@reauth-dev/sdk 0.1.0 → 0.3.0

package/dist/react/index.js

@@ -23,16 +23,35 @@ __export(react_exports, {
   AuthProvider: () => AuthProvider,
   ProtectedRoute: () => ProtectedRoute,
   useAuth: () => useAuth,
-  useAuthContext: () => useAuthContext
+  useAuthContext: () => useAuthContext,
+  useHeadlessAuth: () => useHeadlessAuth
 });
 module.exports = __toCommonJS(react_exports);
 
 // src/react/useAuth.ts
 var import_react = require("react");
 
+// src/types.ts
+var DEFAULT_TIMEOUT_MS = 1e4;
+
 // src/client.ts
+function assertHttpsUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("URL must use HTTPS");
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error("URL must use HTTPS");
+  }
+}
 function createReauthClient(config) {
   const { domain } = config;
+  if (config.timeout !== void 0 && (!Number.isFinite(config.timeout) || config.timeout <= 0)) {
+    throw new Error("timeout must be a positive finite number in milliseconds");
+  }
+  const timeoutMs = config.timeout ?? DEFAULT_TIMEOUT_MS;
   const baseUrl = `https://reauth.${domain}/api/public`;
   return {
     /**
@@ -51,35 +70,47 @@ function createReauthClient(config) {
      */
     async getSession() {
       const res = await fetch(`${baseUrl}/auth/session`, {
-        credentials: "include"
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
       });
+      if (!res.ok) {
+        throw new Error(`Failed to get session: ${res.status}`);
+      }
       return res.json();
     },
     /**
      * Refresh the access token using the refresh token.
      * Call this when getSession() returns valid: false but no error_code.
-     * @returns true if refresh succeeded, false otherwise
+     * @throws Error on failed refresh (401) or server error
      */
     async refresh() {
       const res = await fetch(`${baseUrl}/auth/refresh`, {
         method: "POST",
-        credentials: "include"
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
       });
-      return res.ok;
+      if (!res.ok) {
+        throw new Error(`Failed to refresh: ${res.status}`);
+      }
     },
     /**
      * Get an access token for Bearer authentication.
      * Use this when calling your own API that uses local token verification.
      *
-     * @returns TokenResponse with access token, or null if not authenticated
+     * @returns TokenResponse with access token, or null if not authenticated or network unreachable
+     * @throws Error on server errors (non-401 HTTP status codes) or request timeout
      *
      * @example
      * ```typescript
-     * const tokenResponse = await reauth.getToken();
-     * if (tokenResponse) {
-     *   fetch('/api/data', {
-     *     headers: { Authorization: `Bearer ${tokenResponse.accessToken}` }
-     *   });
+     * try {
+     *   const tokenResponse = await reauth.getToken();
+     *   if (tokenResponse) {
+     *     fetch('/api/data', {
+     *       headers: { Authorization: `Bearer ${tokenResponse.accessToken}` }
+     *     });
+     *   }
+     * } catch (err) {
+     *   // Server error or timeout — do not log the user out
      * }
      * ```
      */
@@ -87,7 +118,8 @@ function createReauthClient(config) {
       try {
         const res = await fetch(`${baseUrl}/auth/token`, {
           method: "GET",
-          credentials: "include"
+          credentials: "include",
+          signal: AbortSignal.timeout(timeoutMs)
         });
         if (!res.ok) {
           if (res.status === 401) return null;
@@ -99,29 +131,158 @@ function createReauthClient(config) {
           expiresIn: data.expires_in,
           tokenType: data.token_type
         };
-      } catch {
-        return null;
+      } catch (err) {
+        if (err instanceof TypeError) return null;
+        throw err;
       }
     },
     /**
      * Log out the user by clearing all session cookies.
+     * @throws Error on server error
      */
     async logout() {
-      await fetch(`${baseUrl}/auth/logout`, {
+      const res = await fetch(`${baseUrl}/auth/logout`, {
         method: "POST",
-        credentials: "include"
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
       });
+      if (!res.ok) {
+        throw new Error(`Failed to logout: ${res.status}`);
+      }
     },
     /**
      * Delete the user's own account (self-service).
