@pylonsync/client 0.3.292 → 0.3.293

package/dist/components/AcceptInvite.d.ts

@@ -0,0 +1,32 @@
+import React from "react";
+import { type ReactNode } from "react";
+export interface AcceptInviteProps {
+    /**
+     * The invite token. Pulled from the email link's `?token=` param
+     * by the consuming page. Falls back to `window.location.search`
+     * when omitted.
+     */
+    token?: string;
+    /** Where to send the user after a successful accept. */
+    afterAcceptUrl?: string;
+    /** Where to send a signed-out user so they can sign in / sign up first. */
+    signInUrl?: string;
+    /** Optional callback once accept lands. Receives `{org_id, role}`. */
+    onAccepted?: (result: {
+        org_id: string;
+        role: string;
+    }) => void;
+    /** Override the headline copy. */
+    title?: ReactNode;
+    className?: string;
+}
+/**
+ * Drop-in landing surface for `/accept-invite?token=…`. Reads the token
+ * from props or the URL, calls `POST /api/auth/invites/:token/accept`,
+ * and lights up org membership when the request succeeds.
+ *
+ * Signed-out users see a "sign in to accept" prompt that bounces through
+ * `signInUrl` with the current href as `?next=` so they end up back on
+ * this page with the token preserved.
+ */
+export declare function AcceptInvite({ token: tokenProp, afterAcceptUrl, signInUrl, onAccepted, title, className, }: AcceptInviteProps): React.JSX.Element;

package/dist/components/ChatBot.d.ts

@@ -0,0 +1,44 @@
+import React from "react";
+import { type ReactNode } from "react";
+export interface ChatMessage {
+    role: "user" | "assistant" | "system";
+    content: string;
+}
+export interface ChatBotProps {
+    /**
+     * Name of the server-side function that drives the model. It runs
+     * `ctx.llm.*` and emits its response as SSE chunks via
+     * `db.streamFn`. The handler receives `{ messages, ...extra }`.
+     */
+    fn: string;
+    /** Extra args merged into every call (e.g., `{model: "haiku"}`). */
+    extraArgs?: Record<string, unknown>;
+    /** System prompt prepended to every turn. */
+    systemPrompt?: string;
+    /** Initial messages to display (e.g., a welcome from the assistant). */
+    initialMessages?: ChatMessage[];
+    /** Placeholder shown in the input. */
+    placeholder?: string;
+    /** Header copy. */
+    title?: ReactNode;
+    className?: string;
+}
+/**
+ * Drop-in chat UI for a server-side LLM handler. Wires the assistant
+ * turn to `db.streamFn(fn, { messages })`; each yielded chunk is parsed
+ * as a JSON event of the shape `{type: "text", delta: string}` (the
+ * default emitted by the framework's streaming helpers). Plain string
+ * chunks are also accepted so this works with apps that just yield
+ * `event.delta` directly.
+ *
+ * Server-side authoring (5 lines):
+ * ```ts
+ * export default action({
+ *   args: { messages: v.array(v.object({ role: v.string(), content: v.string() })) },
+ *   async handler(ctx, { messages }) {
+ *     return ctx.llm.streamMessage({ model: "claude-haiku", messages });
+ *   },
+ * });
+ * ```
+ */
+export declare function ChatBot({ fn, extraArgs, systemPrompt, initialMessages, placeholder, title, className, }: ChatBotProps): React.JSX.Element;

package/dist/components/ConnectAccount.d.ts

@@ -0,0 +1,36 @@
+import React from "react";
+import { type ReactNode } from "react";
+export interface ConnectAccountProps {
+    /**
+     * Name of the connection in the manifest (matches the `name` you
+     * passed to `defineConnection({...})`). NOT the OAuth provider id.
+     */
+    name: string;
+    /**
+     * URL the OAuth provider sends the user back to after consent.
+     * Defaults to the current page so the user lands on the same screen
+     * with the new connection already in place.
+     */
+    postRedirect?: string;
+    /** Optional label override. Default: "Connect <name>". */
+    label?: ReactNode;
+    /**
+     * If true, render an "outline" style button instead of the solid
+     * primary. Useful when the connect-button sits next to a primary
+     * CTA.
+     */
+    variant?: "primary" | "outline";
+    className?: string;
+}
+/**
+ * Drop-in button that starts an OAuth flow for a connection defined via
+ * `defineConnection(...)` in the manifest. Hits
+ * `POST /api/connections/<name>/auth-url` and navigates the browser to
+ * the returned URL; the provider redirects back to
+ * `/api/connections/<name>/callback`, which stores the encrypted token
+ * row and bounces to `postRedirect` (default: current page).
+ *
+ * Renders nothing for signed-out users — connections need an
+ * authenticated identity to bind the access token to.
+ */
+export declare function ConnectAccount({ name, postRedirect, label, variant, className, }: ConnectAccountProps): React.JSX.Element | null;

