@payload-auth-link/react 0.1.1 → 0.2.1

package/README.md

@@ -16,7 +16,7 @@ ESM-only, Node 20.9 or later.
 
 ## What it provides
 
-- `AuthLinkProvider`, `useAuthLink`, `useHasRoles`: session context, hydrated from the server through `initialUser`
+- `AuthLinkProvider`, `useAuthLink`, `useHasRoles`: session context (`user`, anonymous `guest`, `mfaRequired` step-up signal), hydrated from the server through `initialUser`
 - `SignInButton`, `SignOutButton`, `UserMenu`: unstyled primitives
 - `RequireRoles`: hides UI by role (never use it to gate content; enforce on the server)
 

package/dist/index.d.ts

@@ -8,5 +8,6 @@ export { RequireRoles, SignInButton, SignOutButton, UserMenu } from './component
 export type { RequireRolesProps, SignInButtonProps, SignOutButtonProps, UserMenuProps, } from './components.js';
 export { AuthLinkProvider, useAuthLink, useHasRoles } from './provider.js';
 export type { AuthLinkContextValue, AuthLinkProviderProps, AuthLinkStatus } from './provider.js';
-export { fetchSessionUser, revokeSession } from './session.js';
+export { fetchSession, fetchSessionUser, revokeSession } from './session.js';
+export type { SessionSnapshot } from './session.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,6BAA6B,CAAA;AAErD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACrF,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC1E,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAChG,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,6BAA6B,CAAA;AAErD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACrF,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC1E,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA"}

package/dist/index.js

@@ -6,5 +6,5 @@
 export const packageName = '@payload-auth-link/react';
 export { RequireRoles, SignInButton, SignOutButton, UserMenu } from './components.js';
 export { AuthLinkProvider, useAuthLink, useHasRoles } from './provider.js';
-export { fetchSessionUser, revokeSession } from './session.js';
+export { fetchSession, fetchSessionUser, revokeSession } from './session.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,0BAA0B,CAAA;AAErD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAOrF,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE1E,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,0BAA0B,CAAA;AAErD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAOrF,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA"}

package/dist/provider.d.ts

@@ -1,10 +1,16 @@
 import { type ReactNode } from 'react';
-import { type HttpFetch, type SessionUser } from '@payload-auth-link/core';
+import { type HttpFetch, type SessionGuest, type SessionUser } from '@payload-auth-link/core';
 /** Session state: unknown until the first load settles. */
 export type AuthLinkStatus = 'loading' | 'authenticated' | 'anonymous';
 /** What `useAuthLink` returns: user, status, refresh, honest sign-out. */
 export type AuthLinkContextValue = {
     readonly user: SessionUser | null;
+    /**
+     * The anonymous guest principal (CAP-10), present instead of a
+     * user while the provider session is anonymous. Never carries
+     * roles or access — a stable key for anonymous app state only.
+     */
+    readonly guest: SessionGuest | null;
     readonly status: AuthLinkStatus;
     /** Re-read the session endpoint (call after sign-in or role changes). */
     readonly refresh: () => Promise<void>;

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAA;AACd,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAA;AAGhC,2DAA2D;AAC3D,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,eAAe,GAAG,WAAW,CAAA;AAEtE,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACzC,CAAA;AAID,uEAAuE;AACvE,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;CACtD,CAAA;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,eAA4C,EAC5C,SAAiB,EACjB,WAAuB,GACxB,EAAE,qBAAqB,GAAG,SAAS,CA6DnC;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,IAAI,oBAAoB,CAMlD;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMhE"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAA;AACd,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAA;AAGhC,2DAA2D;AAC3D,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,eAAe,GAAG,WAAW,CAAA;AAEtE,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACzC,CAAA;AAID,uEAAuE;AACvE,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;CACtD,CAAA;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,eAA4C,EAC5C,SAAiB,EACjB,WAAuB,GACxB,EAAE,qBAAqB,GAAG,SAAS,CAiEnC;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,IAAI,oBAAoB,CAMlD;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMhE"}

