@poly-x/react 0.1.0-alpha.13 → 0.1.0-alpha.15

package/dist/index.cjs

@@ -433,6 +433,9 @@ var BffSessionStore = class {
 			status: "signed-out",
 			reason: "signed-out"
 		});
+		if (options?.onSignOut) try {
+			await options.onSignOut();
+		} catch {}
 		window.location.assign(options?.redirectTo ?? "/");
 	};
 	/** Null by design: under BFF custody the token never reaches the browser (FR-SES-3). */
@@ -511,6 +514,45 @@ function Protected({ children, fallback = null, loading = null }) {
 	return isSignedIn ? children : fallback;
 }
 //#endregion
+//#region src/geolocation.ts
+/**
+* Capture the browser's precise location IF the user consented. Resolves to a consent-labelled
+* result and never throws/rejects.
+*/
+async function capturePreciseLocation(consented, opts = {}) {
+	if (!consented) return { consent: "denied" };
+	const geo = opts.geolocation ?? (typeof navigator !== "undefined" ? navigator.geolocation : void 0);
+	if (!geo) return { consent: "denied" };
+	const timeoutMs = opts.timeoutMs ?? 8e3;
+	return new Promise((resolve) => {
+		let settled = false;
+		const done = (result) => {
+			if (settled) return;
+			settled = true;
+			resolve(result);
+		};
+		const timer = setTimeout(() => done({ consent: "denied" }), timeoutMs + 500);
+		const finish = (result) => {
+			clearTimeout(timer);
+			done(result);
+		};
+		try {
+			geo.getCurrentPosition((position) => finish({
+				latitude: String(position.coords.latitude),
+				longitude: String(position.coords.longitude),
+				accuracyMeters: typeof position.coords.accuracy === "number" ? position.coords.accuracy : void 0,
+				consent: "granted"
+			}), () => finish({ consent: "denied" }), {
+				enableHighAccuracy: true,
+				timeout: timeoutMs,
+				maximumAge: 0
+			});
+		} catch {
+			finish({ consent: "denied" });
+		}
+	});
+}
+//#endregion
 //#region src/components/sign-in.tsx
 const DEFAULT_LABELS$3 = {
 	heading: "Sign in",
@@ -525,6 +567,7 @@ const DEFAULT_LABELS$3 = {
 	submit: "Sign in",
 	submitting: "Signing in…",
 	forgotPassword: "Forgot password?",
+	shareLocation: "Share my location for added account security",
 	chooseWorkspace: "Choose a workspace",
 	chooseWorkspaceSubheading: "You have access to more than one workspace.",
 	securedBy: "Secured by PolyX",
@@ -638,6 +681,7 @@ function SignIn(props) {
 	const [tenants, setTenants] = (0, react.useState)(null);
 	const [submitting, setSubmitting] = (0, react.useState)(false);
 	const [error, setError] = (0, react.useState)(null);
+	const [shareLocation, setShareLocation] = (0, react.useState)(false);
 	const polyx = (0, react.useContext)(PolyXContext);
 	const [branding, setBranding] = (0, react.useState)({});
 	(0, react.useEffect)(() => {
@@ -670,6 +714,7 @@ function SignIn(props) {
 		setSubmitting(true);
 		setError(null);
 		try {
+			const geo = props.captureLocation ? await capturePreciseLocation(shareLocation) : void 0;
 			const body = await (await fetch(action, {
 				method: "POST",
 				headers: { "content-type": "application/json" },
@@ -678,6 +723,7 @@ function SignIn(props) {
 					password,
 					organizationCode: props.organizationCode,
 					tenantId: options.tenantId,
+					...geo ? { geo } : {},
 					...options.passwords
 				})
 			})).json().catch(() => ({}));
@@ -881,6 +927,19 @@ function SignIn(props) {
 							children: labels.forgotPassword
 						})
 					}) : null,
+					props.captureLocation ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+						className: "polyx-signin__consent",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							type: "checkbox",
+							className: "polyx-signin__checkbox",
+							checked: shareLocation,
+							disabled: submitting,
+							onChange: (event) => setShareLocation(event.target.checked)
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "polyx-signin__consent-label",
+							children: labels.shareLocation
+						})]
+					}) : null,
 					errorNode,