package/dist/components/EnsureGuest.d.ts

@@ -0,0 +1,29 @@
+import React from "react";
+import { type ReactNode } from "react";
+export interface EnsureGuestProps {
+    /**
+     * Render while the guest session is being minted. Defaults to
+     * nothing — the bootstrap is usually fast enough that a flash is
+     * worse than empty space. Pass a spinner / skeleton if you care.
+     */
+    fallback?: ReactNode;
+    children: ReactNode;
+}
+/**
+ * Drop-in wrapper that ensures the browser has a Pylon session before
+ * rendering children. If a token is already cached, renders
+ * immediately; otherwise calls `POST /api/auth/guest` and renders
+ * once the session token lands.
+ *
+ * Use this for zero-auth demos where every visitor implicitly becomes
+ * their own user — recordings, todos, scratch surfaces. Apps with
+ * real users should pair `<SignedOut><SignIn /></SignedOut>` with
+ * `<SignedIn>` instead.
+ *
+ * ```tsx
+ * <EnsureGuest>
+ *   <TodoList />
+ * </EnsureGuest>
+ * ```
+ */
+export declare function EnsureGuest({ fallback, children }: EnsureGuestProps): React.JSX.Element;

package/dist/components/EntityForm.d.ts

@@ -0,0 +1,64 @@
+import React from "react";
+import { type ReactNode } from "react";
+import { type Row } from "@pylonsync/react";
+export interface EntityFormField {
+    /** Field key on the row. */
+    field: string;
+    /** Display label. Defaults to a humanized `field` name. */
+    label?: ReactNode;
+    /** Input type hint. Default: "text". */
+    type?: "text" | "email" | "url" | "password" | "number" | "textarea" | "checkbox" | "select";
+    /** For `type: "select"`. */
+    options?: Array<{
+        value: string;
+        label?: string;
+    }>;
+    /** Required flag. */
+    required?: boolean;
+    /** Placeholder. */
+    placeholder?: string;
+    /** Helper text shown under the input. */
+    help?: ReactNode;
+    /** Default value when creating. */
+    defaultValue?: unknown;
+}
+export interface EntityFormProps<T extends Row = Row> {
+    /** Entity to write into. */
+    entity: string;
+    /** Field descriptors. */
+    fields: EntityFormField[];
+    /**
+     * If set, the form edits this existing row. Omit to create a new
+     * row (the default mode).
+     */
+    row?: T;
+    /** Override the submit label. */
+    submitLabel?: ReactNode;
+    /** Optional cancel button — calls this handler when clicked. */
+    onCancel?: () => void;
+    /** Called after a successful create/update. */
+    onSubmitted?: (row: Row) => void;
+    /** Headline shown above the form. */
+    title?: ReactNode;
+    className?: string;
+}
+/**
+ * Drop-in create / edit form for any entity. Uses `db.useEntity` for
+ * optimistic CRUD — the local replica gets the change immediately and
+ * the server reconciles via the sync push. No `onSubmit` boilerplate.
+ *
+ * ```tsx
+ * <EntityForm
+ *   entity="Post"
+ *   fields={[
+ *     { field: "title", required: true },
+ *     { field: "body", type: "textarea" },
+ *     { field: "status", type: "select", options: [
+ *       { value: "draft" }, { value: "published" },
+ *     ]},
+ *   ]}
+ *   onSubmitted={(row) => router.push(`/posts/${row.id}`)}
+ * />
+ * ```
+ */
+export declare function EntityForm<T extends Row = Row>({ entity, fields, row, submitLabel, onCancel, onSubmitted, title, className, }: EntityFormProps<T>): React.JSX.Element;

package/dist/components/EntityList.d.ts

@@ -0,0 +1,50 @@
+import React from "react";
+import { type ReactNode } from "react";
+import { type Row } from "@pylonsync/react";
+export interface EntityListColumn<T extends Row = Row> {
+    /** Field key on the row. */
+    field: keyof T & string;
+    /** Column header. Defaults to a humanized `field` name. */
+    label?: ReactNode;
+    /** Custom cell renderer. Default: stringified value. */
+    render?: (value: unknown, row: T) => ReactNode;
+    /** Tailwind / utility classes applied to the `<td>`. */
+    className?: string;
+}
+export interface EntityListProps<T extends Row = Row> {
+    /** Entity name (matches your schema declaration). */
+    entity: string;
+    /** Columns. When omitted, infers from the first row's keys. */
+    columns?: Array<EntityListColumn<T> | string>;
+    /** Live filter clause passed straight to `db.useQuery`. */
+    where?: Record<string, unknown>;
+    /** Server-side ordering. */
+    orderBy?: Record<string, "asc" | "desc">;
+    /** Max rows. */
+    limit?: number;
+    /** Click handler — gets the row. */
+    onRowClick?: (row: T) => void;
+    /** Render when there are zero rows. */
+    emptyState?: ReactNode;
+    /** Optional caption shown above the table (e.g., "Posts"). */
+    title?: ReactNode;
+    /** Render arbitrary actions in the top-right (e.g., a "+ New" button). */
+    actions?: ReactNode;
+    className?: string;
+}
+/**
+ * Reactive table for any entity. Wraps `db.useQuery` so rows re-render
+ * live when the underlying data changes (insert / update / delete from
+ * any peer). Columns are explicit; inference is a fallback for "just
+ * give me something" demos.
+ *
+ * ```tsx
+ * <EntityList
+ *   entity="Post"
+ *   columns={["title", "author", { field: "createdAt", render: relative }]}
+ *   where={{ status: "published" }}
+ *   onRowClick={(post) => router.push(`/posts/${post.id}`)}
+ * />
+ * ```
+ */
+export declare function EntityList<T extends Row = Row>({ entity, columns, where, orderBy, limit, onRowClick, emptyState, title, actions, className, }: EntityListProps<T>): React.JSX.Element;

