@payload-auth-link/react 0.0.0-stage → 0.1.0

package/dist/__tests__/components.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=components.test.d.ts.map

package/dist/__tests__/components.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"components.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/components.test.tsx"],"names":[],"mappings":""}

package/dist/__tests__/components.test.js

@@ -0,0 +1,163 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+// @vitest-environment happy-dom
+import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+// RTL's auto-cleanup keys off a global afterEach, which Vitest does not
+// provide with `globals` off — clean up explicitly between renders.
+afterEach(() => {
+    cleanup();
+});
+import { AuthLinkProvider } from '../provider.js';
+import { RequireRoles, SignInButton, SignOutButton, UserMenu } from '../components.js';
+const user = {
+    id: 'user-1',
+    collection: 'users',
+    email: 'user@example.com',
+    roles: ['member', 'admin'],
+};
+function jsonResponse(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function stubFetch(handler) {
+    return vi.fn((input, init) => {
+        const result = handler(input, init);
+        return result instanceof Error ? Promise.reject(result) : Promise.resolve(result);
+    });
+}
+function withinProvider(children, options) {
+    const fetchImpl = options?.fetchImpl ?? stubFetch(() => jsonResponse({ user }));
+    if (options && 'initialUser' in options) {
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: options.initialUser, children: children }));
+        return;
+    }
+    render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, children: children }));
+}
+/**
+ * Deterministic settling for negative assertions: await every response
+ * the stub handed out, then drain the microtask queue (bounded) inside
+ * `act` so React flushes whatever those resolutions scheduled. No
+ * wall-clock sleep, so the test cannot pass or fail on machine load.
+ */
+async function settle(fetchImpl) {
+    await act(async () => {
+        await Promise.allSettled(fetchImpl.mock.results.map((result) => result.value));
+        for (let tick = 0; tick < 50; tick += 1) {
+            await Promise.resolve();
+        }
+    });
+}
+describe('SignInButton', () => {
+    it('links to the sign-in page by default', () => {
+        render(_jsx(SignInButton, {}));
+        const link = screen.getByText('Sign in');
+        expect(link.tagName).toBe('A');
+        expect(link.getAttribute('href')).toBe('/sign-in');
+    });
+    it('honors href, className, and children', () => {
+        render(_jsx(SignInButton, { href: "/login", className: "btn", children: "Log in" }));
+        const link = screen.getByText('Log in');
+        expect(link.getAttribute('href')).toBe('/login');
+        expect(link.getAttribute('class')).toBe('btn');
+    });
+});
+describe('SignOutButton', () => {
+    it('signs out, notifies, and navigates on success', async () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ ok: true }));
+        const navigate = vi.fn();
+        const onSignedOut = vi.fn();
+        withinProvider(_jsx(SignOutButton, { redirectTo: "/", navigate: navigate, onSignedOut: onSignedOut }), {
+            fetchImpl,
+            initialUser: user,
+        });
+        fireEvent.click(screen.getByText('Sign out'));
+        await waitFor(() => {
+            expect(onSignedOut).toHaveBeenCalledTimes(1);
+        });
+        expect(navigate).toHaveBeenCalledWith('/');
+        expect(fetchImpl.mock.calls.some(([, init]) => init?.method === 'DELETE')).toBe(true);
+    });
+    it('stays put when revocation fails', async () => {
+        const fetchImpl = stubFetch(() => jsonResponse({}, 500));
+        const navigate = vi.fn();
+        const onSignedOut = vi.fn();
+        withinProvider(_jsx(SignOutButton, { redirectTo: "/", navigate: navigate, onSignedOut: onSignedOut }), {
+            fetchImpl,
+            initialUser: user,
+        });
+        fireEvent.click(screen.getByText('Sign out'));
+        await waitFor(() => {
+            expect(fetchImpl.mock.calls.some(([, init]) => init?.method === 'DELETE')).toBe(true);
+        });
+        // Let the failed DELETE settle; nothing must happen afterwards.
+        await settle(fetchImpl);
+        expect(onSignedOut).not.toHaveBeenCalled();
+        expect(navigate).not.toHaveBeenCalled();
+    });
+});
+describe('SignOutButton redirect safety (SEC-12)', () => {
+    it.each([
+        ['https://evil.example/phish', '/'],
+        ['//evil.example', '/'],
+        ['/api/users', '/'],
+        ['/sign-in', '/sign-in'],
+        ['/goodbye?x=1', '/goodbye?x=1'],
+    ])('navigates %s as %s', async (redirectTo, expected) => {
+        const fetchImpl = stubFetch(() => jsonResponse({ ok: true }));
+        const navigate = vi.fn();
+        withinProvider(_jsx(SignOutButton, { redirectTo: redirectTo, navigate: navigate }), {
+            fetchImpl,
+            initialUser: user,
+        });
+        fireEvent.click(screen.getByText('Sign out'));
+        await waitFor(() => {
+            expect(navigate).toHaveBeenCalledTimes(1);
+        });
+        expect(navigate).toHaveBeenCalledWith(expected);
+    });
+});
+describe('UserMenu', () => {
+    it('renders nothing while loading', async () => {
+        const pending = [];
+        const fetchImpl = vi.fn(async () => new Promise((resolve) => {
+            pending.push(resolve);
+        }));
+        const { container } = render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, children: _jsx(UserMenu, {}) }));
+        expect(container.textContent).toBe('');
+        pending[0]?.(jsonResponse({ user }));
+        // Settle inside the test so no state update lands after unmount.
+        await screen.findByText('user@example.com');
+    });
+    it('offers sign-in when anonymous', async () => {
+        const fetchImpl = stubFetch(() => jsonResponse({}, 401));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, children: _jsx(UserMenu, { signInHref: "/login" }) }));
+        const link = await screen.findByText('Sign in');
+        expect(link.getAttribute('href')).toBe('/login');
+    });
+    it('shows the email and signs out when authenticated', async () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, children: _jsx(UserMenu, {}) }));
+        expect(await screen.findByText('user@example.com')).toBeDefined();
+        expect(screen.getByText('Sign out')).toBeDefined();
+    });
+});
+describe('RequireRoles', () => {
+    it('gates on every listed role', async () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, children: _jsx(RequireRoles, { roles: ['admin'], fallback: _jsx("span", { children: "denied" }), children: _jsx("span", { children: "granted" }) }) }));
+        expect(await screen.findByText('granted')).toBeDefined();
+    });
+    it('fails closed while loading and when denied', () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        const { container } = render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: null, children: _jsx(RequireRoles, { roles: ['owner'], fallback: _jsx("span", { children: "denied" }), children: _jsx("span", { children: "granted" }) }) }));
+        expect(container.textContent).toBe('denied');
+    });
+    it('renders nothing by default when denied', () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        const { container } = render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: null, children: _jsx(RequireRoles, { roles: ['owner'], children: _jsx("span", { children: "granted" }) }) }));
+        expect(container.textContent).toBe('');
+    });
+});
+//# sourceMappingURL=components.test.js.map