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 						type: "submit",
@@ -1024,7 +1083,7 @@ const DEFAULT_LABELS$2 = {
 	submit: "Send reset link",
 	submitting: "Sending…",
 	sentHeading: "Check your email",
-	sentSubheading: "If an account exists for {email}, a password reset link is on its way. It expires in 30 minutes.",
+	sentSubheading: "If an account exists for {email}, a password reset link is on its way — it expires in 30 minutes. If it doesn't arrive within a few minutes, check your spam folder, then contact your workspace administrator.",
 	differentEmail: "Use a different email",
 	backToSignIn: "Back to sign in",
 	securedBy: "Secured by PolyX",
@@ -1684,7 +1743,10 @@ function UserButtonRoot(props) {
 		key: "signOut",
 		label: labels.signOut,
 		labelIcon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ExitIcon, {}),
-		onClick: () => void signOut({ redirectTo: props.afterSignOutUrl })
+		onClick: () => void signOut({
+			redirectTo: props.afterSignOutUrl,
+			onSignOut: props.onSignOut
+		})
 	});
 	if (props.showSignOutEverywhere) builtIns.set("signOutEverywhere", {
 		key: "signOutEverywhere",
@@ -1692,7 +1754,8 @@ function UserButtonRoot(props) {
 		labelIcon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ExitIcon, {}),
 		onClick: () => void signOut({
 			scope: "everywhere",
-			redirectTo: props.afterSignOutUrl
+			redirectTo: props.afterSignOutUrl,
+			onSignOut: props.onSignOut
 		})
 	});
 	const items = resolveItems(props.children, builtIns);
@@ -1878,6 +1941,7 @@ exports.UserAvatar = UserAvatar;
 exports.UserButton = UserButton;
 exports.WebLocksLock = WebLocksLock;
 exports.WindowBrowserBridge = WindowBrowserBridge;
+exports.capturePreciseLocation = capturePreciseLocation;
 exports.createLoginController = createLoginController;
 exports.initialsFrom = initialsFrom;
 exports.resolveSide = resolveSide;

package/dist/index.d.cts

@@ -24,6 +24,13 @@ interface BffSignOutOptions {
   scope?: "device" | "everywhere";
   /** Where to land afterwards. Resolved here, client-side — the server takes no redirect target. */
   redirectTo?: string;
+  /**
+   * Run consumer cleanup after the session is revoked but BEFORE the post-sign-out
+   * redirect (the page is still alive at this point) — e.g. clear app cookies, reset
+   * local state, flush a store. Awaited; a thrown/rejected hook is swallowed so a
+   * failing callback can never trap the user in a signed-out-but-not-redirected state.
+   */
+  onSignOut?: () => void | Promise<void>;
 }
 //#endregion
 //#region src/auth-channel.d.ts
@@ -218,6 +225,8 @@ interface SignInLabels {
   submit: string;
   submitting: string;
   forgotPassword: string;
+  /** Consent checkbox label shown when `captureLocation` is enabled (v6). */
+  shareLocation: string;
   chooseWorkspace: string;
   chooseWorkspaceSubheading: string;
   securedBy: string;
@@ -255,6 +264,12 @@ interface SignInProps {
    * "Forgot password?" link appears under the password field. Omit to hide it.
    */
   forgotPasswordUrl?: string;
+  /**
+   * v6 (FR-CNST): show an explicit, opt-in consent checkbox to share precise location for
+   * security/presence. On submit, if checked, the browser captures a position and it rides to
+   * the platform with the login. Denial/timeout never blocks sign-in (coarse fallback). Off by default.
+   */
+  captureLocation?: boolean;
   /** Where to send the browser after success. Overrides the server's default redirect. */
   afterSignInPath?: string;
   /** Pre-scope the login to a single organization (skips org discovery). */
@@ -292,7 +307,13 @@ interface ForgotPasswordLabels {
   submitting: string;
   /** Shown after submit — always, regardless of whether the account exists. */
   sentHeading: string;
-  /** Confirmation body. `{email}` is replaced with the entered address, emphasized. */
+  /**
+   * Confirmation body. `{email}` is replaced with the entered address, emphasized.