package/dist/components/FileUpload.d.ts

@@ -0,0 +1,37 @@
+import React from "react";
+import { type ReactNode } from "react";
+import { type UploadedFile } from "@pylonsync/react";
+export interface FileUploadProps {
+    /** Called once for each successfully uploaded file. */
+    onUploaded?: (file: UploadedFile, source: File) => void;
+    /** Called once with the full batch after all files finish (errors and all). */
+    onComplete?: (results: FileUploadResult[]) => void;
+    /** MIME / extension hint passed to `<input accept=...>`. */
+    accept?: string;
+    /** Allow multi-file selection / drop. Default: false. */
+    multiple?: boolean;
+    /** Max file size in bytes — files exceeding this are rejected client-side. */
+    maxSizeBytes?: number;
+    /** Override the headline. */
+    label?: ReactNode;
+    /** Override the helper text. */
+    helperText?: ReactNode;
+    className?: string;
+}
+export interface FileUploadResult {
+    file: File;
+    status: "ok" | "error";
+    uploaded?: UploadedFile;
+    error?: string;
+}
+/**
+ * Drop-in drag-and-drop file picker. Streams each file to
+ * `/api/files/upload` via the existing `uploadFile` helper, surfaces
+ * per-file progress + errors, and emits `onUploaded` as each file
+ * lands.
+ *
+ * Pure UI shell — no provider configuration of its own. Pylon's file
+ * router handles where bytes actually go (local disk for self-host,
+ * Stack0 / S3 for cloud).
+ */
+export declare function FileUpload({ onUploaded, onComplete, accept, multiple, maxSizeBytes, label, helperText, className, }: FileUploadProps): React.JSX.Element;

package/dist/components/Gates.d.ts

@@ -0,0 +1,73 @@
+import React from "react";
+import { type ReactNode } from "react";
+import { useAuth } from "../hooks/useAuth";
+/**
+ * Render children only when the user is signed in. Drop-in match for
+ * Clerk's `<SignedIn>`.
+ */
+export declare function SignedIn({ children }: {
+    children: ReactNode;
+}): React.JSX.Element | null;
+/**
+ * Render children only when the user is signed out.
+ */
+export declare function SignedOut({ children }: {
+    children: ReactNode;
+}): React.JSX.Element | null;
+export interface ProtectProps {
+    /** Show fallback (or null) when the predicate fails. */
+    children: ReactNode;
+    /** What to render when the user isn't authorized. Defaults to nothing. */
+    fallback?: ReactNode;
+    /** Require admin. Equivalent to passing `predicate={(a) => a.isAdmin}`. */
+    admin?: boolean;
+    /** Custom gate. Receives the full `useAuth()` shape. */
+    predicate?: (auth: ReturnType<typeof useAuth>) => boolean;
+}
+/**
+ * Gate children behind a predicate. Defaults to "must be signed in";
+ * pass `admin` or a custom `predicate` for finer control. Server-side
+ * authorization is still enforced by the policy layer — this is purely a
+ * UX convenience to avoid flashing forbidden content.
+ */
+export declare function Protect({ children, fallback, admin, predicate, }: ProtectProps): React.JSX.Element;
+export interface HasRoleProps {
+    /** Role string (e.g., "owner", "admin", "member"). Matches against the
+     *  `roles` array on the resolved session, which the framework populates
+     *  with the user's org role when an org is active. */
+    role: string | string[];
+    /** Match ANY (default) or ALL listed roles. */
+    mode?: "any" | "all";
+    children: ReactNode;
+    fallback?: ReactNode;
+}
+/**
+ * Render children only when the resolved session has one (or all) of the
+ * given roles. Server-side authorization is still the source of truth —
+ * this is purely a UX gate to hide buttons the API would refuse anyway.
+ */
+export declare function HasRole({ role, mode, children, fallback, }: HasRoleProps): React.JSX.Element;
+/** Render children only when the user has an active org selected. */
+export declare function InOrg({ children, fallback, }: {
+    children: ReactNode;
+    fallback?: ReactNode;
+}): React.JSX.Element;
+/** Render children only when no org is selected (personal mode). */
+export declare function NoOrg({ children, fallback, }: {
+    children: ReactNode;
+    fallback?: ReactNode;
+}): React.JSX.Element;
+export interface RedirectToSignInProps {
+    /** Sign-in route (default: "/sign-in"). */
+    signInUrl?: string;
+    /** Encode the current URL into a `next` param so the sign-in page can
+     *  bounce the user back. Default: true. */
+    preserveLocation?: boolean;
+}
+/**
+ * Imperative client-side redirect — drop inside `<SignedOut>` to send an
+ * anonymous visitor to the sign-in page. Uses `window.location.assign`
+ * (full nav) since we don't assume the consumer's router shape; apps
+ * that want a soft navigation should write their own using `useAuth`.
+ */
+export declare function RedirectToSignIn({ signInUrl, preserveLocation, }: RedirectToSignInProps): null;

