
-import { useAuth } from './useAuth';
-const ADMIN_ROLES = new Set([
-    'owner',
-    'admin',
-    'super_admin',
-    'superadmin',
-    'platform_admin',
-    'system_admin',
-    // ADR-0068 canonical role names emitted into `user.roles[]` by the server
-    // customSession (raw better-auth owner/admin are normalized to org_owner/
-    // org_admin). Accept both raw and canonical so admin detection survives the
-    // removal of the `user.role = 'admin'` overwrite footgun.
-    'org_owner',
-    'org_admin',
-]);
-function isAdminRole(role) {
-    return typeof role === 'string' && ADMIN_ROLES.has(role.toLowerCase());
-}
-/**
- * Returns true when the current user has owner/admin privileges.
- *
- * Sources considered (any one is sufficient):
- *  - The active organization member row (multi-tenant mode).
- *  - The top-level `user.role` / `user.roles` from the session — this covers
- *    platform / system administrators in single-tenant deployments where
- *    there is no `activeMember` row to read a role from.
- *
- * In preview-mode / no-auth-enabled mode the provider seeds an admin user,
- * so this returns `true` for dev/demo setups.
- */
-export function useIsWorkspaceAdmin() {
-    const { activeMember, user } = useAuth();
-    if (isAdminRole(activeMember?.role))
-        return true;
-    if (isAdminRole(user?.role))
-        return true;
-    if (Array.isArray(user?.roles) && user.roles.some(isAdminRole))
-        return true;
-    return false;
-}