@viyv/account-client 0.2.0 → 0.3.0

package/dist/react.cjs

@@ -1,8 +1,11 @@
+"use client";
 'use strict';
 
 var react = require('react');
 var client = require('better-auth/client');
 
+// src/components.tsx
+
 // src/entitlement.ts
 function parseEntitlement(wire) {
   return {
@@ -10,6 +13,7 @@ function parseEntitlement(wire) {
     plan: wire.plan,
     addons: wire.addons ?? [],
     products: wire.products ?? [],
+    productPlans: wire.product_plans ?? {},
     features: wire.features
   };
 }
@@ -17,7 +21,9 @@ function entitlementForProduct(entitlement, product) {
   if (!entitlement) return null;
   return {
     enabled: entitlement.products.includes(product),
-    plan: entitlement.plan,
+    // Per-product billing: report THIS product's own tier (free-start default),
+    // not the org-wide effective `plan`.
+    plan: entitlement.productPlans[product] ?? "free",
     addons: entitlement.addons,
     features: entitlement.features
   };
@@ -39,6 +45,21 @@ function createAccountClient(config) {
       email: params.email,
       password: params.password
     }),
+    signInWithProvider: (provider, options) => client$1.signIn.social({
+      provider,
+      callbackURL: options.callbackURL,
+      errorCallbackURL: options.errorCallbackURL
+    }),
+    listAccounts: () => client$1.listAccounts(),
+    linkSocial: (provider, options) => client$1.linkSocial({
+      provider,
+      callbackURL: options.callbackURL,
+      errorCallbackURL: options.errorCallbackURL
+    }),
+    unlinkAccount: (params) => client$1.unlinkAccount({
+      providerId: params.providerId,
+      accountId: params.accountId
+    }),
     signOut: () => client$1.signOut(),
     getSession: () => client$1.getSession()
   };
@@ -57,6 +78,7 @@ var SIGNED_OUT = {
   status: "unauthenticated",
   user: null,
   activeOrg: null,
+  orgs: [],
   entitlement: null
 };
 async function loadAccount(apiBase, opts = {}) {
@@ -74,20 +96,23 @@ async function loadAccount(apiBase, opts = {}) {
     name: session.user.name ?? null,
     image: session.user.image ?? null
   };
+  const wantedOrg = opts.org?.trim() || null;
+  const entUrl = wantedOrg ? `${apiBase}/v1/license/entitlement?org=${encodeURIComponent(wantedOrg)}` : `${apiBase}/v1/license/entitlement`;
   const [ent, orgsBody] = await Promise.all([
-    opts.skipEntitlement ? Promise.resolve(null) : fetchJson(
-      doFetch,
-      `${apiBase}/v1/license/entitlement`,
-      opts.signal
-    ),
+    opts.skipEntitlement ? Promise.resolve(null) : fetchJson(doFetch, entUrl, opts.signal),
     fetchJson(doFetch, `${apiBase}/v1/users/me/orgs`, opts.signal)
   ]);
   const entitlement = ent ? parseEntitlement(ent) : null;
+  const orgsWire = orgsBody?.organizations ?? [];
+  const orgs = orgsWire.map((o) => ({
+    id: o.organization_id,
+    slug: o.slug ?? null,
+    name: o.name ?? null
+  }));
   const activeId = session.session?.activeOrganizationId ?? entitlement?.organizationId ?? null;
-  const orgs = orgsBody?.organizations ?? [];
-  const match = activeId ? orgs.find((o) => o.organization_id === activeId) : orgs[0];
-  const activeOrg = match ? { id: match.organization_id, slug: match.slug ?? null, name: match.name ?? null } : activeId ? { id: activeId, slug: null, name: null } : null;
-  return { status: "authenticated", user, activeOrg, entitlement };
+  const match = wantedOrg ? orgs.find((o) => o.slug === wantedOrg || o.id === wantedOrg) : activeId ? orgs.find((o) => o.id === activeId) : orgs[0];