package/dist/components/InviteMembers.d.ts

@@ -0,0 +1,26 @@
+import React from "react";
+import { type InviteResult } from "../lib/api";
+export interface InviteMembersProps {
+    /** Org to manage. Defaults to the user's active tenant. */
+    orgId?: string;
+    /** Roles offered in the role picker. Default: ["member", "admin"]. */
+    roles?: string[];
+    /** Hide the members roster (focus solely on the invite form + pending list). */
+    hideMembers?: boolean;
+    /** Hide the pending invites list. */
+    hidePending?: boolean;
+    /** Optional callback after a new invite is sent. */
+    onInvited?: (invite: InviteResult) => void;
+    className?: string;
+}
+/**
+ * Drop-in members + invites surface. Owner / admin only — non-managers
+ * see a forbidden notice. Composes three concerns:
+ *
+ *   - Invite form (POST /api/auth/orgs/:id/invites)
+ *   - Pending invites with revoke (GET + DELETE on the same path)
+ *   - Member roster with role change + remove (GET/PUT/DELETE on members)
+ *
+ * For a focused subset, set `hideMembers` or `hidePending`.
+ */
+export declare function InviteMembers({ orgId: orgIdOverride, roles, hideMembers, hidePending, onInvited, className, }: InviteMembersProps): React.JSX.Element | null;

package/dist/components/OrganizationSwitcher.d.ts

@@ -0,0 +1,39 @@
+import React from "react";
+import { type ReactNode } from "react";
+import { type OrgSummary } from "../lib/api";
+export interface OrganizationSwitcherProps {
+    /** Hide the "Personal account" entry (no active org). Default: visible. */
+    hidePersonal?: boolean;
+    /** Disable the "Create organization" menu entry. */
+    hideCreate?: boolean;
+    /** Called after a switch lands. Useful for analytics / route changes. */
+    onSwitched?: (orgId: string | null) => void;
+    /** Called after a new org is created (post-creation, pre-switch). */
+    onCreated?: (org: OrgSummary) => void | Promise<void>;
+    /**
+     * Active org name resolved on the server (e.g. `serverData.get("Org", …)`
+     * in an SSR layout). Seeds the trigger label so it renders the real name on
+     * the first paint — no "Personal" → real-name flash, and no pop-in waiting
+     * for `useAuth()`/`listOrgs()` to hydrate. The dropdown list still loads
+     * client-side, but it's hidden until opened.
+     */
+    initialActiveName?: string;
+    className?: string;
+}
+/**
+ * Drop-in org switcher. Lists the signed-in user's orgs from
+ * `/api/auth/orgs`, lets them switch via `selectOrg` from useSession,
+ * and inline-creates a new org via `/api/auth/orgs` POST.
+ *
+ * Renders nothing for signed-out users — wrap in <SignedIn> if you
+ * need that. Apps that don't use the framework's built-in Org / OrgMember
+ * entities will see an empty list (and just the create form, if enabled).
+ */
+export declare function OrganizationSwitcher({ hidePersonal, hideCreate, onSwitched, onCreated, initialActiveName, className, }: OrganizationSwitcherProps): React.JSX.Element | null;
+export interface CreateOrganizationProps {
+    onCreated?: (org: OrgSummary) => void | Promise<void>;
+    /** Title shown above the form. */
+    title?: ReactNode;
+    className?: string;
+}
+export declare function CreateOrganization({ onCreated, title, className, }: CreateOrganizationProps): React.JSX.Element;

package/dist/components/PasswordReset.d.ts

@@ -0,0 +1,25 @@
+import React from "react";
+import { type ReactNode } from "react";
+export interface ForgotPasswordProps {
+    /** Return route shown as "back to sign-in" link. */
+    signInUrl?: string;
+    /** Override headline. */
+    title?: ReactNode;
+    className?: string;
+}
+/**
+ * "Forgot password" entry point. POSTs `/api/auth/password/reset/request`
+ * and always shows a generic success screen — the server returns 200
+ * regardless of whether the email is registered (account-enumeration
+ * defense), so we mirror that here.
+ */
+export declare function ForgotPassword({ signInUrl, title, className, }: ForgotPasswordProps): React.JSX.Element;
+export interface ResetPasswordProps {
+    /** Token from the reset email. Falls back to `?token=` in URL. */
+    token?: string;
+    /** Where to send the user after a successful reset. Default: `/sign-in`. */
+    afterResetUrl?: string;
+    title?: ReactNode;
+    className?: string;
+}
+export declare function ResetPassword({ token: tokenProp, afterResetUrl, title, className, }: ResetPasswordProps): React.JSX.Element;