package/dist/__tests__/components.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"components.test.js","sourceRoot":"","sources":["../../src/__tests__/components.test.tsx"],"names":[],"mappings":";AAAA,gCAAgC;AAChC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAEzF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE5D,wEAAwE;AACxE,oEAAoE;AACpE,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,EAAE,CAAA;AACX,CAAC,CAAC,CAAA;AAEF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAEtF,MAAM,IAAI,GAAgB;IACxB,EAAE,EAAE,QAAQ;IACZ,UAAU,EAAE,OAAO;IACnB,KAAK,EAAE,kBAAkB;IACzB,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAgE;IACjF,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAqB,EAAE;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,OAAO,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,QAAmB,EACnB,OAAwF;IAExF,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/E,IAAI,OAAO,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC;QACxC,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,YACrE,QAAQ,GACQ,CACpB,CAAA;QACD,OAAM;IACR,CAAC;IACD,MAAM,CAAC,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,YAAG,QAAQ,GAAoB,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CAAC,SAAuC;IAC3D,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAgB,CAAC,CAAC,CAAA;QACzF,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,KAAC,YAAY,KAAG,CAAC,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CACJ,KAAC,YAAY,IAAC,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,KAAK,uBAE5B,CAChB,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACxB,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QAC3B,cAAc,CAAC,KAAC,aAAa,IAAC,UAAU,EAAC,GAAG,EAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,GAAI,EAAE;YAC7F,SAAS;YACT,WAAW,EAAE,IAAI;SAClB,CAAC,CAAA;QACF,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;QAC7C,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QACxD,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACxB,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QAC3B,cAAc,CAAC,KAAC,aAAa,IAAC,UAAU,EAAC,GAAG,EAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,GAAI,EAAE;YAC7F,SAAS;YACT,WAAW,EAAE,IAAI;SAClB,CAAC,CAAA;QACF,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;QAC7C,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvF,CAAC,CAAC,CAAA;QACF,gEAAgE;QAChE,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;QACvB,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,4BAA4B,EAAE,GAAG,CAAC;QACnC,CAAC,gBAAgB,EAAE,GAAG,CAAC;QACvB,CAAC,YAAY,EAAE,GAAG,CAAC;QACnB,CAAC,UAAU,EAAE,UAAU,CAAC;QACxB,CAAC,cAAc,EAAE,cAAc,CAAC;KACjC,CAAC,CAAC,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACxB,cAAc,CAAC,KAAC,aAAa,IAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,GAAI,EAAE;YAC5E,SAAS;YACT,WAAW,EAAE,IAAI;SAClB,CAAC,CAAA;QACF,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;QAC7C,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAqC,EAAE,CAAA;QACpD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CACrB,KAAK,IAAuB,EAAE,CAC5B,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,EAAE;YAChC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC,CAAC,CACL,CAAA;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAC1B,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,YACpC,KAAC,QAAQ,KAAG,GACK,CACpB,CAAA;QACD,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACpC,iEAAiE;QACjE,MAAM,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QACxD,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,YACpC,KAAC,QAAQ,IAAC,UAAU,EAAC,QAAQ,GAAG,GACf,CACpB,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,YACpC,KAAC,QAAQ,KAAG,GACK,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACjE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,YACpC,KAAC,YAAY,IAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,oCAAmB,YAC3D,qCAAoB,GACP,GACE,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAC1B,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,YAAY,IAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,oCAAmB,YAC3D,qCAAoB,GACP,GACE,CACpB,CAAA;QACD,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAC1B,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,YAAY,IAAC,KAAK,EAAE,CAAC,OAAO,CAAC,YAC5B,qCAAoB,GACP,GACE,CACpB,CAAA;QACD,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/__tests__/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/index.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/index.test.js