+  const activeOrg = match ?? (!wantedOrg && activeId ? { id: activeId, slug: null, name: null } : null);
+  return { status: "authenticated", user, activeOrg, orgs, entitlement };
 }
 var AccountContext = react.createContext(null);
 function AccountProvider({
@@ -95,6 +120,7 @@ function AccountProvider({
   cookieDomain,
   signInUrl = "https://app.viyv.io/signin",
   skipEntitlement = false,
+  org,
   devAccount,
   children
 }) {
@@ -105,15 +131,17 @@ function AccountProvider({
   const [status, setStatus] = react.useState("loading");
   const [user, setUser] = react.useState(null);
   const [activeOrg, setActiveOrg] = react.useState(null);
+  const [orgs, setOrgs] = react.useState([]);
   const [entitlement, setEntitlement] = react.useState(null);
   const [error, setError] = react.useState(null);
   const load = react.useCallback(
     async (signal) => {
       try {
         setError(null);
-        const result = await loadAccount(apiBase, { skipEntitlement, signal, devAccount });
+        const result = await loadAccount(apiBase, { skipEntitlement, org, signal, devAccount });
         setUser(result.user);
         setActiveOrg(result.activeOrg);
+        setOrgs(result.orgs);
         setEntitlement(result.entitlement);
         setStatus(result.status);
       } catch (err) {
@@ -121,11 +149,12 @@ function AccountProvider({
         setError(err instanceof Error ? err : new Error(String(err)));
         setUser(null);
         setActiveOrg(null);
+        setOrgs([]);
         setEntitlement(null);
         setStatus("unauthenticated");
       }
     },
-    [apiBase, skipEntitlement, devAccount]
+    [apiBase, skipEntitlement, org, devAccount]
   );
   react.useEffect(() => {
     const ctrl = new AbortController();
@@ -144,6 +173,7 @@ function AccountProvider({
     await clientRef.current?.signOut();
     setUser(null);
     setActiveOrg(null);
+    setOrgs([]);
     setEntitlement(null);
     setStatus("unauthenticated");
   }, []);
@@ -152,6 +182,7 @@ function AccountProvider({
       status,
       user,
       activeOrg,
+      orgs,
       entitlement,
       error,
       refresh: () => load(),
@@ -160,7 +191,7 @@ function AccountProvider({
       apiBase,
       signInUrl
     }),
-    [status, user, activeOrg, entitlement, error, load, signIn, signOut, apiBase, signInUrl]
+    [status, user, activeOrg, orgs, entitlement, error, load, signIn, signOut, apiBase, signInUrl]
   );
   return react.createElement(AccountContext.Provider, { value }, children);
 }
@@ -175,6 +206,17 @@ function useUser() {
 function useActiveOrg() {
   return useAccount().activeOrg;
 }
+function useOrgs() {
+  return useAccount().orgs;
+}
+function useOrgFromSlug(slug) {
+  const orgs = useAccount().orgs;
+  return react.useMemo(() => {
+    const wanted = slug?.trim();
+    if (!wanted) return null;
+    return orgs.find((o) => o.slug === wanted || o.id === wanted) ?? null;
+  }, [orgs, slug]);
+}
 function useEntitlement(product) {
   const { entitlement } = useAccount();
   return react.useMemo(() => entitlementForProduct(entitlement, product), [entitlement, product]);
@@ -212,6 +254,8 @@ exports.loadAccount = loadAccount;
 exports.useAccount = useAccount;
 exports.useActiveOrg = useActiveOrg;
 exports.useEntitlement = useEntitlement;
+exports.useOrgFromSlug = useOrgFromSlug;
+exports.useOrgs = useOrgs;
 exports.useUser = useUser;
 //# sourceMappingURL=react.cjs.map
 //# sourceMappingURL=react.cjs.map