package/dist/components/SignIn.d.ts

@@ -0,0 +1,22 @@
+import React from "react";
+import { type ReactNode } from "react";
+export interface SignInProps {
+    /** Auth method to lead with. Default: "magic" (most secure default). */
+    method?: "magic" | "password";
+    /** Where the dashboard sends the user after sign-in. */
+    afterSignInUrl?: string;
+    /** Optional callback once a session is minted. */
+    onSignedIn?: () => void;
+    /** Forgot-password landing route shown when the password tab is active. */
+    forgotPasswordUrl?: string;
+    /** Text shown above the form. */
+    title?: ReactNode;
+    /** Subtitle / call-to-action. */
+    subtitle?: ReactNode;
+    /** Tailwind class merged onto the card. */
+    className?: string;
+}
+export declare function SignIn({ method, afterSignInUrl, onSignedIn, forgotPasswordUrl, title, subtitle, className, }: SignInProps): React.JSX.Element;
+export interface SignUpProps extends SignInProps {
+}
+export declare function SignUp({ afterSignInUrl, onSignedIn, title, subtitle, className, }: SignUpProps): React.JSX.Element;

package/dist/components/SignOutButton.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+import { type ReactNode } from "react";
+export interface SignOutButtonProps {
+    afterSignOutUrl?: string;
+    className?: string;
+    children?: ReactNode;
+}
+/**
+ * Headless-friendly sign-out button. Pass children to fully customize
+ * the rendered label/UI; default renders a plain "Sign out" button.
+ */
+export declare function SignOutButton({ afterSignOutUrl, className, children, }: SignOutButtonProps): React.JSX.Element;

package/dist/components/UserButton.d.ts

@@ -0,0 +1,21 @@
+import React from "react";
+import { type ReactNode } from "react";
+export interface UserButtonProps {
+    /** Where to send the user after sign-out. Default: current page reload. */
+    afterSignOutUrl?: string;
+    /** Show the user's name next to the avatar (Clerk's `showName`). */
+    showName?: boolean;
+    /** Extra menu items rendered above the built-in entries. */
+    menuItems?: Array<{
+        label: ReactNode;
+        onClick?: () => void;
+        href?: string;
+    }>;
+    className?: string;
+}
+/**
+ * Avatar dropdown with profile/sign-out, mirroring Clerk's `<UserButton />`.
+ * Renders nothing when the user isn't signed in — wrap the call site in
+ * `<SignedIn>` or check `useAuth()` if you want a sign-in CTA instead.
+ */
+export declare function UserButton({ afterSignOutUrl, showName, menuItems, className, }: UserButtonProps): React.JSX.Element | null;

package/dist/components/UserProfile.d.ts

@@ -0,0 +1,20 @@
+import React from "react";
+export interface UserProfileProps {
+    /** Hide sections you don't need. */
+    hidePassword?: boolean;
+    hideSessions?: boolean;
+    hideApiKeys?: boolean;
+    className?: string;
+}
+/**
+ * Drop-in account management surface — Clerk's `<UserProfile />` shape.
+ * Sections:
+ *   - Identity card (user_id, active org)
+ *   - Password change (skipped for OAuth-only accounts)
+ *   - Active sessions + "Sign out other devices"
+ *   - API keys (create / list / revoke)
+ *
+ * Each section can be hidden via props if the consuming app handles it
+ * elsewhere. Renders nothing for signed-out users.
+ */
+export declare function UserProfile({ hidePassword, hideSessions, hideApiKeys, className, }: UserProfileProps): React.JSX.Element | null;

package/dist/hooks/useAuth.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Drop-in hook that wraps `useSession(db.sync)` so components in
+ * `@pylonsync/client` don't have to thread a SyncEngine through props.
+ * Apps that init() the global engine (the common case) get a Clerk-style
+ * `const { isSignedIn, user } = useAuth()` surface.
+ */
+export declare function useAuth(): {
+    isSignedIn: boolean;
+    isLoaded: boolean;
+    userId: string | null;
+    tenantId: string | null;
+    isAdmin: boolean;
+    session: import("@pylonsync/sync").ResolvedSession;
+    signOut: () => Promise<void>;
+    selectOrg: (orgId: string) => Promise<void>;
+    clearOrg: () => Promise<void>;
+    refresh: () => Promise<void>;
+};
+export type UseAuthReturn = ReturnType<typeof useAuth>;