+   * Kept deliberately uniform (no account-existence / mail-config signal, per the
+   * anti-enumeration reset design) and points the user at their administrator for
+   * the cases where no mail can arrive (org has reset email disabled, no provider
+   * configured, or a send failure) — none of which the response is allowed to reveal.
+   */
   sentSubheading: string;
   differentEmail: string;
   backToSignIn: string;
@@ -386,6 +407,49 @@ declare function AuthCallback({
   children
 }: AuthCallbackProps): ReactNode;
 //#endregion
+//#region src/geolocation.d.ts
+/**
+ * @poly-x/react/geolocation — browser precise-location capture for sign-in (v6, FR-CNST/FR-LOC).
+ *
+ * The consent-gated bridge to `navigator.geolocation`. It NEVER rejects: a decline, a browser
+ * permission denial, a missing API, or a timeout all resolve to `{ consent: "denied" }` with no
+ * coordinates, so the caller can always proceed — sign-in must never block on location (D52).
+ * The captured value is posted to the BFF, which forwards it to the platform on the token
+ * exchange; the platform stores precise only when consent is `granted`, else coarse (IP).
+ */
+/** Minimal shape of the browser Geolocation API we depend on (injectable for testing). */
+interface GeolocationLike {
+  getCurrentPosition(success: (position: {
+    coords: {
+      latitude: number;
+      longitude: number;
+      accuracy?: number;
+    };
+  }) => void, error?: (err: unknown) => void, options?: {
+    enableHighAccuracy?: boolean;
+    timeout?: number;
+    maximumAge?: number;
+  }): void;
+}
+/** The consent-labelled result of a capture attempt. Coordinates present only when granted. */
+interface CapturedGeo {
+  latitude?: string;
+  longitude?: string;
+  accuracyMeters?: number;
+  consent: "granted" | "denied";
+}
+interface CaptureOptions {
+  /** Max time to wait for a fix before giving up (coarse fallback). Default 8000ms. */
+  timeoutMs?: number;
+  /** Override the geolocation source (tests). Defaults to `navigator.geolocation`. */
+  geolocation?: GeolocationLike;
+}
+/**
+ * Capture the browser's precise location IF the user consented. Resolves to a consent-labelled
+ * result and never throws/rejects.
+ */
+declare function capturePreciseLocation(consented: boolean, opts?: CaptureOptions): Promise<CapturedGeo>;
+//#endregion
 //#region src/components/placement.d.ts
 /**
  * Collision-aware placement for the SDK's popovers.
@@ -457,6 +521,12 @@ interface UserButtonProps {
   showName?: boolean;
   /** Where to land after signing out. Default the app root. */
   afterSignOutUrl?: string;
+  /**
+   * Consumer cleanup run after the session is revoked but before the redirect —
+   * clear app cookies, reset local stores, etc. Awaited; errors are swallowed so a
+   * failing hook can't trap the user. Applies to both "Sign out" and "Sign out everywhere".
+   */
+  onSignOut?: () => void | Promise<void>;
   /**
    * Destination for the "Manage account" entry. Omitted entirely when unset — PolyX has no
    * hosted profile page, so the destination is the consumer's to own.