@@ -0,0 +1,10 @@
+import { describe, expect, it, vi } from 'vitest';
+import { fetchSessionUser } from '../index.js';
+describe('react entrypoint', () => {
+    it('serves the session reader contract through the barrel', async () => {
+        const fetchImpl = vi.fn(() => Promise.resolve(new Response('nope', { status: 401 })));
+        await expect(fetchSessionUser('/api/auth-link/session', fetchImpl)).resolves.toBeNull();
+        expect(fetchImpl).toHaveBeenCalledTimes(1);
+    });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/__tests__/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../../src/__tests__/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;QACrF,MAAM,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACvF,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/provider.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.test.d.ts.map

package/dist/__tests__/provider.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/provider.test.tsx"],"names":[],"mappings":""}

package/dist/__tests__/provider.test.js

@@ -0,0 +1,177 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { AuthLinkProvider, useAuthLink, useHasRoles } from '../provider.js';
+// RTL's auto-cleanup keys off a global afterEach, which Vitest does not
+// provide with `globals` off — clean up explicitly between renders.
+afterEach(() => {
+    cleanup();
+});
+const user = {
+    id: 'user-1',
+    collection: 'users',
+    email: 'user@example.com',
+    roles: ['member', 'admin'],
+};
+function jsonResponse(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function stubFetch(handler) {
+    return vi.fn((input, init) => {
+        const result = handler(input, init);
+        return result instanceof Error ? Promise.reject(result) : Promise.resolve(result);
+    });
+}
+function StatusProbe() {
+    const { user: current, status } = useAuthLink();
+    return (_jsxs("div", { children: [_jsx("span", { "data-testid": "status", children: status }), _jsx("span", { "data-testid": "email", children: current?.email ?? 'none' })] }));
+}
+function RolesProbe({ roles }) {
+    return _jsx("span", { "data-testid": "has-roles", children: useHasRoles(...roles) ? 'yes' : 'no' });
+}
+describe('AuthLinkProvider', () => {
+    it('loads the session on mount', async () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, children: _jsx(StatusProbe, {}) }));
+        expect(screen.getByTestId('status').textContent).toBe('loading');
+        await waitFor(() => {
+            expect(screen.getByTestId('status').textContent).toBe('authenticated');
+        });
+        expect(screen.getByTestId('email').textContent).toBe('user@example.com');
+        expect(fetchImpl).toHaveBeenCalledTimes(1);
+    });
+    it('goes anonymous when no session exists', async () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ error: 'nope' }, 401));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, children: _jsx(StatusProbe, {}) }));
+        await waitFor(() => {
+            expect(screen.getByTestId('status').textContent).toBe('anonymous');
+        });
+    });
+    it('hydrates from initialUser without fetching', () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: user, children: _jsx(StatusProbe, {}) }));
+        expect(screen.getByTestId('status').textContent).toBe('authenticated');
+        expect(screen.getByTestId('email').textContent).toBe('user@example.com');
+        expect(fetchImpl).not.toHaveBeenCalled();
+    });
+    it('hydrates anonymous from a null initialUser without fetching', () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: null, children: _jsx(StatusProbe, {}) }));
+        expect(screen.getByTestId('status').textContent).toBe('anonymous');
+        expect(fetchImpl).not.toHaveBeenCalled();
+    });
+    it('syncs a later initialUser into context (PAR-10)', () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        const other = { ...user, id: 'user-2', email: 'other@example.com' };
+        const { rerender } = render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: null, children: _jsx(StatusProbe, {}) }));
+        expect(screen.getByTestId('status').textContent).toBe('anonymous');
+        rerender(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: user, children: _jsx(StatusProbe, {}) }));
+        expect(screen.getByTestId('email').textContent).toBe('user@example.com');
+        expect(screen.getByTestId('status').textContent).toBe('authenticated');
+        rerender(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: other, children: _jsx(StatusProbe, {}) }));
+        expect(screen.getByTestId('email').textContent).toBe('other@example.com');
+        rerender(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: null, children: _jsx(StatusProbe, {}) }));