package/dist/provider.js

@@ -2,7 +2,7 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from 'react';
 import { defaultSessionEndpointPath, } from '@payload-auth-link/core';
-import { fetchSessionUser, revokeSession } from './session.js';
+import { fetchSession, revokeSession } from './session.js';
 const AuthLinkContext = createContext(null);
 /** Value identity for hydration snapshots (fresh objects, same user). */
 function snapshotKey(user) {
@@ -12,7 +12,17 @@ function snapshotKey(user) {
     if (user === null) {
         return 'null';
     }
-    return JSON.stringify([user.id, user.collection, user.email, [...user.roles].sort()]);
+    // PORT-4 facts are part of the value: a re-run loader reporting a
+    // new actor/assurance/tenant for the same user must still sync.
+    return JSON.stringify([
+        user.id,
+        user.collection,
+        user.email,
+        [...user.roles].sort(),
+        user.assurance ?? null,
+        user.actor ?? null,
+        user.organizationId ?? null,
+    ]);
 }
 function statusFor(user) {
     return user === null ? 'anonymous' : 'authenticated';
@@ -28,6 +38,7 @@ function statusFor(user) {
  */
 export function AuthLinkProvider({ children, sessionEndpoint = defaultSessionEndpointPath, fetchImpl = fetch, initialUser = undefined, }) {
     const [user, setUser] = useState(initialUser ?? null);
+    const [guest, setGuest] = useState(null);
     const [status, setStatus] = useState(initialUser === undefined ? 'loading' : statusFor(initialUser));
     // React's "adjust state when a prop changes" pattern (during render,
     // not in an effect): no stale frame, no set-state-in-effect.
@@ -40,16 +51,18 @@ export function AuthLinkProvider({ children, sessionEndpoint = defaultSessionEnd
             setStatus(statusFor(initialUser));
         }
     }
-    const loadSession = useCallback(() => fetchSessionUser(sessionEndpoint, fetchImpl), [sessionEndpoint, fetchImpl]);
+    const loadSession = useCallback(() => fetchSession(sessionEndpoint, fetchImpl), [sessionEndpoint, fetchImpl]);
     const refresh = useCallback(async () => {
         const current = await loadSession();
-        setUser(current);
-        setStatus(current === null ? 'anonymous' : 'authenticated');
+        setUser(current.user);
+        setGuest(current.guest);
+        setStatus(current.user === null ? 'anonymous' : 'authenticated');
     }, [loadSession]);
     const signOut = useCallback(async () => {
         const revoked = await revokeSession(sessionEndpoint, fetchImpl);
         if (revoked) {
             setUser(null);
+            setGuest(null);
             setStatus('anonymous');
         }
         return revoked;
@@ -64,15 +77,16 @@ export function AuthLinkProvider({ children, sessionEndpoint = defaultSessionEnd
         void (async () => {
             const current = await loadSession();
             if (!cancelled) {
-                setUser(current);
-                setStatus(current === null ? 'anonymous' : 'authenticated');
+                setUser(current.user);
+                setGuest(current.guest);
+                setStatus(current.user === null ? 'anonymous' : 'authenticated');
             }
         })();
         return () => {
             cancelled = true;
         };
     }, [initialUser, loadSession]);
-    const value = useMemo(() => ({ user, status, refresh, signOut }), [user, status, refresh, signOut]);
+    const value = useMemo(() => ({ user, guest, status, refresh, signOut }), [user, guest, status, refresh, signOut]);
     return _jsx(AuthLinkContext.Provider, { value: value, children: children });
 }
 /** Read the auth context. Throws outside `AuthLinkProvider` — fail loud. */