@@ -559,4 +629,4 @@ declare function UserAvatar({
 declare const PACKAGE_NAME = "@poly-x/react";
 declare const version = "0.0.0";
 //#endregion
-export { type Align, AuthCallback, type AuthCallbackMessage, type AuthCallbackProps, type AuthChannel, BroadcastAuthChannel, BroadcastChannelSessionChannel, type BrowserBridge, type CallbackParams, ForgotPassword, type ForgotPasswordLabels, type ForgotPasswordProps, type LoginController, type LoginControllerDeps, PACKAGE_NAME, PolyXContext, type PolyXContextValue, PolyXProvider, type PolyXProviderProps, PopupCancelledError, type PopupHandle, Protected, type ProtectedProps, ResetPassword, type ResetPasswordLabels, type ResetPasswordProps, SessionStoragePkceStore, type Side, type SideOption, SignIn, type SignInLabels, type SignInOptions, type SignInProps, type SignInVariant, type UseAuth, UserAvatar, type UserAvatarProps, UserButton, type UserButtonActionProps, type UserButtonLabels, type UserButtonLinkProps, type UserButtonProps, type UserButtonSlotProps, WebLocksLock, WindowBrowserBridge, createLoginController, initialsFrom, resolveSide, useAuth, useAuthCallback, useSession, useUser, version };
+export { type Align, AuthCallback, type AuthCallbackMessage, type AuthCallbackProps, type AuthChannel, BroadcastAuthChannel, BroadcastChannelSessionChannel, type BrowserBridge, type CallbackParams, type CaptureOptions, type CapturedGeo, ForgotPassword, type ForgotPasswordLabels, type ForgotPasswordProps, type GeolocationLike, type LoginController, type LoginControllerDeps, PACKAGE_NAME, PolyXContext, type PolyXContextValue, PolyXProvider, type PolyXProviderProps, PopupCancelledError, type PopupHandle, Protected, type ProtectedProps, ResetPassword, type ResetPasswordLabels, type ResetPasswordProps, SessionStoragePkceStore, type Side, type SideOption, SignIn, type SignInLabels, type SignInOptions, type SignInProps, type SignInVariant, type UseAuth, UserAvatar, type UserAvatarProps, UserButton, type UserButtonActionProps, type UserButtonLabels, type UserButtonLinkProps, type UserButtonProps, type UserButtonSlotProps, WebLocksLock, WindowBrowserBridge, capturePreciseLocation, createLoginController, initialsFrom, resolveSide, useAuth, useAuthCallback, useSession, useUser, version };

package/dist/index.d.mts

@@ -24,6 +24,13 @@ interface BffSignOutOptions {
   scope?: "device" | "everywhere";
   /** Where to land afterwards. Resolved here, client-side — the server takes no redirect target. */
   redirectTo?: string;
+  /**
+   * Run consumer cleanup after the session is revoked but BEFORE the post-sign-out
+   * redirect (the page is still alive at this point) — e.g. clear app cookies, reset
+   * local state, flush a store. Awaited; a thrown/rejected hook is swallowed so a
+   * failing callback can never trap the user in a signed-out-but-not-redirected state.
+   */
+  onSignOut?: () => void | Promise<void>;
 }
 //#endregion
 //#region src/auth-channel.d.ts
@@ -218,6 +225,8 @@ interface SignInLabels {
   submit: string;
   submitting: string;
   forgotPassword: string;
+  /** Consent checkbox label shown when `captureLocation` is enabled (v6). */
+  shareLocation: string;
   chooseWorkspace: string;
   chooseWorkspaceSubheading: string;
   securedBy: string;
@@ -255,6 +264,12 @@ interface SignInProps {
    * "Forgot password?" link appears under the password field. Omit to hide it.
    */
   forgotPasswordUrl?: string;
+  /**
+   * v6 (FR-CNST): show an explicit, opt-in consent checkbox to share precise location for
+   * security/presence. On submit, if checked, the browser captures a position and it rides to
+   * the platform with the login. Denial/timeout never blocks sign-in (coarse fallback). Off by default.
+   */
+  captureLocation?: boolean;
   /** Where to send the browser after success. Overrides the server's default redirect. */
   afterSignInPath?: string;
   /** Pre-scope the login to a single organization (skips org discovery). */
@@ -292,7 +307,13 @@ interface ForgotPasswordLabels {
   submitting: string;
   /** Shown after submit — always, regardless of whether the account exists. */
   sentHeading: string;
-  /** Confirmation body. `{email}` is replaced with the entered address, emphasized. */
+  /**
+   * Confirmation body. `{email}` is replaced with the entered address, emphasized.
+   * Kept deliberately uniform (no account-existence / mail-config signal, per the
+   * anti-enumeration reset design) and points the user at their administrator for
+   * the cases where no mail can arrive (org has reset email disabled, no provider
+   * configured, or a send failure) — none of which the response is allowed to reveal.
+   */
   sentSubheading: string;
   differentEmail: string;
   backToSignIn: string;
@@ -386,6 +407,49 @@ declare function AuthCallback({
   children
 }: AuthCallbackProps): ReactNode;
 //#endregion
+//#region src/geolocation.d.ts
+/**
+ * @poly-x/react/geolocation — browser precise-location capture for sign-in (v6, FR-CNST/FR-LOC).