-     * @returns true if deletion succeeded, false otherwise
+     * @throws Error on permission denied or server error
      */
     async deleteAccount() {
       const res = await fetch(`${baseUrl}/auth/account`, {
         method: "DELETE",
-        credentials: "include"
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
       });
-      return res.ok;
+      if (!res.ok) {
+        throw new Error(`Failed to delete account: ${res.status}`);
+      }
+    },
+    // ========================================================================
+    // Headless Auth Methods
+    // ========================================================================
+    /**
+     * Get the domain's public auth configuration.
+     * Returns enabled auth methods and whether headless auth is available.
+     */
+    async getConfig() {
+      const res = await fetch(`${baseUrl}/config`, {
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        throw new Error(`Failed to get config: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        domain: data.domain,
+        authMethods: {
+          magicLink: data.auth_methods.magic_link,
+          googleOauth: data.auth_methods.google_oauth,
+          twitterOauth: data.auth_methods.twitter_oauth
+        },
+        redirectUrl: data.redirect_url,
+        headlessEnabled: data.headless_enabled
+      };
+    },
+    /**
+     * Request a magic link email for headless authentication.
+     * When callbackUrl is provided, the email link will point to your custom URL
+     * with the token as a query parameter.
+     * @param opts Options including email and optional callbackUrl
+     */
+    async requestMagicLink(opts) {
+      const body = { email: opts.email };
+      if (opts.callbackUrl) {
+        body.callback_url = opts.callbackUrl;
+      }
+      const res = await fetch(`${baseUrl}/auth/request-magic-link`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify(body)
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to request magic link: ${res.status}`);
+      }
+    },
+    /**
+     * Verify a magic link token received from the email callback URL.
+     * On success, session cookies are set automatically.
+     * @param opts Options including the token from the callback URL
+     */
+    async verifyMagicLink(opts) {
+      const res = await fetch(`${baseUrl}/auth/verify-magic-link`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({ token: opts.token })
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to verify magic link: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        success: data.success,
+        redirectUrl: data.redirect_url,
+        endUserId: data.end_user_id,
+        email: data.email,
+        waitlistPosition: data.waitlist_position
+      };
+    },
+    /**
+     * Start a Google OAuth flow for headless authentication.
+     * Returns the Google authorization URL to redirect the user to.
+     * After Google authentication, the portal handles the callback and
+     * redirects to the domain's configured redirect_url.
+     */
+    async startGoogleOAuth() {
+      const res = await fetch(`${baseUrl}/auth/google/start`, {
+        method: "POST",
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to start Google OAuth: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        authUrl: data.auth_url,
+        state: data.state
+      };
+    },
+    /**
+     * Start an X (Twitter) OAuth flow for headless authentication.
+     * Returns the X authorization URL to redirect the user to.
+     * After X authentication, the portal handles the callback and
+     * redirects to the domain's configured redirect_url.
+     */
+    async startTwitterOAuth() {
+      const res = await fetch(`${baseUrl}/auth/twitter/start`, {
+        method: "POST",
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to start Twitter OAuth: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        authUrl: data.auth_url,
+        state: data.state
+      };
     },
     // ========================================================================
     // Billing Methods
@@ -129,12 +290,16 @@ function createReauthClient(config) {
     /**
      * Get available subscription plans for the domain.
      * Only returns public plans sorted by display order.
+     * @throws Error on server error
      */
     async getPlans() {
       const res = await fetch(`${baseUrl}/billing/plans`, {
-        credentials: "include"
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
       });
-      if (!res.ok) return [];
+      if (!res.ok) {
+        throw new Error(`Failed to get plans: ${res.status}`);
+      }
       const data = await res.json();
       return data.map(
         (p) => ({
@@ -147,8 +312,17 @@ function createReauthClient(config) {
           interval: p.interval,
           intervalCount: p.interval_count,
           trialDays: p.trial_days,
-          features: p.features,
-          displayOrder: p.display_order
+          features: p.features.map((f) => ({
+            code: f.code,
+            name: f.name,
+            featureType: f.feature_type,
+            numericValue: f.numeric_value,
+            unitLabel: f.unit_label
+          })),
+          displayOrder: p.display_order,
+          creditsAmount: p.credits_amount,
+          planType: p.plan_type,
+          contactUrl: p.contact_url
         })
       );
     },
@@ -157,8 +331,12 @@ function createReauthClient(config) {
      */
     async getSubscription() {
       const res = await fetch(`${baseUrl}/billing/subscription`, {
-        credentials: "include"
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
       });
+      if (!res.ok) {
+        throw new Error(`Failed to get subscription: ${res.status}`);
+      }
       const data = await res.json();
       return {
         id: data.id,
@@ -182,6 +360,7 @@ function createReauthClient(config) {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
         body: JSON.stringify({
           plan_code: planCode,
           success_url: successUrl,
@@ -210,6 +389,7 @@ function createReauthClient(config) {
         currentUrl,
         currentUrl
       );
+      assertHttpsUrl(checkoutUrl);
       window.location.href = checkoutUrl;
     },
     /**
@@ -224,6 +404,7 @@ function createReauthClient(config) {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
         body: JSON.stringify({
           return_url: returnUrl || window.location.href
         })
@@ -232,18 +413,22 @@ function createReauthClient(config) {
         throw new Error("Failed to open billing portal");
       }
       const data = await res.json();
+      assertHttpsUrl(data.portal_url);
       window.location.href = data.portal_url;
     },
     /**
      * Cancel the user's subscription at period end.