package/dist/index.d.ts

@@ -0,0 +1,38 @@
+export { SignIn, SignUp } from "./components/SignIn";
+export type { SignInProps, SignUpProps } from "./components/SignIn";
+export { SignedIn, SignedOut, Protect, HasRole, InOrg, NoOrg, RedirectToSignIn, } from "./components/Gates";
+export type { ProtectProps, HasRoleProps, RedirectToSignInProps, } from "./components/Gates";
+export { UserButton } from "./components/UserButton";
+export type { UserButtonProps } from "./components/UserButton";
+export { SignOutButton } from "./components/SignOutButton";
+export type { SignOutButtonProps } from "./components/SignOutButton";
+export { EnsureGuest } from "./components/EnsureGuest";
+export type { EnsureGuestProps } from "./components/EnsureGuest";
+export { OrganizationSwitcher, CreateOrganization, } from "./components/OrganizationSwitcher";
+export type { OrganizationSwitcherProps, CreateOrganizationProps, } from "./components/OrganizationSwitcher";
+export { InviteMembers } from "./components/InviteMembers";
+export type { InviteMembersProps } from "./components/InviteMembers";
+export { AcceptInvite } from "./components/AcceptInvite";
+export type { AcceptInviteProps } from "./components/AcceptInvite";
+export { ConnectAccount } from "./components/ConnectAccount";
+export type { ConnectAccountProps } from "./components/ConnectAccount";
+export { FileUpload } from "./components/FileUpload";
+export type { FileUploadProps, FileUploadResult, } from "./components/FileUpload";
+export { UserProfile } from "./components/UserProfile";
+export type { UserProfileProps } from "./components/UserProfile";
+export { ForgotPassword, ResetPassword } from "./components/PasswordReset";
+export type { ForgotPasswordProps, ResetPasswordProps, } from "./components/PasswordReset";
+export { ChatBot } from "./components/ChatBot";
+export type { ChatBotProps, ChatMessage } from "./components/ChatBot";
+export { EntityList } from "./components/EntityList";
+export type { EntityListProps, EntityListColumn, } from "./components/EntityList";
+export { EntityForm } from "./components/EntityForm";
+export type { EntityFormProps, EntityFormField, } from "./components/EntityForm";
+export { Router, Link, Outlet } from "./router/Router";
+export type { RouterProps, LinkProps } from "./router/Router";
+export type { RouteSpec, MatchedRoute } from "./router/match";
+export { useRouter, useParams, useSearchParams, usePathname, } from "./router/useRouter";
+export { useAuth } from "./hooks/useAuth";
+export type { UseAuthReturn } from "./hooks/useAuth";
+export { acceptInvite, ApiError, changePassword, completePasswordReset, ensureGuestSession, connectionAuthUrl, createApiKey, createInvite, createOrg, deleteOrg, renameOrg, listActiveSessions, listApiKeys, listAuthProviders, listInvites, listOrgMembers, listOrgs, passwordLogin, passwordRegister, persistSession, removeMember, requestPasswordReset, revokeAllSessions, revokeApiKey, revokeInvite, sendMagicLink, updateMemberRole, verifyMagicLink, } from "./lib/api";
+export type { ActiveSession, ApiKeyCreated, ApiKeySummary, AuthProvider, InviteResult, OrgMember, OrgSummary, PendingInvite, SessionResponse, } from "./lib/api";