+ *
+ * The consent-gated bridge to `navigator.geolocation`. It NEVER rejects: a decline, a browser
+ * permission denial, a missing API, or a timeout all resolve to `{ consent: "denied" }` with no
+ * coordinates, so the caller can always proceed — sign-in must never block on location (D52).
+ * The captured value is posted to the BFF, which forwards it to the platform on the token
+ * exchange; the platform stores precise only when consent is `granted`, else coarse (IP).
+ */
+/** Minimal shape of the browser Geolocation API we depend on (injectable for testing). */
+interface GeolocationLike {
+  getCurrentPosition(success: (position: {
+    coords: {
+      latitude: number;
+      longitude: number;
+      accuracy?: number;
+    };
+  }) => void, error?: (err: unknown) => void, options?: {
+    enableHighAccuracy?: boolean;
+    timeout?: number;
+    maximumAge?: number;
+  }): void;
+}
+/** The consent-labelled result of a capture attempt. Coordinates present only when granted. */
+interface CapturedGeo {
+  latitude?: string;
+  longitude?: string;
+  accuracyMeters?: number;
+  consent: "granted" | "denied";
+}
+interface CaptureOptions {
+  /** Max time to wait for a fix before giving up (coarse fallback). Default 8000ms. */
+  timeoutMs?: number;
+  /** Override the geolocation source (tests). Defaults to `navigator.geolocation`. */
+  geolocation?: GeolocationLike;
+}
+/**
+ * Capture the browser's precise location IF the user consented. Resolves to a consent-labelled
+ * result and never throws/rejects.
+ */
+declare function capturePreciseLocation(consented: boolean, opts?: CaptureOptions): Promise<CapturedGeo>;
+//#endregion
 //#region src/components/placement.d.ts
 /**
  * Collision-aware placement for the SDK's popovers.
@@ -457,6 +521,12 @@ interface UserButtonProps {
   showName?: boolean;
   /** Where to land after signing out. Default the app root. */
   afterSignOutUrl?: string;
+  /**
+   * Consumer cleanup run after the session is revoked but before the redirect —
+   * clear app cookies, reset local stores, etc. Awaited; errors are swallowed so a
+   * failing hook can't trap the user. Applies to both "Sign out" and "Sign out everywhere".
+   */
+  onSignOut?: () => void | Promise<void>;
   /**
    * Destination for the "Manage account" entry. Omitted entirely when unset — PolyX has no
    * hosted profile page, so the destination is the consumer's to own.
@@ -559,4 +629,4 @@ declare function UserAvatar({
 declare const PACKAGE_NAME = "@poly-x/react";
 declare const version = "0.0.0";
 //#endregion
-export { type Align, AuthCallback, type AuthCallbackMessage, type AuthCallbackProps, type AuthChannel, BroadcastAuthChannel, BroadcastChannelSessionChannel, type BrowserBridge, type CallbackParams, ForgotPassword, type ForgotPasswordLabels, type ForgotPasswordProps, type LoginController, type LoginControllerDeps, PACKAGE_NAME, PolyXContext, type PolyXContextValue, PolyXProvider, type PolyXProviderProps, PopupCancelledError, type PopupHandle, Protected, type ProtectedProps, ResetPassword, type ResetPasswordLabels, type ResetPasswordProps, SessionStoragePkceStore, type Side, type SideOption, SignIn, type SignInLabels, type SignInOptions, type SignInProps, type SignInVariant, type UseAuth, UserAvatar, type UserAvatarProps, UserButton, type UserButtonActionProps, type UserButtonLabels, type UserButtonLinkProps, type UserButtonProps, type UserButtonSlotProps, WebLocksLock, WindowBrowserBridge, createLoginController, initialsFrom, resolveSide, useAuth, useAuthCallback, useSession, useUser, version };
