@zautha/react 0.7.0 → 0.9.0

package/README.md

@@ -63,6 +63,23 @@ inside that modal does not finish: the provider sends the user back to the app's
 nothing completes the connection there — pass `userProfileUrl`, or render `<UserProfile />` on its own page, for
 connecting accounts.
 
+## Organizations: roles and permissions
+
+`useAuth()` gives the session's active organization from its token: `orgId`, `orgRole` (`org:admin`), `orgSlug` and
+`orgPermissions` (the role's custom permissions, `org:invoices:read`), all null without one. `has({ role })` and
+`has({ permission })` take full keys and answer the same as your server does (`@zautha/backend`, `@zautha/nextjs`,
+`Zautha.AspNetCore`); a system permission (`org:sys_…`) is never in the token, so it is false. `<Show>` takes the same
+conditions. Switch organizations with `useZautha()?.setActive({ organization })` (an id, a slug while slugs are on, or
+`null` for the personal account); the hooks follow once the new token is in.
+
+```tsx
+<Show when={{ permission: "org:invoices:read" }} fallback={<p>No access</p>}>
+  <Invoices />
+</Show>
+```
+
+`<Show>` only hides UI: check the same permission on your server.
+
 ## Sensitive actions (reverification)
 
 `useReverification(fetcher)` wraps an action that may need a recent identity check. When `fetcher` throws

package/dist/index.cjs

@@ -58,6 +58,7 @@ const NO_STATE = {
 	client: null,
 	session: null,
 	user: null,
+	organization: null,
 	initialState: null
 };
 const noop = () => () => void 0;
@@ -81,12 +82,17 @@ function useAuth() {
 	const userId = initial === null ? session?.userId ?? null : initial.userId;
 	const sessionId = initial === null ? session?.id ?? null : initial.sessionId;
 	const signedIn = userId !== null;
-	const has = (0, react.useCallback)((params) => signedIn && params.role === void 0 && params.permission === void 0, [signedIn]);
+	const organization = initial === null ? session === null ? null : state.organization : initial.organization;
+	const has = (0, react.useCallback)((params) => (0, _zautha_js.checkAuthorization)(organization, params), [organization]);
 	return {
 		isLoaded: isLoadedStatus(state.status) || initial !== null,
 		isSignedIn: signedIn,
 		userId,
 		sessionId,
+		orgId: organization?.id ?? null,
+		orgRole: organization?.role ?? null,
+		orgSlug: organization?.slug ?? null,
+		orgPermissions: organization?.permissions ?? null,
 		getToken,
 		signOut,
 		has