package/dist/lib/api.d.ts

@@ -0,0 +1,164 @@
+export interface AuthProvider {
+    provider: string;
+    auth_url: string;
+}
+export interface SessionResponse {
+    token: string;
+    user_id: string;
+    expires_at?: number;
+}
+export interface OrgSummary {
+    id: string;
+    name: string;
+    role: "owner" | "admin" | "member" | string;
+    created_at: number;
+}
+declare class ApiError extends Error {
+    code: string;
+    status: number;
+    constructor(code: string, message: string, status: number);
+}
+/**
+ * Mint a guest session if the browser doesn't already have a Pylon
+ * token. Idempotent — calling repeatedly is a no-op once a session
+ * exists. Designed for zero-auth demos (`<EnsureGuest>` is the
+ * component wrapper); apps that need real users should use `<SignIn>`
+ * instead.
+ *
+ * Each browser gets its own anonymous `user_id`, so multi-tab demos
+ * still observe live sync across tabs sharing the same guest. To
+ * reset (e.g. "switch identity"), clear the token from storage and
+ * call this again.
+ */
+export declare function ensureGuestSession(): Promise<SessionResponse | null>;
+export declare function listAuthProviders(): Promise<AuthProvider[]>;
+export declare function sendMagicLink(email: string, captchaToken?: string): Promise<{
+    ok: true;
+}>;
+export declare function verifyMagicLink(email: string, code: string): Promise<SessionResponse>;
+export declare function passwordRegister(input: {
+    email: string;
+    password: string;
+    displayName?: string;
+    captchaToken?: string;
+}): Promise<SessionResponse>;
+export declare function passwordLogin(input: {
+    email: string;
+    password: string;
+}): Promise<SessionResponse>;
+/**
+ * Persist a freshly-minted session locally + tell the sync engine to
+ * re-fetch /api/auth/me so cached `useSession()` consumers re-render
+ * immediately. Components call this after successful sign-in/sign-up.
+ */
+export declare function persistSession(session: SessionResponse): void;
+export declare function listOrgs(): Promise<OrgSummary[]>;
+export declare function createOrg(name: string): Promise<OrgSummary>;
+/** Rename an org. Server gates this to owners + admins (`can_manage_members`). */
+export declare function renameOrg(orgId: string, name: string): Promise<{
+    id: string;
+    name: string;
+}>;
+/** Delete an org and its memberships + invites. Server gates this to owners
+ *  (`can_delete_org`). Irreversible. */
+export declare function deleteOrg(orgId: string): Promise<{
+    deleted: boolean;
+}>;
+export interface OrgMember {
+    user_id: string;
+    role: string;
+    joined_at: number;
+    /** Member's email, joined server-side from the User entity. `null` if the
+     *  User row is missing or has no email. */
+    email: string | null;
+    /** Member's display name (displayName / name / fullName), if set. */
+    name: string | null;
+}
+export declare function listOrgMembers(orgId: string): Promise<OrgMember[]>;
+export declare function updateMemberRole(orgId: string, userId: string, role: string): Promise<{
+    updated: boolean;
+}>;
+export declare function removeMember(orgId: string, userId: string): Promise<{
+    removed: boolean;
+}>;
+export interface PendingInvite {
+    id: string;
+    email: string;
+    role: string;
+    token_prefix: string;
+    invited_by: string;
+    created_at: number;
+    expires_at: number;
+}
+export interface InviteResult {
+    id: string;
+    email: string;
+    role: string;
+    expires_at: number;
+    accept_url: string;
+    /** Dev mode only — full token so the inviter can copy/paste when
+     *  the email transport isn't configured. */
+    token?: string;
+}
+export declare function listInvites(orgId: string): Promise<PendingInvite[]>;
+export declare function createInvite(orgId: string, email: string, role: string): Promise<InviteResult>;
+export declare function revokeInvite(orgId: string, inviteId: string): Promise<{
+    revoked: boolean;
+}>;
+export declare function acceptInvite(token: string): Promise<{
+    org_id: string;
+    role: string;
+}>;
+export interface ConnectionAuthUrl {
+    url: string;
+}
+export declare function connectionAuthUrl(name: string, postRedirect?: string): Promise<ConnectionAuthUrl>;
+export interface ActiveSession {
+    token_prefix: string;
+    user_id: string;
+    device?: string;
+    created_at: number;
+    expires_at: number;
+}
+export declare function listActiveSessions(): Promise<ActiveSession[]>;
+export declare function revokeAllSessions(): Promise<{
+    revoked_count: number;
+}>;
+export declare function changePassword(input: {
+    currentPassword: string;
+    newPassword: string;
+}): Promise<{
+    ok: true;
+}>;
+export declare function requestPasswordReset(email: string): Promise<{
+    sent: true;
+}>;
+export declare function completePasswordReset(input: {
+    token: string;
+    newPassword: string;
+}): Promise<{
+    ok: true;
+}>;
+export interface ApiKeySummary {
+    id: string;
+    prefix: string;
+    name: string;
+    scopes?: string | null;
+    expires_at?: number | null;
+    last_used_at?: number | null;
+    created_at: number;
+}
+export interface ApiKeyCreated extends ApiKeySummary {
+    /** Shown once on creation. Never returned again. */
+    key: string;
+}
+export declare function listApiKeys(): Promise<ApiKeySummary[]>;
+export declare function createApiKey(input: {
+    name: string;
+    scopes?: string;
+    expiresAt?: number;
+}): Promise<ApiKeyCreated>;
+export declare function revokeApiKey(id: string): Promise<{
+    revoked: boolean;
+}>;
+export { ApiError };

package/dist/lib/cn.d.ts

@@ -0,0 +1,2 @@
+import { type ClassValue } from "clsx";
+export declare function cn(...inputs: ClassValue[]): string;

package/dist/router/Router.d.ts

@@ -0,0 +1,50 @@
+import React from "react";
+import { type AnchorHTMLAttributes, type ReactNode } from "react";
+import { type RouteSpec } from "./match";
+export interface RouterProps {
+    routes: RouteSpec[];
+    /** Render when no route matches. Default: a minimal 404 line. */
+    notFound?: ReactNode;
+    /** Initial pathname for SSR / testing. Default: window.location.pathname. */
+    initialUrl?: string;
+}
+/**
+ * Top-level SPA router. Subscribes to `popstate` + intercepted clicks
+ * from `<Link />`, matches the URL against the `routes` tree, and
+ * renders the matched chain with nested `<Outlet />` support.
+ *
+ * Place once near the root of the app:
+ *
+ * ```tsx
+ * <Router routes={[
+ *   { path: "/", component: HomePage },
+ *   {
+ *     path: "/dashboard",
+ *     component: DashboardLayout,
+ *     requireAuth: true,
+ *     children: [
+ *       { path: "/", component: DashboardHome },
+ *       { path: "/settings", component: SettingsPage },
+ *     ],
+ *   },
+ * ]} />
+ * ```
+ */
+export declare function Router({ routes, notFound, initialUrl }: RouterProps): React.JSX.Element;
+/**
+ * Renders the next match in the chain — the page nested under the
+ * current layout. Without an `<Outlet />` a layout component's
+ * children never appear.
+ */
+export declare function Outlet(): React.JSX.Element | null;
+export interface LinkProps extends AnchorHTMLAttributes<HTMLAnchorElement> {
+    href: string;
+    /** Use replaceState instead of pushState (no history entry added). */
+    replace?: boolean;
+}
+/**
+ * SPA link. Renders a real `<a>` so middle-click / cmd-click / right-
+ * click → "open in new tab" all behave correctly. Plain left-click is
+ * intercepted and routed via the in-page Router.
+ */
+export declare function Link({ href, replace, onClick, target, rel, children, ...rest }: LinkProps): React.JSX.Element;