package/dist/react.d.cts

@@ -43,16 +43,24 @@ interface AccountOrg {
 /** Shape of GET /v1/license/entitlement (docs/09 A-4). */
 interface Entitlement {
     organizationId: string;
+    /**
+     * The org's effective (highest) tier across its products — a back-compat
+     * summary. Per-product billing (2026-06-13): the authoritative per-product
+     * tier is in {@link Entitlement.productPlans}.
+     */
     plan: PlanTier;
     addons: string[];
     /** Product slugs this org may use (free-start lists the agent family). */
     products: ProductSlug[];
+    /** Per-product tier (each enabled product → its plan; free-start = "free"). */
+    productPlans: Partial<Record<ProductSlug, PlanTier>>;
     features: EntitlementFeatures;
 }
 /** Per-product entitlement view returned by useEntitlement(slug). */
 interface ProductEntitlement {
     /** Whether the product is enabled for this org. */
     enabled: boolean;
+    /** THIS product's tier (per-product billing) — not the org-wide summary. */
     plan: PlanTier;
     addons: string[];
     /** The full feature map (callers branch on the flags they care about). */
@@ -64,6 +72,8 @@ interface LoadedAccount {
     status: "authenticated" | "unauthenticated";
     user: AccountUser | null;
     activeOrg: AccountOrg | null;
+    /** Every org the user belongs to (for switchers + URL-slug resolution, docs/14). */
+    orgs: AccountOrg[];
     entitlement: Entitlement | null;
 }
 /**
@@ -76,6 +86,13 @@ declare function loadAccount(apiBase: string, opts?: {
     skipEntitlement?: boolean;
     signal?: AbortSignal;
     fetchImpl?: typeof fetch;
+    /**
+     * URL-scoped org (docs/14): an org id OR slug. When set, the resolved
+     * `activeOrg` is THIS org (membership-verified via the user's org list) and
+     * the entitlement is read for it (`?org=`), instead of the cookie active org.
+     * Omit for the legacy "session active org" behavior.
+     */
+    org?: string | null;
     /**
      * Dev escape hatch: when supplied, short-circuit ALL network I/O and resolve
      * to this synthetic account. Intended for local `next dev` against an
@@ -86,7 +103,15 @@ declare function loadAccount(apiBase: string, opts?: {
 interface AccountContextValue {
     status: AccountStatus;
     user: AccountUser | null;
+    /**
+     * The org in scope: the URL org when <AccountProvider org=...> is set
+     * (docs/14), else the session's default/active org. Read it for "the org this
+     * page is about". For "which org should a bare entry default to", the session
+     * active org is what the API falls back to.
+     */
     activeOrg: AccountOrg | null;
+    /** Every org the user belongs to (switchers + slug guards). */
+    orgs: AccountOrg[];
     entitlement: Entitlement | null;
     error: Error | null;
     /** Re-fetch session + entitlement (e.g. after returning from checkout). */
@@ -107,6 +132,13 @@ interface AccountProviderProps {
     signInUrl?: string;
     /** Skip the entitlement fetch (session-only consumers). Default false. */
     skipEntitlement?: boolean;
+    /**
+     * URL-scoped org (docs/14): an org id OR slug, typically the `:slug` segment of
+     * a `/o/:slug/...` route. When set, `activeOrg` + `entitlement` reflect THIS
+     * org (membership-verified), not the cookie active org — so switching org in a
+     * sibling product never re-scopes this one. Changing it re-loads the provider.
+     */
+    org?: string | null;
     /**
      * Dev escape hatch: a synthetic account to render instead of fetching from
      * api.viyv.io. Intended for local `next dev` (gate it on a NEXT_PUBLIC_* flag
@@ -115,17 +147,30 @@ interface AccountProviderProps {
     devAccount?: LoadedAccount | null;
     children?: ReactNode;
 }
-declare function AccountProvider({ apiBase, cookieDomain, signInUrl, skipEntitlement, devAccount, children, }: AccountProviderProps): react.FunctionComponentElement<react.ProviderProps<AccountContextValue | null>>;
+declare function AccountProvider({ apiBase, cookieDomain, signInUrl, skipEntitlement, org, devAccount, children, }: AccountProviderProps): react.FunctionComponentElement<react.ProviderProps<AccountContextValue | null>>;
 /** Read the full account context. Throws if used outside <AccountProvider>. */
 declare function useAccount(): AccountContextValue;
 /** The signed-in user, or null when unauthenticated/loading. */
 declare function useUser(): AccountUser | null;
-/** The active organization, or null. */
+/**
+ * The org in scope, or null. When <AccountProvider org=...> is set this is the
+ * URL org (docs/14); otherwise the session's default/active org. Treat it as
+ * "the org this page is about", not a global mutable selection.
+ */
 declare function useActiveOrg(): AccountOrg | null;
+/** Every org the signed-in user belongs to (for switchers). Empty when signed out. */
+declare function useOrgs(): AccountOrg[];
+/**
+ * Resolve a URL slug (or org id) to one of the user's orgs, or null when they
+ * are not a member (docs/14). Use it in a `/o/:slug` layout to decide between
+ * rendering and a 404 / org-picker — the resolution is purely client-side over
+ * the already-fetched org list, so it never leaks non-member orgs.
+ */
+declare function useOrgFromSlug(slug: string | null | undefined): AccountOrg | null;
 /**
  * Per-product entitlement view. Returns null while loading / unauthenticated.
  * Web products gate features on the returned `enabled` + `features` flags.
  */
 declare function useEntitlement(product: ProductSlug): ProductEntitlement | null;
 