+        expect(screen.getByTestId('status').textContent).toBe('anonymous');
+        // Refresh stays explicit: syncing a snapshot never fetches.
+        expect(fetchImpl).not.toHaveBeenCalled();
+    });
+    it('keeps a client sign-out when re-rendered with an equal fresh snapshot', async () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ ok: true }));
+        function SignOutProbe() {
+            const { signOut } = useAuthLink();
+            return (_jsx("button", { type: "button", onClick: () => void signOut(), children: "out" }));
+        }
+        const tree = (snapshot) => (_jsxs(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: snapshot, children: [_jsx(StatusProbe, {}), _jsx(SignOutProbe, {})] }));
+        const { rerender } = render(tree(user));
+        fireEvent.click(screen.getByText('out'));
+        await waitFor(() => {
+            expect(screen.getByTestId('status').textContent).toBe('anonymous');
+        });
+        rerender(tree({ ...user, roles: [...user.roles] }));
+        expect(screen.getByTestId('status').textContent).toBe('anonymous');
+    });
+    it('refreshes on demand', async () => {
+        let current = null;
+        const fetchImpl = stubFetch(() => current ? jsonResponse({ user: current }) : jsonResponse({}, 401));
+        function RefreshProbe() {
+            const { refresh } = useAuthLink();
+            return (_jsx("button", { type: "button", onClick: () => {
+                    void refresh();
+                }, children: "refresh" }));
+        }
+        render(_jsxs(AuthLinkProvider, { fetchImpl: fetchImpl, children: [_jsx(StatusProbe, {}), _jsx(RefreshProbe, {})] }));
+        await waitFor(() => {
+            expect(screen.getByTestId('status').textContent).toBe('anonymous');
+        });
+        current = user;
+        fireEvent.click(screen.getByText('refresh'));
+        await waitFor(() => {
+            expect(screen.getByTestId('status').textContent).toBe('authenticated');
+        });
+    });
+    it('signOut clears state on success and keeps it on failure', async () => {
+        let failRevoke = false;
+        const outcomes = [];
+        const fetchImpl = stubFetch((_input, init) => {
+            if (init?.method === 'DELETE') {
+                return failRevoke ? jsonResponse({}, 500) : jsonResponse({ ok: true });
+            }
+            return jsonResponse({ user });
+        });
+        function SignOutProbe() {
+            const { signOut } = useAuthLink();
+            return (_jsx("button", { type: "button", onClick: () => {
+                    void signOut().then((ok) => outcomes.push(ok));
+                }, children: "sign out" }));
+        }
+        render(_jsxs(AuthLinkProvider, { fetchImpl: fetchImpl, children: [_jsx(StatusProbe, {}), _jsx(SignOutProbe, {})] }));
+        await waitFor(() => {
+            expect(screen.getByTestId('status').textContent).toBe('authenticated');
+        });
+        failRevoke = true;
+        fireEvent.click(screen.getByText('sign out'));
+        await waitFor(() => {
+            expect(outcomes).toEqual([false]);
+        });
+        expect(screen.getByTestId('status').textContent).toBe('authenticated');
+        failRevoke = false;
+        fireEvent.click(screen.getByText('sign out'));
+        await waitFor(() => {
+            expect(screen.getByTestId('status').textContent).toBe('anonymous');
+        });
+        expect(outcomes).toEqual([false, true]);
+    });
+});
+describe('useAuthLink', () => {
+    it('throws outside the provider', () => {
+        const silenced = vi.spyOn(console, 'error').mockImplementation(() => { });
+        try {
+            expect(() => render(_jsx(StatusProbe, {}))).toThrow('useAuthLink must be used within AuthLinkProvider');
+        }
+        finally {
+            silenced.mockRestore();
+        }
+    });
+});
+describe('useHasRoles', () => {
+    it('passes when every listed role is held', () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: user, children: _jsx(RolesProbe, { roles: ['admin', 'member'] }) }));
+        expect(screen.getByTestId('has-roles').textContent).toBe('yes');
+    });
+    it('fails when any listed role is missing', () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: user, children: _jsx(RolesProbe, { roles: ['admin', 'owner'] }) }));
+        expect(screen.getByTestId('has-roles').textContent).toBe('no');
+    });
+    it('fails closed when anonymous', () => {
+        const fetchImpl = stubFetch(() => jsonResponse({ user }));
+        render(_jsx(AuthLinkProvider, { fetchImpl: fetchImpl, initialUser: null, children: _jsx(RolesProbe, { roles: ['admin'] }) }));
+        expect(screen.getByTestId('has-roles').textContent).toBe('no');
+    });
+});
+//# sourceMappingURL=provider.test.js.map