package/dist/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EACL,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,OAAO,EACP,QAAQ,GAET,MAAM,OAAO,CAAA;AACd,OAAO,EACL,0BAA0B,GAG3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAkB9D,MAAM,eAAe,GAAG,aAAa,CAA8B,IAAI,CAAC,CAAA;AAkBxE,yEAAyE;AACzE,SAAS,WAAW,CAAC,IAAoC;IACvD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB;IACzC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAA;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,QAAQ,EACR,eAAe,GAAG,0BAA0B,EAC5C,SAAS,GAAG,KAAK,EACjB,WAAW,GAAG,SAAS,GACD;IACtB,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAqB,WAAW,IAAI,IAAI,CAAC,CAAA;IACzE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAClC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAC/D,CAAA;IACD,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1E,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,YAAY,CAAC,WAAW,CAAC,CAAA;QACzB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,WAAW,CAAC,CAAA;YACpB,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAC7B,GAAG,EAAE,CAAC,gBAAgB,CAAC,eAAe,EAAE,SAAS,CAAC,EAClD,CAAC,eAAe,EAAE,SAAS,CAAC,CAC7B,CAAA;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAA;QACnC,OAAO,CAAC,OAAO,CAAC,CAAA;QAChB,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IAC7D,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEjB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;QAC/D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,SAAS,CAAC,WAAW,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAA;IAEhC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAM;QACR,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,oEAAoE;QACpE,qEAAqE;QACrE,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAA;YACnC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,OAAO,CAAC,CAAA;gBAChB,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;YAC7D,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;IAE9B,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAC1C,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CACjC,CAAA;IACD,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAA;AACtF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,CAAA;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,GAAG,KAAwB;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AACzD,CAAC"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EACL,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,OAAO,EACP,QAAQ,GAET,MAAM,OAAO,CAAA;AACd,OAAO,EACL,0BAA0B,GAI3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAwB1D,MAAM,eAAe,GAAG,aAAa,CAA8B,IAAI,CAAC,CAAA;AAkBxE,yEAAyE;AACzE,SAAS,WAAW,CAAC,IAAoC;IACvD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,kEAAkE;IAClE,gEAAgE;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,CAAC,EAAE;QACP,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,KAAK;QACV,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;QACtB,IAAI,CAAC,SAAS,IAAI,IAAI;QACtB,IAAI,CAAC,KAAK,IAAI,IAAI;QAClB,IAAI,CAAC,cAAc,IAAI,IAAI;KAC5B,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB;IACzC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAA;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,QAAQ,EACR,eAAe,GAAG,0BAA0B,EAC5C,SAAS,GAAG,KAAK,EACjB,WAAW,GAAG,SAAS,GACD;IACtB,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAqB,WAAW,IAAI,IAAI,CAAC,CAAA;IACzE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAA;IAC7D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAClC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAC/D,CAAA;IACD,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1E,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,YAAY,CAAC,WAAW,CAAC,CAAA;QACzB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,WAAW,CAAC,CAAA;YACpB,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAC7B,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,EAC9C,CAAC,eAAe,EAAE,SAAS,CAAC,CAC7B,CAAA;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAA;QACnC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACrB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACvB,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IAClE,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEjB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;QAC/D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,SAAS,CAAC,WAAW,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAA;IAEhC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAM;QACR,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,oEAAoE;QACpE,qEAAqE;QACrE,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAA;YACnC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBACrB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBACvB,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;YAClE,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;IAE9B,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACjD,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CACxC,CAAA;IACD,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAA;AACtF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,CAAA;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,GAAG,KAAwB;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AACzD,CAAC"}

package/dist/session.d.ts

@@ -1,4 +1,4 @@
-import { type HttpFetch, type SessionUser } from '@payload-auth-link/core';
+import { type HttpFetch, type SessionGuest, type SessionUser } from '@payload-auth-link/core';
 /**
  * Read the current session user from the plugin's session endpoint
  * (`{ user }` envelope). Fails closed: transport errors, non-2xx
@@ -6,6 +6,18 @@ import { type HttpFetch, type SessionUser } from '@payload-auth-link/core';
  * never an exception and never a partial user.
  */
 export declare function fetchSessionUser(sessionEndpoint?: string, fetchImpl?: HttpFetch): Promise<SessionUser | null>;
+/** Both halves of one session-endpoint read (CAP-10). */
+export type SessionSnapshot = {
+    readonly user: SessionUser | null;
+    readonly guest: SessionGuest | null;
+};
+/**
+ * Read user AND guest from one session-endpoint response. The body
+ * is parsed exactly once; a guest body yields `user: null` plus the
+ * guest, a user body the reverse. Fails closed like
+ * {@link fetchSessionUser}.
+ */
+export declare function fetchSession(sessionEndpoint?: string, fetchImpl?: HttpFetch): Promise<SessionSnapshot>;
 /**
  * Revoke the current session through the plugin's session endpoint.
  * Sends the CSRF header the endpoint requires. Returns `true` when the

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,eAAe,GAAE,MAAmC,EACpD,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAe7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,eAAe,GAAE,MAAmC,EACpD,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,OAAO,CAAC,CAYlB"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,eAAe,GAAE,MAAmC,EACpD,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAe7B;AAED,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,eAAe,GAAE,MAAmC,EACpD,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA6B1B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,eAAe,GAAE,MAAmC,EACpD,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,OAAO,CAAC,CAYlB"}