-export { type AccountContextValue, type AccountOrg, AccountProvider, type AccountProviderProps, type AccountStatus, type AccountUser, type Entitlement, type LoadedAccount, type ProductEntitlement, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, loadAccount, useAccount, useActiveOrg, useEntitlement, useUser };
+export { type AccountContextValue, type AccountOrg, AccountProvider, type AccountProviderProps, type AccountStatus, type AccountUser, type Entitlement, type LoadedAccount, type ProductEntitlement, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, loadAccount, useAccount, useActiveOrg, useEntitlement, useOrgFromSlug, useOrgs, useUser };

package/dist/react.d.ts

@@ -43,16 +43,24 @@ interface AccountOrg {
 /** Shape of GET /v1/license/entitlement (docs/09 A-4). */
 interface Entitlement {
     organizationId: string;
+    /**
+     * The org's effective (highest) tier across its products — a back-compat
+     * summary. Per-product billing (2026-06-13): the authoritative per-product
+     * tier is in {@link Entitlement.productPlans}.
+     */
     plan: PlanTier;
     addons: string[];
     /** Product slugs this org may use (free-start lists the agent family). */
     products: ProductSlug[];
+    /** Per-product tier (each enabled product → its plan; free-start = "free"). */
+    productPlans: Partial<Record<ProductSlug, PlanTier>>;
     features: EntitlementFeatures;
 }
 /** Per-product entitlement view returned by useEntitlement(slug). */
 interface ProductEntitlement {
     /** Whether the product is enabled for this org. */
     enabled: boolean;
+    /** THIS product's tier (per-product billing) — not the org-wide summary. */
     plan: PlanTier;
     addons: string[];
     /** The full feature map (callers branch on the flags they care about). */
@@ -64,6 +72,8 @@ interface LoadedAccount {
     status: "authenticated" | "unauthenticated";
     user: AccountUser | null;
     activeOrg: AccountOrg | null;
+    /** Every org the user belongs to (for switchers + URL-slug resolution, docs/14). */
+    orgs: AccountOrg[];
     entitlement: Entitlement | null;
 }
 /**
@@ -76,6 +86,13 @@ declare function loadAccount(apiBase: string, opts?: {
     skipEntitlement?: boolean;
     signal?: AbortSignal;
     fetchImpl?: typeof fetch;
+    /**
+     * URL-scoped org (docs/14): an org id OR slug. When set, the resolved
+     * `activeOrg` is THIS org (membership-verified via the user's org list) and
+     * the entitlement is read for it (`?org=`), instead of the cookie active org.
+     * Omit for the legacy "session active org" behavior.
+     */
+    org?: string | null;
     /**
      * Dev escape hatch: when supplied, short-circuit ALL network I/O and resolve
      * to this synthetic account. Intended for local `next dev` against an
@@ -86,7 +103,15 @@ declare function loadAccount(apiBase: string, opts?: {
 interface AccountContextValue {
     status: AccountStatus;
     user: AccountUser | null;
+    /**
+     * The org in scope: the URL org when <AccountProvider org=...> is set
+     * (docs/14), else the session's default/active org. Read it for "the org this
+     * page is about". For "which org should a bare entry default to", the session
+     * active org is what the API falls back to.
+     */
     activeOrg: AccountOrg | null;
+    /** Every org the user belongs to (switchers + slug guards). */
+    orgs: AccountOrg[];
     entitlement: Entitlement | null;
     error: Error | null;
     /** Re-fetch session + entitlement (e.g. after returning from checkout). */