package/dist/__tests__/provider.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.test.js","sourceRoot":"","sources":["../../src/__tests__/provider.test.tsx"],"names":[],"mappings":";AAAA,gCAAgC;AAChC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAEpF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE5D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE3E,wEAAwE;AACxE,oEAAoE;AACpE,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,EAAE,CAAA;AACX,CAAC,CAAC,CAAA;AAEF,MAAM,IAAI,GAAgB;IACxB,EAAE,EAAE,QAAQ;IACZ,UAAU,EAAE,OAAO;IACnB,KAAK,EAAE,kBAAkB;IACzB,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAgE;IACjF,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAqB,EAAE;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,OAAO,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAA;IAC/C,OAAO,CACL,0BACE,8BAAkB,QAAQ,YAAE,MAAM,GAAQ,EAC1C,8BAAkB,OAAO,YAAE,OAAO,EAAE,KAAK,IAAI,MAAM,GAAQ,IACvD,CACP,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,EAAE,KAAK,EAAgC;IACzD,OAAO,8BAAkB,WAAW,YAAE,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAQ,CAAA;AACpF,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,YACpC,KAAC,WAAW,KAAG,GACE,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChE,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACxE,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACxE,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QACvE,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,YACpC,KAAC,WAAW,KAAG,GACE,CACpB,CAAA;QACD,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,WAAW,KAAG,GACE,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACtE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACxE,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,WAAW,KAAG,GACE,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,KAAK,GAAgB,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;QAChF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CACzB,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,WAAW,KAAG,GACE,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,QAAQ,CACN,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,WAAW,KAAG,GACE,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACxE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACtE,QAAQ,CACN,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,YACxD,KAAC,WAAW,KAAG,GACE,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACzE,QAAQ,CACN,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,WAAW,KAAG,GACE,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,4DAA4D;QAC5D,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC7D,SAAS,YAAY;YACnB,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAA;YACjC,OAAO,CACL,iBAAQ,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,oBAE1C,CACV,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,QAAqB,EAAE,EAAE,CAAC,CACtC,MAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,aAC3D,KAAC,WAAW,KAAG,EACf,KAAC,YAAY,KAAG,IACC,CACpB,CAAA;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACvC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;QACxC,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QACF,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,IAAI,OAAO,GAAuB,IAAI,CAAA;QACtC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAC/B,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAClE,CAAA;QACD,SAAS,YAAY;YACnB,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAA;YACjC,OAAO,CACL,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE;oBACZ,KAAK,OAAO,EAAE,CAAA;gBAChB,CAAC,wBAGM,CACV,CAAA;QACH,CAAC;QACD,MAAM,CACJ,MAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,aACpC,KAAC,WAAW,KAAG,EACf,KAAC,YAAY,KAAG,IACC,CACpB,CAAA;QACD,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QACF,OAAO,GAAG,IAAI,CAAA;QACd,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAA;QAC5C,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACxE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAA;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC3C,IAAI,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YACxE,CAAC;YACD,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAA;QACF,SAAS,YAAY;YACnB,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAA;YACjC,OAAO,CACL,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE;oBACZ,KAAK,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;gBAChD,CAAC,yBAGM,CACV,CAAA;QACH,CAAC;QACD,MAAM,CACJ,MAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,aACpC,KAAC,WAAW,KAAG,EACf,KAAC,YAAY,KAAG,IACC,CACpB,CAAA;QACD,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACxE,CAAC,CAAC,CAAA;QACF,UAAU,GAAG,IAAI,CAAA;QACjB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;QAC7C,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACtE,UAAU,GAAG,KAAK,CAAA;QAClB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;QAC7C,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACxE,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAC,WAAW,KAAG,CAAC,CAAC,CAAC,OAAO,CAC3C,kDAAkD,CACnD,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,WAAW,EAAE,CAAA;QACxB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,UAAU,IAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAI,GACzB,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,UAAU,IAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,GAAI,GACxB,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,MAAM,CACJ,KAAC,gBAAgB,IAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,YACvD,KAAC,UAAU,IAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAI,GACf,CACpB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/session.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session.test.d.ts.map