package/dist/router/context.d.ts

@@ -0,0 +1,19 @@
+import type { MatchedRoute } from "./match";
+export interface RouterContextValue {
+    pathname: string;
+    search: string;
+    hash: string;
+    query: Record<string, string>;
+    params: Record<string, string>;
+    /** The matched chain — root layout to leaf page. */
+    matches: MatchedRoute[];
+    push: (href: string) => void;
+    replace: (href: string) => void;
+    back: () => void;
+}
+export declare const RouterContext: import("react").Context<RouterContextValue | null>;
+/**
+ * Used internally so a layout's `<Outlet />` knows which depth in the
+ * match chain to render next. Apps don't touch this directly.
+ */
+export declare const RouterDepthContext: import("react").Context<number>;

package/dist/router/match.d.ts

@@ -0,0 +1,35 @@
+import type { ReactNode } from "react";
+export interface RouteSpec {
+    /** Path pattern. `/users/:id`, `/posts/:slug?`, `/*` for catch-all. */
+    path: string;
+    /** Component rendered when matched. */
+    component?: () => ReactNode;
+    /** Explicit JSX alternative when you don't want a factory. */
+    element?: ReactNode;
+    /**
+     * Require an authenticated session. `true` = signed in. `"admin"` =
+     * signed in AND isAdmin. Custom predicates: render your own gate
+     * inside the component instead.
+     */
+    requireAuth?: boolean | "admin";
+    /** Where to send unauthenticated visitors. Default: `/sign-in`. */
+    signInUrl?: string;
+    /** Nested routes — parent renders `<Outlet />` where these appear. */
+    children?: RouteSpec[];
+}
+export interface MatchedRoute {
+    route: RouteSpec;
+    params: Record<string, string>;
+    /** Tail of the path that wasn't consumed by this route — used to
+     *  match children. Empty string when the parent consumed the whole
+     *  path. */
+    tail: string;
+}
+/**
+ * Walk the routes tree depth-first, picking the first leaf that
+ * fully consumes the pathname. Returns the full match chain
+ * (root → ... → leaf) so layouts can render via `<Outlet />`.
+ */
+export declare function matchRoutes(routes: RouteSpec[], pathname: string): MatchedRoute[] | null;
+declare function normalize(p: string): string;
+export { normalize };

package/dist/router/useRouter.d.ts

@@ -0,0 +1,19 @@
+import { type RouterContextValue } from "./context";
+/**
+ * Access the router from any descendant of `<Router />`. Returns a
+ * stable snapshot of the current URL plus `push` / `replace` / `back`
+ * helpers. Throws when used outside a `<Router />` — that's almost
+ * always a bug worth surfacing immediately.
+ *
+ * ```tsx
+ * const { pathname, params, push } = useRouter();
+ * useEffect(() => { if (!user) push("/sign-in"); }, [user]);
+ * ```
+ */
+export declare function useRouter(): RouterContextValue;
+/** Shorthand for `useRouter().params`. */
+export declare function useParams<T extends Record<string, string>>(): T;
+/** Shorthand for `useRouter().query`. */
+export declare function useSearchParams(): Record<string, string>;
+/** Shorthand for `useRouter().pathname`. */
+export declare function usePathname(): string;

package/package.json

@@ -3,24 +3,25 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.292",
+  "version": "0.3.293",
   "type": "module",
   "main": "src/index.ts",
-  "types": "src/index.ts",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "types": "./src/index.ts",
+      "types": "./dist/index.d.ts",
       "import": "./src/index.ts"
     },
     "./theme.css": "./src/theme.css"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json --noEmit",
-    "check": "tsc -p tsconfig.json --noEmit"
+    "build": "tsc -p tsconfig.build.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "prepack": "bun run build"
   },
   "dependencies": {
-    "@pylonsync/react": "0.3.292",
-    "@pylonsync/sync": "0.3.292",
+    "@pylonsync/react": "0.3.293",
+    "@pylonsync/sync": "0.3.293",
     "clsx": "^2.1.1"
   },
   "peerDependencies": {
@@ -28,5 +29,10 @@
   },
   "devDependencies": {
     "@types/react": "^19.0.0"
-  }
+  },
+  "files": [
+    "src",
+    "dist",
+    "README.md"
+  ]
 }

package/tsconfig.json

@@ -1,6 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "include": [
-    "src"
-  ]
-}