@@ -107,6 +132,13 @@ interface AccountProviderProps {
     signInUrl?: string;
     /** Skip the entitlement fetch (session-only consumers). Default false. */
     skipEntitlement?: boolean;
+    /**
+     * URL-scoped org (docs/14): an org id OR slug, typically the `:slug` segment of
+     * a `/o/:slug/...` route. When set, `activeOrg` + `entitlement` reflect THIS
+     * org (membership-verified), not the cookie active org — so switching org in a
+     * sibling product never re-scopes this one. Changing it re-loads the provider.
+     */
+    org?: string | null;
     /**
      * Dev escape hatch: a synthetic account to render instead of fetching from
      * api.viyv.io. Intended for local `next dev` (gate it on a NEXT_PUBLIC_* flag
@@ -115,17 +147,30 @@ interface AccountProviderProps {
     devAccount?: LoadedAccount | null;
     children?: ReactNode;
 }
-declare function AccountProvider({ apiBase, cookieDomain, signInUrl, skipEntitlement, devAccount, children, }: AccountProviderProps): react.FunctionComponentElement<react.ProviderProps<AccountContextValue | null>>;
+declare function AccountProvider({ apiBase, cookieDomain, signInUrl, skipEntitlement, org, devAccount, children, }: AccountProviderProps): react.FunctionComponentElement<react.ProviderProps<AccountContextValue | null>>;
 /** Read the full account context. Throws if used outside <AccountProvider>. */
 declare function useAccount(): AccountContextValue;
 /** The signed-in user, or null when unauthenticated/loading. */
 declare function useUser(): AccountUser | null;
-/** The active organization, or null. */
+/**
+ * The org in scope, or null. When <AccountProvider org=...> is set this is the
+ * URL org (docs/14); otherwise the session's default/active org. Treat it as
+ * "the org this page is about", not a global mutable selection.
+ */
 declare function useActiveOrg(): AccountOrg | null;
+/** Every org the signed-in user belongs to (for switchers). Empty when signed out. */
+declare function useOrgs(): AccountOrg[];
+/**
+ * Resolve a URL slug (or org id) to one of the user's orgs, or null when they
+ * are not a member (docs/14). Use it in a `/o/:slug` layout to decide between
+ * rendering and a 404 / org-picker — the resolution is purely client-side over
+ * the already-fetched org list, so it never leaks non-member orgs.
+ */
+declare function useOrgFromSlug(slug: string | null | undefined): AccountOrg | null;
 /**
  * Per-product entitlement view. Returns null while loading / unauthenticated.
  * Web products gate features on the returned `enabled` + `features` flags.
  */
 declare function useEntitlement(product: ProductSlug): ProductEntitlement | null;
 
-export { type AccountContextValue, type AccountOrg, AccountProvider, type AccountProviderProps, type AccountStatus, type AccountUser, type Entitlement, type LoadedAccount, type ProductEntitlement, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, loadAccount, useAccount, useActiveOrg, useEntitlement, useUser };
+export { type AccountContextValue, type AccountOrg, AccountProvider, type AccountProviderProps, type AccountStatus, type AccountUser, type Entitlement, type LoadedAccount, type ProductEntitlement, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, loadAccount, useAccount, useActiveOrg, useEntitlement, useOrgFromSlug, useOrgs, useUser };

package/dist/react.js

@@ -1,6 +1,9 @@
+"use client";
 import { createContext, useRef, useState, useCallback, useEffect, useMemo, createElement, useContext } from 'react';
 import { createAuthClient } from 'better-auth/client';
 