package/dist/__tests__/session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/session.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/session.test.js

@@ -0,0 +1,70 @@
+import { describe, expect, it, vi } from 'vitest';
+import { fetchSessionUser, revokeSession } from '../session.js';
+const user = { id: 'user-1', collection: 'users', email: 'user@example.com', roles: ['member'] };
+function jsonResponse(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function stubFetch(response) {
+    const fetchImpl = vi.fn();
+    if (response instanceof Error) {
+        fetchImpl.mockRejectedValue(response);
+    }
+    else {
+        fetchImpl.mockResolvedValue(response);
+    }
+    return fetchImpl;
+}
+describe('fetchSessionUser', () => {
+    it('reads the user from the default endpoint', async () => {
+        const fetchImpl = stubFetch(jsonResponse({ user }));
+        const result = await fetchSessionUser(undefined, fetchImpl);
+        expect(result).toEqual(user);
+        expect(fetchImpl).toHaveBeenCalledWith('/api/auth-link/session', {
+            method: 'GET',
+            credentials: 'same-origin',
+            cache: 'no-store',
+            headers: { accept: 'application/json' },
+        });
+    });
+    it('honors a custom endpoint', async () => {
+        const fetchImpl = stubFetch(jsonResponse({ user }));
+        await fetchSessionUser('/custom/session', fetchImpl);
+        expect(fetchImpl).toHaveBeenCalledWith('/custom/session', expect.objectContaining({ method: 'GET' }));
+    });
+    it('fails closed on transport and protocol failures', async () => {
+        for (const response of [
+            stubFetch(new Error('down')),
+            stubFetch(jsonResponse({ error: 'nope' }, 401)),
+            stubFetch(jsonResponse({ error: 'nope' }, 500)),
+            stubFetch(new Response('not-json{', { status: 200 })),
+            stubFetch(jsonResponse([user])),
+            stubFetch(jsonResponse({})),
+            stubFetch(jsonResponse({ user: { ...user, email: 'bad' } })),
+        ]) {
+            await expect(fetchSessionUser(undefined, response)).resolves.toBeNull();
+        }
+    });
+});
+describe('revokeSession', () => {
+    it('sends a CSRF-proofed DELETE to the default endpoint', async () => {
+        const fetchImpl = stubFetch(jsonResponse({ ok: true }));
+        await expect(revokeSession(undefined, fetchImpl)).resolves.toBe(true);
+        expect(fetchImpl).toHaveBeenCalledWith('/api/auth-link/session', {
+            method: 'DELETE',
+            credentials: 'same-origin',
+            headers: { 'x-auth-link-csrf': '1' },
+        });
+    });
+    it('treats already-signed-out as success (idempotent logout)', async () => {
+        await expect(revokeSession(undefined, stubFetch(jsonResponse({}, 401)))).resolves.toBe(true);
+    });
+    it('reports failure instead of lying', async () => {
+        await expect(revokeSession(undefined, stubFetch(new Error('down')))).resolves.toBe(false);
+        await expect(revokeSession(undefined, stubFetch(jsonResponse({}, 500)))).resolves.toBe(false);
+        await expect(revokeSession(undefined, stubFetch(jsonResponse({}, 403)))).resolves.toBe(false);
+    });
+});
+//# sourceMappingURL=session.test.js.map

package/dist/__tests__/session.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.test.js","sourceRoot":"","sources":["../../src/__tests__/session.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE/D,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAA;AAEhG,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,QAA0B;IAC3C,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;IACzB,IAAI,QAAQ,YAAY,KAAK,EAAE,CAAC;QAC9B,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACvC,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,wBAAwB,EAAE;YAC/D,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,aAAa;YAC1B,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACnD,MAAM,gBAAgB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAA;QACpD,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,iBAAiB,EACjB,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC3C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,KAAK,MAAM,QAAQ,IAAI;YACrB,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,SAAS,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/C,SAAS,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/C,SAAS,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,SAAS,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/B,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC3B,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;SAC7D,EAAE,CAAC;YACF,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACzE,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACvD,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,wBAAwB,EAAE;YAC/D,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,aAAa;YAC1B,OAAO,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE;SACrC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzF,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7F,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/components.d.ts