+export { type Align, AuthCallback, type AuthCallbackMessage, type AuthCallbackProps, type AuthChannel, BroadcastAuthChannel, BroadcastChannelSessionChannel, type BrowserBridge, type CallbackParams, type CaptureOptions, type CapturedGeo, ForgotPassword, type ForgotPasswordLabels, type ForgotPasswordProps, type GeolocationLike, type LoginController, type LoginControllerDeps, PACKAGE_NAME, PolyXContext, type PolyXContextValue, PolyXProvider, type PolyXProviderProps, PopupCancelledError, type PopupHandle, Protected, type ProtectedProps, ResetPassword, type ResetPasswordLabels, type ResetPasswordProps, SessionStoragePkceStore, type Side, type SideOption, SignIn, type SignInLabels, type SignInOptions, type SignInProps, type SignInVariant, type UseAuth, UserAvatar, type UserAvatarProps, UserButton, type UserButtonActionProps, type UserButtonLabels, type UserButtonLinkProps, type UserButtonProps, type UserButtonSlotProps, WebLocksLock, WindowBrowserBridge, capturePreciseLocation, createLoginController, initialsFrom, resolveSide, useAuth, useAuthCallback, useSession, useUser, version };

package/dist/index.mjs

@@ -432,6 +432,9 @@ var BffSessionStore = class {
 			status: "signed-out",
 			reason: "signed-out"
 		});
+		if (options?.onSignOut) try {
+			await options.onSignOut();
+		} catch {}
 		window.location.assign(options?.redirectTo ?? "/");
 	};
 	/** Null by design: under BFF custody the token never reaches the browser (FR-SES-3). */
@@ -510,6 +513,45 @@ function Protected({ children, fallback = null, loading = null }) {
 	return isSignedIn ? children : fallback;
 }
 //#endregion
+//#region src/geolocation.ts
+/**
+* Capture the browser's precise location IF the user consented. Resolves to a consent-labelled
+* result and never throws/rejects.
+*/
+async function capturePreciseLocation(consented, opts = {}) {
+	if (!consented) return { consent: "denied" };
+	const geo = opts.geolocation ?? (typeof navigator !== "undefined" ? navigator.geolocation : void 0);
+	if (!geo) return { consent: "denied" };
+	const timeoutMs = opts.timeoutMs ?? 8e3;
+	return new Promise((resolve) => {
+		let settled = false;
+		const done = (result) => {
+			if (settled) return;
+			settled = true;
+			resolve(result);
+		};
+		const timer = setTimeout(() => done({ consent: "denied" }), timeoutMs + 500);
+		const finish = (result) => {
+			clearTimeout(timer);
+			done(result);
+		};
+		try {
+			geo.getCurrentPosition((position) => finish({
+				latitude: String(position.coords.latitude),
+				longitude: String(position.coords.longitude),
+				accuracyMeters: typeof position.coords.accuracy === "number" ? position.coords.accuracy : void 0,
+				consent: "granted"
+			}), () => finish({ consent: "denied" }), {
+				enableHighAccuracy: true,
+				timeout: timeoutMs,
+				maximumAge: 0
+			});
+		} catch {
+			finish({ consent: "denied" });
+		}
+	});
+}
+//#endregion
 //#region src/components/sign-in.tsx
 const DEFAULT_LABELS$3 = {
 	heading: "Sign in",
@@ -524,6 +566,7 @@ const DEFAULT_LABELS$3 = {
 	submit: "Sign in",
 	submitting: "Signing in…",
 	forgotPassword: "Forgot password?",
+	shareLocation: "Share my location for added account security",
 	chooseWorkspace: "Choose a workspace",
 	chooseWorkspaceSubheading: "You have access to more than one workspace.",
 	securedBy: "Secured by PolyX",
@@ -637,6 +680,7 @@ function SignIn(props) {
 	const [tenants, setTenants] = useState(null);
 	const [submitting, setSubmitting] = useState(false);
 	const [error, setError] = useState(null);
+	const [shareLocation, setShareLocation] = useState(false);
 	const polyx = useContext(PolyXContext);
 	const [branding, setBranding] = useState({});
 	useEffect(() => {
@@ -669,6 +713,7 @@ function SignIn(props) {
 		setSubmitting(true);
 		setError(null);
 		try {
+			const geo = props.captureLocation ? await capturePreciseLocation(shareLocation) : void 0;
 			const body = await (await fetch(action, {