+// src/components.tsx
+
 // src/entitlement.ts
 function parseEntitlement(wire) {
   return {
@@ -8,6 +11,7 @@ function parseEntitlement(wire) {
     plan: wire.plan,
     addons: wire.addons ?? [],
     products: wire.products ?? [],
+    productPlans: wire.product_plans ?? {},
     features: wire.features
   };
 }
@@ -15,7 +19,9 @@ function entitlementForProduct(entitlement, product) {
   if (!entitlement) return null;
   return {
     enabled: entitlement.products.includes(product),
-    plan: entitlement.plan,
+    // Per-product billing: report THIS product's own tier (free-start default),
+    // not the org-wide effective `plan`.
+    plan: entitlement.productPlans[product] ?? "free",
     addons: entitlement.addons,
     features: entitlement.features
   };
@@ -37,6 +43,21 @@ function createAccountClient(config) {
       email: params.email,
       password: params.password
     }),
+    signInWithProvider: (provider, options) => client.signIn.social({
+      provider,
+      callbackURL: options.callbackURL,
+      errorCallbackURL: options.errorCallbackURL
+    }),
+    listAccounts: () => client.listAccounts(),
+    linkSocial: (provider, options) => client.linkSocial({
+      provider,
+      callbackURL: options.callbackURL,
+      errorCallbackURL: options.errorCallbackURL
+    }),
+    unlinkAccount: (params) => client.unlinkAccount({
+      providerId: params.providerId,
+      accountId: params.accountId
+    }),
     signOut: () => client.signOut(),
     getSession: () => client.getSession()
   };
@@ -55,6 +76,7 @@ var SIGNED_OUT = {
   status: "unauthenticated",
   user: null,
   activeOrg: null,
+  orgs: [],
   entitlement: null
 };
 async function loadAccount(apiBase, opts = {}) {
@@ -72,20 +94,23 @@ async function loadAccount(apiBase, opts = {}) {
     name: session.user.name ?? null,
     image: session.user.image ?? null
   };
+  const wantedOrg = opts.org?.trim() || null;
+  const entUrl = wantedOrg ? `${apiBase}/v1/license/entitlement?org=${encodeURIComponent(wantedOrg)}` : `${apiBase}/v1/license/entitlement`;
   const [ent, orgsBody] = await Promise.all([
-    opts.skipEntitlement ? Promise.resolve(null) : fetchJson(
-      doFetch,
-      `${apiBase}/v1/license/entitlement`,
-      opts.signal
-    ),
+    opts.skipEntitlement ? Promise.resolve(null) : fetchJson(doFetch, entUrl, opts.signal),
     fetchJson(doFetch, `${apiBase}/v1/users/me/orgs`, opts.signal)
   ]);
   const entitlement = ent ? parseEntitlement(ent) : null;
+  const orgsWire = orgsBody?.organizations ?? [];
+  const orgs = orgsWire.map((o) => ({
+    id: o.organization_id,
+    slug: o.slug ?? null,
+    name: o.name ?? null
+  }));
   const activeId = session.session?.activeOrganizationId ?? entitlement?.organizationId ?? null;
-  const orgs = orgsBody?.organizations ?? [];
-  const match = activeId ? orgs.find((o) => o.organization_id === activeId) : orgs[0];
-  const activeOrg = match ? { id: match.organization_id, slug: match.slug ?? null, name: match.name ?? null } : activeId ? { id: activeId, slug: null, name: null } : null;
-  return { status: "authenticated", user, activeOrg, entitlement };