-     * @returns true if cancellation succeeded
+     * @throws Error on failure or server error
      */
     async cancelSubscription() {
       const res = await fetch(`${baseUrl}/billing/cancel`, {
         method: "POST",
-        credentials: "include"
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
       });
-      return res.ok;
+      if (!res.ok) {
+        throw new Error(`Failed to cancel subscription: ${res.status}`);
+      }
     },
     // ========================================================================
     // Balance Methods
@@ -254,13 +439,15 @@ function createReauthClient(config) {
      */
     async getBalance() {
       const res = await fetch(`${baseUrl}/balance`, {
-        credentials: "include"
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
       });
       if (!res.ok) {
         if (res.status === 401) throw new Error("Not authenticated");
         throw new Error(`Failed to get balance: ${res.status}`);
       }
-      return res.json();
+      const data = await res.json();
+      return { balance: data.balance };
     },
     /**
      * Get the current user's balance transaction history.
@@ -274,7 +461,7 @@ function createReauthClient(config) {
       const qs = params.toString();
       const res = await fetch(
         `${baseUrl}/balance/transactions${qs ? `?${qs}` : ""}`,
-        { credentials: "include" }
+        { credentials: "include", signal: AbortSignal.timeout(timeoutMs) }
       );
       if (!res.ok) {
         if (res.status === 401) throw new Error("Not authenticated");
@@ -292,13 +479,602 @@ function createReauthClient(config) {
           })
         )
       };
+    },
+    // ========================================================================
+    // Credits Methods
+    // ========================================================================
+    /**
+     * Get the domain's credits configuration.
+     * Returns exchange rate, display settings, and purchase limits.
+     */
+    async getCreditsConfig() {
+      const res = await fetch(`${baseUrl}/billing/credits-config`, {
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        if (res.status === 401) throw new Error("Not authenticated");
+        throw new Error(`Failed to get credits config: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        creditsEnabled: data.credits_enabled,
+        creditsPerDollar: data.credits_per_dollar,
+        displayName: data.display_name,
+        displaySymbol: data.display_symbol,
+        displaySymbolPosition: data.display_symbol_position,
+        displayDecimals: data.display_decimals,
+        minPurchaseCents: data.min_purchase_cents,
+        maxPurchaseCents: data.max_purchase_cents,
+        manualTopUpAvailable: data.manual_top_up_available,
+        autoTopUpAvailable: data.auto_top_up_available,
+        overdrawEnabled: data.overdraw_enabled
+      };
+    },
+    // ========================================================================
+    // Payment Method Methods
+    // ========================================================================
+    /**
+     * List the current user's stored payment methods.
+     * Sorted by priority (lower number = higher priority).
+     */
+    async getPaymentMethods() {
+      const res = await fetch(`${baseUrl}/billing/payment-methods`, {
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        if (res.status === 401) throw new Error("Not authenticated");
+        throw new Error(`Failed to get payment methods: ${res.status}`);
+      }
+      const data = await res.json();
+      return data.map(
+        (pm) => ({
+          id: pm.id,
+          provider: pm.provider,
+          methodType: pm.method_type,
+          cardBrand: pm.card_brand,
+          cardLast4: pm.card_last4,
+          cardExpMonth: pm.card_exp_month,
+          cardExpYear: pm.card_exp_year,
+          priority: pm.priority,
+          createdAt: pm.created_at
+        })
+      );
+    },
+    /**
+     * Create a Stripe SetupIntent for adding a new payment method.