@@ -0,0 +1,54 @@
+import type { ReactNode } from 'react';
+/** {@link SignInButton} wiring; unstyled by design. */
+export type SignInButtonProps = {
+    /** Where the sign-in page lives. Defaults to `/sign-in`. */
+    readonly href?: string | undefined;
+    readonly className?: string | undefined;
+    readonly children?: ReactNode | undefined;
+};
+/** Unstyled link to the builder's sign-in page. */
+export declare function SignInButton({ href, className, children, }: SignInButtonProps): ReactNode;
+/** {@link SignOutButton} wiring; navigation is injectable. */
+export type SignOutButtonProps = {
+    readonly className?: string | undefined;
+    readonly children?: ReactNode | undefined;
+    /**
+     * Where to go after a successful sign-out. Stays put by default.
+     * Narrowed by `safeRedirectPath` (an off-origin or API destination
+     * falls back to `/`), so a prop fed from a query param cannot turn
+     * sign-out into an open redirect.
+     */
+    readonly redirectTo?: string | undefined;
+    /** Navigation injection for tests; defaults to a full page load. */
+    readonly navigate?: ((url: string) => void) | undefined;
+    /** Called after a successful sign-out, before navigation. */
+    readonly onSignedOut?: (() => void) | undefined;
+};
+/**
+ * Unstyled sign-out button. Revokes through the provider; on failure it
+ * does nothing (the session is still live, so navigating away would lie).
+ */
+export declare function SignOutButton({ className, children, redirectTo, navigate, onSignedOut, }: SignOutButtonProps): ReactNode;
+/** {@link UserMenu} wiring; renders nothing while loading. */
+export type UserMenuProps = {
+    readonly className?: string | undefined;
+    /** Sign-in page for the anonymous state. Defaults to `/sign-in`. */
+    readonly signInHref?: string | undefined;
+    /** Where to go after sign-out. Stays put by default. */
+    readonly signOutRedirectTo?: string | undefined;
+};
+/**
+ * Minimal session menu: nothing while loading, a sign-in link when
+ * anonymous, the email plus a sign-out button when authenticated.
+ */
+export declare function UserMenu({ className, signInHref, signOutRedirectTo, }: UserMenuProps): ReactNode;
+/** {@link RequireRoles} wiring: all roles required, fail closed. */
+export type RequireRolesProps = {
+    /** Every listed role is required (fail closed while loading). */
+    readonly roles: readonly string[];
+    readonly children: ReactNode;
+    readonly fallback?: ReactNode | undefined;
+};
+/** Render-gate for role-restricted UI. Hides — it never authorizes. */
+export declare function RequireRoles({ roles, children, fallback }: RequireRolesProps): ReactNode;
+//# sourceMappingURL=components.d.ts.map

package/dist/components.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"components.d.ts","sourceRoot":"","sources":["../src/components.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGtC,uDAAuD;AACvD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAC1C,CAAA;AAED,mDAAmD;AACnD,wBAAgB,YAAY,CAAC,EAC3B,IAAiB,EACjB,SAAS,EACT,QAAoB,GACrB,EAAE,iBAAiB,GAAG,SAAS,CAM/B;AAED,8DAA8D;AAC9D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAA;IACvD,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAA;CAChD,CAAA;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,EAC5B,SAAS,EACT,QAAqB,EACrB,UAAU,EACV,QAEC,EACD,WAAW,GACZ,EAAE,kBAAkB,GAAG,SAAS,CAuBhC;AAED,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChD,CAAA;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,EACvB,SAAS,EACT,UAAuB,EACvB,iBAAiB,GAClB,EAAE,aAAa,GAAG,SAAS,CAc3B;AAED,oEAAoE;AACpE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAC1C,CAAA;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAe,EAAE,EAAE,iBAAiB,GAAG,SAAS,CAG/F"}