 				method: "POST",
 				headers: { "content-type": "application/json" },
@@ -677,6 +722,7 @@ function SignIn(props) {
 					password,
 					organizationCode: props.organizationCode,
 					tenantId: options.tenantId,
+					...geo ? { geo } : {},
 					...options.passwords
 				})
 			})).json().catch(() => ({}));
@@ -880,6 +926,19 @@ function SignIn(props) {
 							children: labels.forgotPassword
 						})
 					}) : null,
+					props.captureLocation ? /* @__PURE__ */ jsxs("label", {
+						className: "polyx-signin__consent",
+						children: [/* @__PURE__ */ jsx("input", {
+							type: "checkbox",
+							className: "polyx-signin__checkbox",
+							checked: shareLocation,
+							disabled: submitting,
+							onChange: (event) => setShareLocation(event.target.checked)
+						}), /* @__PURE__ */ jsx("span", {
+							className: "polyx-signin__consent-label",
+							children: labels.shareLocation
+						})]
+					}) : null,
 					errorNode,
 					/* @__PURE__ */ jsx("button", {
 						type: "submit",
@@ -1023,7 +1082,7 @@ const DEFAULT_LABELS$2 = {
 	submit: "Send reset link",
 	submitting: "Sending…",
 	sentHeading: "Check your email",
-	sentSubheading: "If an account exists for {email}, a password reset link is on its way. It expires in 30 minutes.",
+	sentSubheading: "If an account exists for {email}, a password reset link is on its way — it expires in 30 minutes. If it doesn't arrive within a few minutes, check your spam folder, then contact your workspace administrator.",
 	differentEmail: "Use a different email",
 	backToSignIn: "Back to sign in",
 	securedBy: "Secured by PolyX",
@@ -1683,7 +1742,10 @@ function UserButtonRoot(props) {
 		key: "signOut",
 		label: labels.signOut,
 		labelIcon: /* @__PURE__ */ jsx(ExitIcon, {}),
-		onClick: () => void signOut({ redirectTo: props.afterSignOutUrl })
+		onClick: () => void signOut({
+			redirectTo: props.afterSignOutUrl,
+			onSignOut: props.onSignOut
+		})
 	});
 	if (props.showSignOutEverywhere) builtIns.set("signOutEverywhere", {
 		key: "signOutEverywhere",
@@ -1691,7 +1753,8 @@ function UserButtonRoot(props) {
 		labelIcon: /* @__PURE__ */ jsx(ExitIcon, {}),
 		onClick: () => void signOut({
 			scope: "everywhere",
-			redirectTo: props.afterSignOutUrl
+			redirectTo: props.afterSignOutUrl,
+			onSignOut: props.onSignOut
 		})
 	});
 	const items = resolveItems(props.children, builtIns);
@@ -1861,4 +1924,4 @@ const UserButton = Object.assign(UserButtonRoot, {
 const PACKAGE_NAME = "@poly-x/react";
 const version = "0.0.0";
 //#endregion
-export { AuthCallback, BroadcastAuthChannel, BroadcastChannelSessionChannel, ForgotPassword, PACKAGE_NAME, PolyXContext, PolyXProvider, PopupCancelledError, Protected, ResetPassword, SessionStoragePkceStore, SignIn, UserAvatar, UserButton, WebLocksLock, WindowBrowserBridge, createLoginController, initialsFrom, resolveSide, useAuth, useAuthCallback, useSession, useUser, version };
+export { AuthCallback, BroadcastAuthChannel, BroadcastChannelSessionChannel, ForgotPassword, PACKAGE_NAME, PolyXContext, PolyXProvider, PopupCancelledError, Protected, ResetPassword, SessionStoragePkceStore, SignIn, UserAvatar, UserButton, WebLocksLock, WindowBrowserBridge, capturePreciseLocation, createLoginController, initialsFrom, resolveSide, useAuth, useAuthCallback, useSession, useUser, version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/react",
-  "version": "0.1.0-alpha.13",
+  "version": "0.1.0-alpha.15",
   "description": "PolyX SDK for React SPAs - provider, hooks, drop-in auth UI",
   "license": "MIT",
   "type": "module",
@@ -27,7 +27,7 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.0-alpha.13"
+    "@poly-x/core": "0.1.0-alpha.15"
   },
   "peerDependencies": {
     "react": ">=18",