+     * Use the returned clientSecret with Stripe.js `confirmCardSetup()`.
+     */
+    async createSetupIntent() {
+      const res = await fetch(`${baseUrl}/billing/setup-intent`, {
+        method: "POST",
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        if (res.status === 401) throw new Error("Not authenticated");
+        throw new Error(`Failed to create setup intent: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        clientSecret: data.client_secret,
+        setupIntentId: data.setup_intent_id
+      };
+    },
+    /**
+     * Delete a stored payment method.
+     * @param id UUID of the payment method to delete
+     */
+    async deletePaymentMethod(id) {
+      const res = await fetch(`${baseUrl}/billing/payment-methods/${id}`, {
+        method: "DELETE",
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        if (res.status === 401) throw new Error("Not authenticated");
+        if (res.status === 404) throw new Error("Payment method not found");
+        throw new Error(`Failed to delete payment method: ${res.status}`);
+      }
+    },
+    /**
+     * Reorder payment method priorities.
+     * @param paymentMethodIds Array of payment method UUIDs in desired priority order
+     */
+    async reorderPaymentMethods(paymentMethodIds) {
+      const res = await fetch(`${baseUrl}/billing/payment-methods/reorder`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({ payment_method_ids: paymentMethodIds })
+      });
+      if (!res.ok) {
+        if (res.status === 401) throw new Error("Not authenticated");
+        throw new Error(`Failed to reorder payment methods: ${res.status}`);
+      }
+    },
+    /**
+     * Purchase credits using a stored payment method.
+     * @param opts Purchase options (amount, payment method, idempotency key)
+     */
+    async purchaseCredits(opts) {
+      const res = await fetch(`${baseUrl}/billing/credits/purchase`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({
+          amount_cents: opts.amountCents,
+          payment_method_id: opts.paymentMethodId,
+          idempotency_key: opts.idempotencyKey
+        })
+      });
+      if (!res.ok) {
+        if (res.status === 401) throw new Error("Not authenticated");
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to purchase credits: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        creditsPurchased: data.credits_purchased,
+        newBalance: data.new_balance,
+        paymentIntentId: data.payment_intent_id
+      };
+    },
+    // ========================================================================
+    // Auto Top-Up Methods
+    // ========================================================================
+    /**
+     * Get the current user's auto top-up configuration and status.
+     */
+    async getAutoTopUpStatus() {
+      const res = await fetch(`${baseUrl}/billing/auto-top-up`, {
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        if (res.status === 401) throw new Error("Not authenticated");
+        throw new Error(`Failed to get auto top-up status: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        enabled: data.enabled,
+        thresholdCents: data.threshold_cents,
+        purchaseAmountCents: data.purchase_amount_cents,
+        status: data.status,
+        lastFailureReason: data.last_failure_reason,
+        retriesRemaining: data.retries_remaining,
+        nextRetryAt: data.next_retry_at
+      };
+    },
+    /**
+     * Update the current user's auto top-up configuration.
+     * @param opts New auto top-up settings
+     */
+    async updateAutoTopUp(opts) {
+      const res = await fetch(`${baseUrl}/billing/auto-top-up`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({
+          enabled: opts.enabled,
+          threshold_cents: opts.thresholdCents,
+          purchase_amount_cents: opts.purchaseAmountCents
+        })
+      });
+      if (!res.ok) {
+        if (res.status === 401) throw new Error("Not authenticated");
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to update auto top-up: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        enabled: data.enabled,
+        thresholdCents: data.threshold_cents,
+        purchaseAmountCents: data.purchase_amount_cents,
+        status: data.status,
+        lastFailureReason: data.last_failure_reason,
+        retriesRemaining: data.retries_remaining,
+        nextRetryAt: data.next_retry_at
+      };
+    },
+    // ========================================================================
+    // Organization Methods
+    // ========================================================================
+    /**
+     * Create a new organization.
+     * @param name The organization name
+     * @returns The created organization
+     */
+    async createOrg(name) {
+      const res = await fetch(`${baseUrl}/auth/orgs`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({ name })
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to create org: ${res.status}`);
+      }
+      const data = await res.json();
+      return transformOrg(data);
+    },
+    /**
+     * List all organizations the current user belongs to.