package/dist/session.js

@@ -1,4 +1,4 @@
-import { csrfHeaderName, defaultSessionEndpointPath, parseSessionResponse, } from '@payload-auth-link/core';
+import { csrfHeaderName, defaultSessionEndpointPath, isRecord, parseSessionGuest, parseSessionResponse, parseSessionUser, } from '@payload-auth-link/core';
 /**
  * Read the current session user from the plugin's session endpoint
  * (`{ user }` envelope). Fails closed: transport errors, non-2xx
@@ -22,6 +22,44 @@ export async function fetchSessionUser(sessionEndpoint = defaultSessionEndpointP
     }
     return parseSessionResponse(response);
 }
+/**
+ * Read user AND guest from one session-endpoint response. The body
+ * is parsed exactly once; a guest body yields `user: null` plus the
+ * guest, a user body the reverse. Fails closed like
+ * {@link fetchSessionUser}.
+ */
+export async function fetchSession(sessionEndpoint = defaultSessionEndpointPath, fetchImpl = fetch) {
+    const empty = { user: null, guest: null };
+    let response;
+    try {
+        response = await fetchImpl(sessionEndpoint, {
+            method: 'GET',
+            credentials: 'same-origin',
+            cache: 'no-store',
+            headers: { accept: 'application/json' },
+        });
+    }
+    catch {
+        return empty;
+    }
+    if (!response.ok) {
+        return empty;
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        return empty;
+    }
+    if (!isRecord(body)) {
+        return empty;
+    }
+    return {
+        user: parseSessionUser(body.user),
+        guest: body.user === null ? parseSessionGuest(body.guest) : null,
+    };
+}
 /**
  * Revoke the current session through the plugin's session endpoint.
  * Sends the CSRF header the endpoint requires. Returns `true` when the

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,oBAAoB,GAGrB,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,kBAA0B,0BAA0B,EACpD,YAAuB,KAAK;IAE5B,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;YAC1C,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,aAAa;YAC1B,0DAA0D;YAC1D,mDAAmD;YACnD,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,kBAA0B,0BAA0B,EACpD,YAAuB,KAAK;IAE5B,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;YAC1C,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,aAAa;YAC1B,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE;SACnC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,QAAQ,EACR,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GAIjB,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,kBAA0B,0BAA0B,EACpD,YAAuB,KAAK;IAE5B,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;YAC1C,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,aAAa;YAC1B,0DAA0D;YAC1D,mDAAmD;YACnD,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAA;AACvC,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,kBAA0B,0BAA0B,EACpD,YAAuB,KAAK;IAE5B,MAAM,KAAK,GAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC1D,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;YAC1C,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,aAAa;YAC1B,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QACjC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,kBAA0B,0BAA0B,EACpD,YAAuB,KAAK;IAE5B,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;YAC1C,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,aAAa;YAC1B,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE;SACnC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAA;AAC/C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payload-auth-link/react",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "payload-auth-link React UI: provider-agnostic sign-in components and user menu.",
   "license": "MIT",
   "repository": {
@@ -37,7 +37,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@payload-auth-link/core": "0.1.1"
+    "@payload-auth-link/core": "0.3.0"
   },
   "peerDependencies": {
     "react": "^19.0.0"

package/src/index.ts

@@ -14,4 +14,5 @@ export type {
 } from './components.js'
 export { AuthLinkProvider, useAuthLink, useHasRoles } from './provider.js'
 export type { AuthLinkContextValue, AuthLinkProviderProps, AuthLinkStatus } from './provider.js'
-export { fetchSessionUser, revokeSession } from './session.js'
+export { fetchSession, fetchSessionUser, revokeSession } from './session.js'
+export type { SessionSnapshot } from './session.js'

package/src/provider.tsx

@@ -12,9 +12,10 @@ import {
 import {
   defaultSessionEndpointPath,
   type HttpFetch,
+  type SessionGuest,
   type SessionUser,
 } from '@payload-auth-link/core'
-import { fetchSessionUser, revokeSession } from './session.js'
+import { fetchSession, revokeSession } from './session.js'
 
 /** Session state: unknown until the first load settles. */
 export type AuthLinkStatus = 'loading' | 'authenticated' | 'anonymous'
@@ -22,6 +23,12 @@ export type AuthLinkStatus = 'loading' | 'authenticated' | 'anonymous'
 /** What `useAuthLink` returns: user, status, refresh, honest sign-out. */
 export type AuthLinkContextValue = {
   readonly user: SessionUser | null
+  /**
+   * The anonymous guest principal (CAP-10), present instead of a
+   * user while the provider session is anonymous. Never carries
+   * roles or access — a stable key for anonymous app state only.
+   */
+  readonly guest: SessionGuest | null
   readonly status: AuthLinkStatus
   /** Re-read the session endpoint (call after sign-in or role changes). */
   readonly refresh: () => Promise<void>
@@ -58,7 +65,17 @@ function snapshotKey(user: SessionUser | null | undefined): string {
   if (user === null) {
     return 'null'
   }
-  return JSON.stringify([user.id, user.collection, user.email, [...user.roles].sort()])
+  // PORT-4 facts are part of the value: a re-run loader reporting a
+  // new actor/assurance/tenant for the same user must still sync.
+  return JSON.stringify([
+    user.id,
+    user.collection,
+    user.email,
+    [...user.roles].sort(),
+    user.assurance ?? null,
+    user.actor ?? null,
+    user.organizationId ?? null,
+  ])
 }
 