package/dist/components.js

@@ -0,0 +1,49 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { safeRedirectPath } from '@payload-auth-link/core';
+import { useAuthLink, useHasRoles } from './provider.js';
+/** Unstyled link to the builder's sign-in page. */
+export function SignInButton({ href = '/sign-in', className, children = 'Sign in', }) {
+    return (_jsx("a", { href: href, className: className, "data-auth-link": "sign-in", children: children }));
+}
+/**
+ * Unstyled sign-out button. Revokes through the provider; on failure it
+ * does nothing (the session is still live, so navigating away would lie).
+ */
+export function SignOutButton({ className, children = 'Sign out', redirectTo, navigate = (url) => {
+    window.location.assign(url);
+}, onSignedOut, }) {
+    const { signOut } = useAuthLink();
+    return (_jsx("button", { type: "button", className: className, "data-auth-link": "sign-out", onClick: () => {
+            void (async () => {
+                if (await signOut()) {
+                    onSignedOut?.();
+                    if (redirectTo !== undefined) {
+                        // Sign-in is a fine post-sign-out destination: disable
+                        // that rule, keep the off-origin and API ones.
+                        navigate(safeRedirectPath(redirectTo, '/', { signInPath: null }));
+                    }
+                }
+            })();
+        }, children: children }));
+}
+/**
+ * Minimal session menu: nothing while loading, a sign-in link when
+ * anonymous, the email plus a sign-out button when authenticated.
+ */
+export function UserMenu({ className, signInHref = '/sign-in', signOutRedirectTo, }) {
+    const { user, status } = useAuthLink();
+    if (status === 'loading') {
+        return null;
+    }
+    if (!user) {
+        return _jsx(SignInButton, { href: signInHref });
+    }
+    return (_jsxs("div", { className: className, "data-auth-link": "user-menu", "data-auth-status": status, children: [_jsx("span", { "data-auth-link": "user-email", children: user.email }), ' ', _jsx(SignOutButton, { redirectTo: signOutRedirectTo })] }));
+}
+/** Render-gate for role-restricted UI. Hides — it never authorizes. */
+export function RequireRoles({ roles, children, fallback = null }) {
+    const allowed = useHasRoles(...roles);
+    return allowed ? children : fallback;
+}
+//# sourceMappingURL=components.js.map

package/dist/components.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"components.js","sourceRoot":"","sources":["../src/components.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAUxD,mDAAmD;AACnD,MAAM,UAAU,YAAY,CAAC,EAC3B,IAAI,GAAG,UAAU,EACjB,SAAS,EACT,QAAQ,GAAG,SAAS,GACF;IAClB,OAAO,CACL,YAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,oBAAiB,SAAS,YAC1D,QAAQ,GACP,CACL,CAAA;AACH,CAAC;AAmBD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,SAAS,EACT,QAAQ,GAAG,UAAU,EACrB,UAAU,EACV,QAAQ,GAAG,CAAC,GAAW,EAAQ,EAAE;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC,EACD,WAAW,GACQ;IACnB,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAA;IACjC,OAAO,CACL,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAE,SAAS,oBACL,UAAU,EACzB,OAAO,EAAE,GAAG,EAAE;YACZ,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,MAAM,OAAO,EAAE,EAAE,CAAC;oBACpB,WAAW,EAAE,EAAE,CAAA;oBACf,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;wBAC7B,uDAAuD;wBACvD,+CAA+C;wBAC/C,QAAQ,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;oBACnE,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,EAAE,CAAA;QACN,CAAC,YAEA,QAAQ,GACF,CACV,CAAA;AACH,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,EACvB,SAAS,EACT,UAAU,GAAG,UAAU,EACvB,iBAAiB,GACH;IACd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAA;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAC,YAAY,IAAC,IAAI,EAAE,UAAU,GAAI,CAAA;IAC3C,CAAC;IACD,OAAO,CACL,eAAK,SAAS,EAAE,SAAS,oBAAiB,WAAW,sBAAmB,MAAM,aAC5E,iCAAqB,YAAY,YAAE,IAAI,CAAC,KAAK,GAAQ,EAAC,GAAG,EACzD,KAAC,aAAa,IAAC,UAAU,EAAE,iBAAiB,GAAI,IAC5C,CACP,CAAA;AACH,CAAC;AAUD,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,EAAqB;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAA;AACtC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Provider-agnostic React UI: session context, sign-in components, user
+ * menu, role gates. No Next, no Payload imports — framework work lives in
+ * `@payload-auth-link/next`, server work in `@payload-auth-link/plugin`.
+ */
+export declare const packageName = "@payload-auth-link/react";
+export { RequireRoles, SignInButton, SignOutButton, UserMenu } from './components.js';
+export type { RequireRolesProps, SignInButtonProps, SignOutButtonProps, UserMenuProps, } from './components.js';
+export { AuthLinkProvider, useAuthLink, useHasRoles } from './provider.js';
+export type { AuthLinkContextValue, AuthLinkProviderProps, AuthLinkStatus } from './provider.js';
+export { fetchSessionUser, revokeSession } from './session.js';
+//# sourceMappingURL=index.d.ts.map