+     */
+    async listOrgs() {
+      const res = await fetch(`${baseUrl}/auth/orgs`, {
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        throw new Error(`Failed to list orgs: ${res.status}`);
+      }
+      const data = await res.json();
+      return data.map(transformOrg);
+    },
+    /**
+     * Get organization details.
+     * @param orgId The organization ID
+     */
+    async getOrg(orgId) {
+      const res = await fetch(`${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}`, {
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        if (res.status === 404) throw new Error("Organization not found");
+        throw new Error(`Failed to get org: ${res.status}`);
+      }
+      const data = await res.json();
+      return transformOrg(data);
+    },
+    /**
+     * Update an organization's name. Requires owner role.
+     * @param orgId The organization ID
+     * @param name The new name
+     */
+    async updateOrg(orgId, name) {
+      const res = await fetch(`${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({ name })
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to update org: ${res.status}`);
+      }
+      const data = await res.json();
+      return transformOrg(data);
+    },
+    /**
+     * Delete an organization. Requires owner role.
+     * @param orgId The organization ID
+     */
+    async deleteOrg(orgId) {
+      const res = await fetch(`${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}`, {
+        method: "DELETE",
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        throw new Error(`Failed to delete org: ${res.status}`);
+      }
+    },
+    // ========================================================================
+    // Organization Member Methods
+    // ========================================================================
+    /**
+     * List members of an organization. Requires membership.
+     * @param orgId The organization ID
+     */
+    async listOrgMembers(orgId) {
+      const res = await fetch(`${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}/members`, {
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        throw new Error(`Failed to list org members: ${res.status}`);
+      }
+      const data = await res.json();
+      return data.map(transformOrgMember);
+    },
+    /**
+     * Remove a member from an organization. Requires owner role.
+     * @param orgId The organization ID
+     * @param userId The user ID to remove
+     */
+    async removeOrgMember(orgId, userId) {
+      const res = await fetch(
+        `${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(userId)}`,
+        {
+          method: "DELETE",
+          credentials: "include",
+          signal: AbortSignal.timeout(timeoutMs)
+        }
+      );
+      if (!res.ok) {
+        throw new Error(`Failed to remove org member: ${res.status}`);
+      }
+    },
+    /**
+     * Update a member's role. Requires owner role.
+     * @param orgId The organization ID
+     * @param userId The user ID to update
+     * @param role The new role
+     */
+    async updateMemberRole(orgId, userId, role) {
+      const res = await fetch(
+        `${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(userId)}`,
+        {
+          method: "PATCH",
+          headers: { "Content-Type": "application/json" },
+          credentials: "include",
+          signal: AbortSignal.timeout(timeoutMs),
+          body: JSON.stringify({ role })
+        }
+      );
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to update member role: ${res.status}`);
+      }
+      const data = await res.json();
+      return transformOrgMember(data);
+    },
+    // ========================================================================
+    // Organization Context Methods
+    // ========================================================================
+    /**
+     * Switch the active organization. Re-issues session tokens with new org context.
+     * @param orgId The organization ID to switch to
+     * @returns The new active org context with subscription info
+     */
+    async switchOrg(orgId) {
+      const res = await fetch(`${baseUrl}/auth/switch-org`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({ org_id: orgId })
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to switch org: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        activeOrgId: data.active_org_id,
+        orgRole: data.org_role,
+        subscription: {
+          status: data.subscription.status,
+          planCode: data.subscription.plan_code,
+          planName: data.subscription.plan_name,
+          currentPeriodEnd: data.subscription.current_period_end,
+          cancelAtPeriodEnd: data.subscription.cancel_at_period_end,
+          trialEndsAt: data.subscription.trial_ends_at
+        }
+      };
+    },
+    /**
+     * Get the active organization from the current session.
+     * @returns Active org ID and role, or null if no active org
+     */
+    async getActiveOrg() {
+      const session = await this.getSession();
+      if (!session.valid || !session.active_org_id || !session.org_role) {
+        return null;
+      }
+      return {
+        id: session.active_org_id,
+        role: session.org_role
+      };
+    },
+    // ========================================================================
+    // Invitation Methods
+    // ========================================================================
+    /**
+     * Send an email invite to join an organization. Requires owner role.