+  const match = wantedOrg ? orgs.find((o) => o.slug === wantedOrg || o.id === wantedOrg) : activeId ? orgs.find((o) => o.id === activeId) : orgs[0];
+  const activeOrg = match ?? (!wantedOrg && activeId ? { id: activeId, slug: null, name: null } : null);
+  return { status: "authenticated", user, activeOrg, orgs, entitlement };
 }
 var AccountContext = createContext(null);
 function AccountProvider({
@@ -93,6 +118,7 @@ function AccountProvider({
   cookieDomain,
   signInUrl = "https://app.viyv.io/signin",
   skipEntitlement = false,
+  org,
   devAccount,
   children
 }) {
@@ -103,15 +129,17 @@ function AccountProvider({
   const [status, setStatus] = useState("loading");
   const [user, setUser] = useState(null);
   const [activeOrg, setActiveOrg] = useState(null);
+  const [orgs, setOrgs] = useState([]);
   const [entitlement, setEntitlement] = useState(null);
   const [error, setError] = useState(null);
   const load = useCallback(
     async (signal) => {
       try {
         setError(null);
-        const result = await loadAccount(apiBase, { skipEntitlement, signal, devAccount });
+        const result = await loadAccount(apiBase, { skipEntitlement, org, signal, devAccount });
         setUser(result.user);
         setActiveOrg(result.activeOrg);
+        setOrgs(result.orgs);
         setEntitlement(result.entitlement);
         setStatus(result.status);
       } catch (err) {
@@ -119,11 +147,12 @@ function AccountProvider({
         setError(err instanceof Error ? err : new Error(String(err)));
         setUser(null);
         setActiveOrg(null);
+        setOrgs([]);
         setEntitlement(null);
         setStatus("unauthenticated");
       }
     },
-    [apiBase, skipEntitlement, devAccount]
+    [apiBase, skipEntitlement, org, devAccount]
   );
   useEffect(() => {
     const ctrl = new AbortController();
@@ -142,6 +171,7 @@ function AccountProvider({
     await clientRef.current?.signOut();
     setUser(null);
     setActiveOrg(null);
+    setOrgs([]);
     setEntitlement(null);
     setStatus("unauthenticated");
   }, []);
@@ -150,6 +180,7 @@ function AccountProvider({
       status,
       user,
       activeOrg,
+      orgs,
       entitlement,
       error,
       refresh: () => load(),
@@ -158,7 +189,7 @@ function AccountProvider({
       apiBase,
       signInUrl
     }),
-    [status, user, activeOrg, entitlement, error, load, signIn, signOut, apiBase, signInUrl]
+    [status, user, activeOrg, orgs, entitlement, error, load, signIn, signOut, apiBase, signInUrl]
   );
   return createElement(AccountContext.Provider, { value }, children);
 }
@@ -173,6 +204,17 @@ function useUser() {
 function useActiveOrg() {
   return useAccount().activeOrg;
 }
+function useOrgs() {
+  return useAccount().orgs;
+}
+function useOrgFromSlug(slug) {
+  const orgs = useAccount().orgs;
+  return useMemo(() => {
+    const wanted = slug?.trim();
+    if (!wanted) return null;
+    return orgs.find((o) => o.slug === wanted || o.id === wanted) ?? null;
+  }, [orgs, slug]);
+}
 function useEntitlement(product) {
   const { entitlement } = useAccount();
   return useMemo(() => entitlementForProduct(entitlement, product), [entitlement, product]);
@@ -203,6 +245,6 @@ function SignOutButton({ children, className, onSignedOut }) {
   );
 }
 