 function statusFor(user: SessionUser | null): AuthLinkStatus {
@@ -81,6 +98,7 @@ export function AuthLinkProvider({
   initialUser = undefined,
 }: AuthLinkProviderProps): ReactNode {
   const [user, setUser] = useState<SessionUser | null>(initialUser ?? null)
+  const [guest, setGuest] = useState<SessionGuest | null>(null)
   const [status, setStatus] = useState<AuthLinkStatus>(
     initialUser === undefined ? 'loading' : statusFor(initialUser)
   )
@@ -97,20 +115,22 @@ export function AuthLinkProvider({
   }
 
   const loadSession = useCallback(
-    () => fetchSessionUser(sessionEndpoint, fetchImpl),
+    () => fetchSession(sessionEndpoint, fetchImpl),
     [sessionEndpoint, fetchImpl]
   )
 
   const refresh = useCallback(async () => {
     const current = await loadSession()
-    setUser(current)
-    setStatus(current === null ? 'anonymous' : 'authenticated')
+    setUser(current.user)
+    setGuest(current.guest)
+    setStatus(current.user === null ? 'anonymous' : 'authenticated')
   }, [loadSession])
 
   const signOut = useCallback(async () => {
     const revoked = await revokeSession(sessionEndpoint, fetchImpl)
     if (revoked) {
       setUser(null)
+      setGuest(null)
       setStatus('anonymous')
     }
     return revoked
@@ -126,8 +146,9 @@ export function AuthLinkProvider({
     void (async () => {
       const current = await loadSession()
       if (!cancelled) {
-        setUser(current)
-        setStatus(current === null ? 'anonymous' : 'authenticated')
+        setUser(current.user)
+        setGuest(current.guest)
+        setStatus(current.user === null ? 'anonymous' : 'authenticated')
       }
     })()
     return () => {
@@ -136,8 +157,8 @@ export function AuthLinkProvider({
   }, [initialUser, loadSession])
 
   const value = useMemo<AuthLinkContextValue>(
-    () => ({ user, status, refresh, signOut }),
-    [user, status, refresh, signOut]
+    () => ({ user, guest, status, refresh, signOut }),
+    [user, guest, status, refresh, signOut]
   )
   return <AuthLinkContext.Provider value={value}>{children}</AuthLinkContext.Provider>
 }

package/src/session.ts

@@ -1,8 +1,12 @@
 import {
   csrfHeaderName,
   defaultSessionEndpointPath,
+  isRecord,
+  parseSessionGuest,
   parseSessionResponse,
+  parseSessionUser,
   type HttpFetch,
+  type SessionGuest,
   type SessionUser,
 } from '@payload-auth-link/core'
 
@@ -32,6 +36,52 @@ export async function fetchSessionUser(
   return parseSessionResponse(response)
 }
 
+/** Both halves of one session-endpoint read (CAP-10). */
+export type SessionSnapshot = {
+  readonly user: SessionUser | null
+  readonly guest: SessionGuest | null
+}
+
+/**
+ * Read user AND guest from one session-endpoint response. The body
+ * is parsed exactly once; a guest body yields `user: null` plus the
+ * guest, a user body the reverse. Fails closed like
+ * {@link fetchSessionUser}.
+ */
+export async function fetchSession(
+  sessionEndpoint: string = defaultSessionEndpointPath,
+  fetchImpl: HttpFetch = fetch
+): Promise<SessionSnapshot> {
+  const empty: SessionSnapshot = { user: null, guest: null }
+  let response: Response
+  try {
+    response = await fetchImpl(sessionEndpoint, {
+      method: 'GET',
+      credentials: 'same-origin',
+      cache: 'no-store',
+      headers: { accept: 'application/json' },
+    })
+  } catch {
+    return empty
+  }
+  if (!response.ok) {
+    return empty
+  }
+  let body: unknown
+  try {
+    body = await response.json()
+  } catch {
+    return empty
+  }
+  if (!isRecord(body)) {
+    return empty
+  }
+  return {
+    user: parseSessionUser(body.user),
+    guest: body.user === null ? parseSessionGuest(body.guest) : null,
+  }
+}
+
 /**
  * Revoke the current session through the plugin's session endpoint.
  * Sends the CSRF header the endpoint requires. Returns `true` when the