+     * @param orgId The organization ID
+     * @param email The email address to invite
+     * @param role Optional role (defaults to "member")
+     */
+    async inviteToOrg(orgId, email, role) {
+      const res = await fetch(`${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}/invites`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({ email, role: role ?? "member" })
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to send invite: ${res.status}`);
+      }
+      const data = await res.json();
+      return transformInvitation(data);
+    },
+    /**
+     * List pending invites for an organization. Requires owner role.
+     * @param orgId The organization ID
+     */
+    async listPendingInvites(orgId) {
+      const res = await fetch(`${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}/invites`, {
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        throw new Error(`Failed to list invites: ${res.status}`);
+      }
+      const data = await res.json();
+      return data.map(transformInvitation);
+    },
+    /**
+     * Revoke a pending invite. Requires owner role.
+     * @param orgId The organization ID
+     * @param inviteId The invite ID to revoke
+     */
+    async revokeInvite(orgId, inviteId) {
+      const res = await fetch(
+        `${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}/invites/${encodeURIComponent(inviteId)}`,
+        {
+          method: "DELETE",
+          credentials: "include",
+          signal: AbortSignal.timeout(timeoutMs)
+        }
+      );
+      if (!res.ok) {
+        throw new Error(`Failed to revoke invite: ${res.status}`);
+      }
+    },
+    /**
+     * Accept an email invite using the invite token.
+     * @param token The invite token from the email
+     * @returns The org ID and role assigned
+     */
+    async acceptInvite(token) {
+      const res = await fetch(
+        `${baseUrl}/auth/orgs/invites/${encodeURIComponent(token)}/accept`,
+        {
+          method: "POST",
+          credentials: "include",
+          signal: AbortSignal.timeout(timeoutMs)
+        }
+      );
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to accept invite: ${res.status}`);
+      }
+      const data = await res.json();
+      return {
+        orgId: data.org_id,
+        role: data.role
+      };
+    },
+    /**
+     * Create a shareable invite link for an organization. Requires owner role.
+     * @param orgId The organization ID
+     * @param role Optional role for joiners (defaults to "member")
+     */
+    async createInviteLink(orgId, role) {
+      const res = await fetch(`${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}/invite-links`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs),
+        body: JSON.stringify({ role: role ?? "member" })
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to create invite link: ${res.status}`);
+      }
+      const data = await res.json();
+      return transformInviteLink(data);
+    },
+    /**
+     * List invite links for an organization. Requires owner role.
+     * @param orgId The organization ID
+     */
+    async listInviteLinks(orgId) {
+      const res = await fetch(`${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}/invite-links`, {
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        throw new Error(`Failed to list invite links: ${res.status}`);
+      }
+      const data = await res.json();
+      return data.map(transformInviteLink);
+    },
+    /**
+     * Revoke an invite link. Requires owner role.
+     * @param orgId The organization ID
+     * @param linkId The invite link ID to revoke
+     */
+    async revokeInviteLink(orgId, linkId) {
+      const res = await fetch(
+        `${baseUrl}/auth/orgs/${encodeURIComponent(orgId)}/invite-links/${encodeURIComponent(linkId)}`,
+        {
+          method: "DELETE",
+          credentials: "include",
+          signal: AbortSignal.timeout(timeoutMs)
+        }
+      );
+      if (!res.ok) {
+        throw new Error(`Failed to revoke invite link: ${res.status}`);
+      }
+    },
+    /**
+     * Join an organization via an invite link token.