-export { AccountProvider, SignInButton, SignOutButton, loadAccount, useAccount, useActiveOrg, useEntitlement, useUser };
+export { AccountProvider, SignInButton, SignOutButton, loadAccount, useAccount, useActiveOrg, useEntitlement, useOrgFromSlug, useOrgs, useUser };
 //# sourceMappingURL=react.js.map
 //# sourceMappingURL=react.js.map

package/dist/server.cjs

@@ -7,6 +7,7 @@ function parseEntitlement(wire) {
     plan: wire.plan,
     addons: wire.addons ?? [],
     products: wire.products ?? [],
+    productPlans: wire.product_plans ?? {},
     features: wire.features
   };
 }
@@ -38,14 +39,35 @@ async function getCurrentSession(config) {
   };
 }
 async function getEntitlement(config) {
+  const qs = config.org ? `?org=${encodeURIComponent(config.org)}` : "";
   const wire = await getJson(
-    `${config.apiBase}/v1/license/entitlement`,
+    `${config.apiBase}/v1/license/entitlement${qs}`,
     config.cookie
   );
   return wire ? parseEntitlement(wire) : null;
 }
+async function listUserOrgs(config) {
+  const body = await getJson(
+    `${config.apiBase}/v1/users/me/orgs`,
+    config.cookie
+  );
+  return (body?.organizations ?? []).map((o) => ({
+    id: o.organization_id,
+    slug: o.slug ?? null,
+    name: o.name ?? null,
+    role: o.role ?? null
+  }));
+}
+async function resolveOrgFromSlug(config) {
+  const wanted = config.slug.trim();
+  if (!wanted) return null;
+  const orgs = await listUserOrgs(config);
+  return orgs.find((o) => o.slug === wanted || o.id === wanted) ?? null;
+}
 
 exports.getCurrentSession = getCurrentSession;
 exports.getEntitlement = getEntitlement;
+exports.listUserOrgs = listUserOrgs;
+exports.resolveOrgFromSlug = resolveOrgFromSlug;
 //# sourceMappingURL=server.cjs.map
 //# sourceMappingURL=server.cjs.map

package/dist/server.d.cts

@@ -1,4 +1,5 @@
-import { a as AccountUser, E as Entitlement } from './entitlement-B3pXM2vO.cjs';
+import { a as AccountUser, E as Entitlement } from './entitlement-CfKncUyH.cjs';
+export { A as AccountOrg } from './entitlement-CfKncUyH.cjs';
 import '@viyv/shared';
 
 interface ServerSessionConfig {
@@ -10,12 +11,39 @@ interface ServerSessionConfig {
      */
     cookie: string;
 }
+/** An org the signed-in user belongs to, plus their role in it. */
+interface ResolvedOrg {
+    id: string;
+    slug: string | null;
+    name: string | null;
+    /** The signed-in user's role in this org (e.g. "owner" | "admin" | "member"). */
+    role: string | null;
+}
 /** Resolve the signed-in user from forwarded cookies (or null). */
 declare function getCurrentSession(config: ServerSessionConfig): Promise<{
     user: AccountUser;
     activeOrganizationId: string | null;
 } | null>;
-/** Resolve the org entitlement from forwarded cookies (or null). */
-declare function getEntitlement(config: ServerSessionConfig): Promise<Entitlement | null>;
+/**
+ * Resolve the org entitlement from forwarded cookies (or null).
+ *
+ * Pass `org` (an org id or slug) to read a SPECIFIC org's entitlement — the
+ * URL-scoped read (docs/14). The API membership-verifies it; a non-member org
+ * resolves to null. Omit `org` for the legacy cookie active-org behavior.
+ */
+declare function getEntitlement(config: ServerSessionConfig & {
+    org?: string | null;
+}): Promise<Entitlement | null>;
+/** List every org the signed-in user belongs to (from forwarded cookies). */
+declare function listUserOrgs(config: ServerSessionConfig): Promise<ResolvedOrg[]>;
+/**
+ * Resolve the org named by a URL slug (or id) to a membership-verified org, or
+ * null when the signed-in user is NOT a member of it (docs/14). This is the
+ * server-side seam a product uses to turn `/o/:slug/...` into the org it scopes
+ * its queries to — the URL says *which* org, this verifies the user may see it.
+ */
+declare function resolveOrgFromSlug(config: ServerSessionConfig & {
+    slug: string;
+}): Promise<ResolvedOrg | null>;
 
-export { type ServerSessionConfig, getCurrentSession, getEntitlement };
+export { type ResolvedOrg, type ServerSessionConfig, getCurrentSession, getEntitlement, listUserOrgs, resolveOrgFromSlug };