+     * @param token The invite link token
+     */
+    async joinViaLink(token) {
+      const res = await fetch(`${baseUrl}/auth/orgs/join/${encodeURIComponent(token)}`, {
+        method: "POST",
+        credentials: "include",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(err.message || `Failed to join via link: ${res.status}`);
+      }
     }
   };
 }
+function transformOrg(data) {
+  return {
+    id: data.id,
+    name: data.name,
+    isPersonal: data.is_personal,
+    createdAt: data.created_at
+  };
+}
+function transformOrgMember(data) {
+  return {
+    id: data.id,
+    orgId: data.org_id,
+    endUserId: data.end_user_id,
+    role: data.role,
+    joinedAt: data.joined_at
+  };
+}
+function transformInvitation(data) {
+  return {
+    id: data.id,
+    orgId: data.org_id,
+    email: data.email,
+    token: data.token,
+    role: data.role,
+    status: data.status,
+    expiresAt: data.expires_at,
+    acceptedAt: data.accepted_at,
+    createdAt: data.created_at
+  };
+}
+function transformInviteLink(data) {
+  return {
+    id: data.id,
+    orgId: data.org_id,
+    token: data.token,
+    role: data.role,
+    isActive: data.is_active,
+    expiresAt: data.expires_at,
+    createdAt: data.created_at
+  };
+}
 
 // src/react/useAuth.ts
+var DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
 function useAuth(config) {
-  const client = (0, import_react.useMemo)(() => createReauthClient(config), [config.domain]);
+  const { refreshInterval = DEFAULT_REFRESH_INTERVAL_MS, ...clientConfig } = config;
+  const client = (0, import_react.useMemo)(() => createReauthClient(clientConfig), [clientConfig.domain]);
+  const isRefreshing = (0, import_react.useRef)(false);
   const [state, setState] = (0, import_react.useState)({
     user: null,
     loading: true,
@@ -307,12 +1083,15 @@ function useAuth(config) {
     waitlistPosition: null
   });
   const checkSession = (0, import_react.useCallback)(async () => {
+    if (isRefreshing.current) return;
+    isRefreshing.current = true;
     try {
       let session = await client.getSession();
       if (!session.valid && !session.error_code && !session.end_user_id) {
-        const refreshed = await client.refresh();
-        if (refreshed) {
+        try {
+          await client.refresh();
           session = await client.getSession();
+        } catch {
         }
       }
       if (session.error_code === "ACCOUNT_SUSPENDED") {
@@ -330,7 +1109,9 @@ function useAuth(config) {
           user: {
             id: session.end_user_id,
             email: session.email,
-            roles: session.roles || []
+            roles: session.roles || [],
+            activeOrgId: session.active_org_id || "",
+            orgRole: session.org_role || ""
           },
           loading: false,
           error: null,
@@ -344,7 +1125,9 @@ function useAuth(config) {
           user: {
             id: session.end_user_id,
             email: session.email,
-            roles: session.roles || []
+            roles: session.roles || [],
+            activeOrgId: session.active_org_id || "",
+            orgRole: session.org_role || ""
           },
           loading: false,
           error: null,
@@ -368,11 +1151,20 @@ function useAuth(config) {
         isOnWaitlist: false,
         waitlistPosition: null
       });
+    } finally {
+      isRefreshing.current = false;
     }
   }, [client]);
   (0, import_react.useEffect)(() => {
     checkSession();
   }, [checkSession]);
+  (0, import_react.useEffect)(() => {
+    if (refreshInterval <= 0) return;
+    const intervalId = setInterval(() => {
+      checkSession();
+    }, refreshInterval);
+    return () => clearInterval(intervalId);
+  }, [checkSession, refreshInterval]);
   const logout = (0, import_react.useCallback)(async () => {
     await client.logout();
     setState({
@@ -391,16 +1183,141 @@ function useAuth(config) {
   };
 }
 
-// src/react/AuthProvider.tsx
+// src/react/useHeadlessAuth.ts
 var import_react2 = require("react");
+function useHeadlessAuth(options) {
+  const client = (0, import_react2.useMemo)(
+    () => createReauthClient({ domain: options.domain, timeout: options.timeout }),
+    [options.domain, options.timeout]
+  );
+  const [state, setState] = (0, import_react2.useState)({
+    loading: false,
+    error: null,
+    step: "idle",
+    config: null,
+    verifyResult: null
+  });
+  const getConfig = (0, import_react2.useCallback)(async () => {
+    setState((s) => ({ ...s, loading: true, error: null }));
+    try {
+      const config = await client.getConfig();
+      setState((s) => ({ ...s, loading: false, config }));
+      return config;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to get config";
+      setState((s) => ({ ...s, loading: false, error: message }));
+      throw err;
+    }
+  }, [client]);
+  const requestMagicLink = (0, import_react2.useCallback)(
+    async (email) => {
+      setState((s) => ({ ...s, loading: true, error: null }));
+      try {
+        await client.requestMagicLink({
+          email,
+          callbackUrl: options.callbackUrl
+        });
+        setState((s) => ({
+          ...s,
+          loading: false,
+          step: "magic_link_sent"
+        }));
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Failed to send magic link";
+        setState((s) => ({ ...s, loading: false, error: message }));
+        throw err;
+      }
+    },
+    [client, options.callbackUrl]
+  );
+  const verifyMagicLink = (0, import_react2.useCallback)(
+    async (token) => {
+      setState((s) => ({ ...s, loading: true, error: null }));
+      try {
+        const result = await client.verifyMagicLink({ token });
+        setState((s) => ({
+          ...s,
+          loading: false,
+          step: "completed",
+          verifyResult: result
+        }));
+        return result;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Failed to verify magic link";
+        setState((s) => ({ ...s, loading: false, error: message }));
+        throw err;
+      }
+    },
+    [client]
+  );
+  const startGoogleOAuth = (0, import_react2.useCallback)(async () => {
+    setState((s) => ({ ...s, loading: true, error: null }));
+    try {
+      const result = await client.startGoogleOAuth();
+      setState((s) => ({
+        ...s,
+        loading: false,
+        step: "google_started"
+      }));
+      if (typeof window !== "undefined") {
+        window.location.href = result.authUrl;
+      }
+      return result;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to start Google OAuth";
+      setState((s) => ({ ...s, loading: false, error: message }));
+      throw err;
+    }
+  }, [client]);
+  const startTwitterOAuth = (0, import_react2.useCallback)(async () => {
+    setState((s) => ({ ...s, loading: true, error: null }));
+    try {
+      const result = await client.startTwitterOAuth();
+      setState((s) => ({
+        ...s,
+        loading: false,
+        step: "twitter_started"
+      }));
+      if (typeof window !== "undefined") {
+        window.location.href = result.authUrl;
+      }
+      return result;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to start Twitter OAuth";
+      setState((s) => ({ ...s, loading: false, error: message }));
+      throw err;
+    }
+  }, [client]);
+  const reset = (0, import_react2.useCallback)(() => {
+    setState({
+      loading: false,
+      error: null,
+      step: "idle",
+      config: null,
+      verifyResult: null
+    });
+  }, []);
+  return {
+    ...state,
+    getConfig,
+    requestMagicLink,
+    verifyMagicLink,
+    startGoogleOAuth,
+    startTwitterOAuth,
+    reset
+  };
+}
+
+// src/react/AuthProvider.tsx
+var import_react3 = require("react");
 var import_jsx_runtime = require("react/jsx-runtime");
-var AuthContext = (0, import_react2.createContext)(null);
+var AuthContext = (0, import_react3.createContext)(null);
 function AuthProvider({ config, children }) {
   const auth = useAuth(config);
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AuthContext.Provider, { value: auth, children });
 }
 function useAuthContext() {
-  const context = (0, import_react2.useContext)(AuthContext);
+  const context = (0, import_react3.useContext)(AuthContext);
   if (!context) {
     throw new Error("useAuthContext must be used within AuthProvider");
   }
@@ -408,7 +1325,7 @@ function useAuthContext() {
 }
 
 // src/react/ProtectedRoute.tsx
-var import_react3 = require("react");
+var import_react4 = require("react");
 var import_jsx_runtime2 = require("react/jsx-runtime");
 function ProtectedRoute({
   children,
@@ -417,8 +1334,10 @@ function ProtectedRoute({
   onWaitlist
 }) {
   const { user, loading, isOnWaitlist, login } = useAuthContext();
-  (0, import_react3.useEffect)(() => {
-    if (!loading && !user) {
+  const hasRedirected = (0, import_react4.useRef)(false);
+  (0, import_react4.useEffect)(() => {
+    if (!loading && !user && !hasRedirected.current) {
+      hasRedirected.current = true;
       if (onUnauthenticated) {
         onUnauthenticated();
       } else {
@@ -426,8 +1345,9 @@ function ProtectedRoute({
       }
     }
   }, [loading, user, login, onUnauthenticated]);
-  (0, import_react3.useEffect)(() => {
-    if (!loading && isOnWaitlist && onWaitlist) {
+  (0, import_react4.useEffect)(() => {
+    if (!loading && isOnWaitlist && onWaitlist && !hasRedirected.current) {
+      hasRedirected.current = true;
       onWaitlist();
     }
   }, [loading, isOnWaitlist, onWaitlist]);
@@ -444,5 +1364,6 @@ function ProtectedRoute({
   AuthProvider,
   ProtectedRoute,
   useAuth,
-  useAuthContext
+  useAuthContext,
+  useHeadlessAuth
 });