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["createContext","useState","Zautha","useMemo","useContext","useSyncExternalStore","useCallback","useRef","withReverification","useSyncExternalStore","Children","isValidElement","cloneElement","useRef"],"sources":["../src/provider.tsx","../src/hooks.ts","../src/control.tsx","../src/buttons.tsx","../src/prebuilt.tsx"],"sourcesContent":["import { Zautha, type ZauthaOptions, type ZauthaState } from \"@zautha/js\";\nimport { createContext, useContext, useEffect, useMemo, useState, useSyncExternalStore, type ReactNode } from \"react\";\n\ninterface ZauthaContextValue {\n  readonly zautha: Zautha | null;\n  /** The snapshot before the instance exists and during server rendering (carries `initialState`). */\n  readonly pending: ZauthaState;\n}\n\nconst ZauthaContext = createContext<ZauthaContextValue | undefined>(undefined);\n\nexport interface ZauthaProviderProps extends Omit<ZauthaOptions, \"fetch\"> {\n  publishableKey: string;\n  children?: ReactNode;\n}\n\n/**\n * Creates the Zautha instance after mount (never during render, so StrictMode's double mount and SSR\n * create no timers or channels), loads it, and disposes it on unmount. Until then hooks report\n * `isLoaded: false`, unless `initialState` (the server's view, e.g. from @zautha/nextjs) says who is signed in.\n */\nexport function ZauthaProvider({ publishableKey, children, ...options }: ZauthaProviderProps): ReactNode {\n  const [zautha, setZautha] = useState<Zautha | null>(null);\n  const { ui, appearance, localization, signInUrl, signUpUrl, navigate, initialState } = options;\n  const [pending] = useState<ZauthaState>(() => ({ ...NO_STATE, initialState: initialState ?? null }));\n\n  useEffect(() => {\n    const instance = new Zautha(publishableKey, {\n      ...(ui === undefined ? {} : { ui }),\n      ...(appearance === undefined ? {} : { appearance }),\n      ...(localization === undefined ? {} : { localization }),\n      ...(signInUrl === undefined ? {} : { signInUrl }),\n      ...(signUpUrl === undefined ? {} : { signUpUrl }),\n      ...(navigate === undefined ? {} : { navigate }),\n      ...(initialState === undefined ? {} : { initialState }),\n    });\n    // The instance is an external system: it is created here, never during render, and published through state.\n    // eslint-disable-next-line react-hooks/set-state-in-effect\n    setZautha(instance);\n    void instance.load();\n    return () => {\n      instance.dispose();\n      setZautha(null);\n    };\n    // Appearance/localization objects are read at mount; changing the key re-creates the instance.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [publishableKey]);\n\n  const value = useMemo(() => ({ zautha, pending }), [zautha, pending]);\n  return <ZauthaContext.Provider value={value}>{children}</ZauthaContext.Provider>;\n}\n\n/** The Zautha instance, or null before the provider has created it. */\nexport function useZautha(): Zautha | null {\n  return useZauthaContext().zautha;\n}\n\nfunction useZauthaContext(): ZauthaContextValue {\n  const value = useContext(ZauthaContext);\n  if (value === undefined) throw new Error(\"Zautha hooks and components must be used inside <ZauthaProvider>.\");\n  return value;\n}\n\nconst NO_STATE: ZauthaState = {\n  status: \"loading\",\n  environment: null,\n  client: null,\n  session: null,\n  user: null,\n  initialState: null,\n};\nconst noop = (): (() => void) => () => undefined;\n\n/** Reactive snapshot of the instance state (the loading state, with any initial state, before the instance exists). */\nexport function useZauthaState(): ZauthaState {\n  const { zautha, pending } = useZauthaContext();\n  return useSyncExternalStore(\n    zautha?.subscribe ?? noop,\n    () => zautha?.getSnapshot() ?? pending,\n    () => pending,\n  );\n}\n","import {\n  withReverification,\n  type AttemptErrors,\n  type FetchStatus,\n  type Session,\n  type SignInResource,\n  type SignUpResource,\n  type UserResource,\n  type ZauthaState,\n} from \"@zautha/js\";\nimport { useCallback, useLayoutEffect, useRef, useSyncExternalStore } from \"react\";\nimport { useZautha, useZauthaState } from \"./provider\";\n\n/** Authorization check. In 3a there are no organization claims yet, so role/permission checks are false. */\nexport type HasParams = { role?: string; permission?: string };\nexport type Has = (params: HasParams) => boolean;\n\nexport interface UseAuthResult {\n  isLoaded: boolean;\n  isSignedIn: boolean;\n  userId: string | null;\n  sessionId: string | null;\n  getToken: (options?: { skipCache?: boolean }) => Promise<string | null>;\n  signOut: (options?: { redirectUrl?: string }) => Promise<void>;\n  has: Has;\n}\n\nconst isLoadedStatus = (status: string): boolean => status === \"ready\" || status === \"degraded\";\n\n/** The signed-in session: a pending one (tasks left, e.g. setting up two-step verification) counts as signed out. */\nconst activeSession = (state: ZauthaState): Session | null =>\n  state.session?.status === \"active\" ? state.session : null;\n\nexport function useAuth(): UseAuthResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const getToken = useCallback(\n    (options?: { skipCache?: boolean }) => zautha?.getToken(options) ?? Promise.resolve(null),\n    [zautha],\n  );\n  const signOut = useCallback(\n    (options?: { redirectUrl?: string }) => zautha?.signOut(options) ?? Promise.resolve(),\n    [zautha],\n  );\n  // Until the first load settles, the server's initial state (if any) answers, so nothing flickers.\n  const initial = state.status === \"loading\" ? state.initialState : null;\n  const session = activeSession(state);\n  const userId = initial === null ? (session?.userId ?? null) : initial.userId;\n  const sessionId = initial === null ? (session?.id ?? null) : initial.sessionId;\n  const signedIn = userId !== null;\n  const has = useCallback<Has>(\n    (params) => signedIn && params.role === undefined && params.permission === undefined,\n    [signedIn],\n  );\n  return {\n    isLoaded: isLoadedStatus(state.status) || initial !== null,\n    isSignedIn: signedIn,\n    userId,\n    sessionId,\n    getToken,\n    signOut,\n    has,\n  };\n}\n\n/** The signed-in user with its self-service actions (`user.update`, `user.createEmailAddress`, …). */\nexport function useUser(): { isLoaded: boolean; isSignedIn: boolean; user: UserResource | null } {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const signedIn = activeSession(state) !== null;\n  // zautha.user is rebuilt only when state.user changes, so the resource is stable between renders.\n  const user = !signedIn || state.user === null ? null : (zautha?.user ?? null);\n  return { isLoaded: isLoadedStatus(state.status), isSignedIn: signedIn, user };\n}\n\n/**\n * Wraps a sensitive action so that it completes after an identity check when it needs one: when `fetcher` throws\n * `ReverificationRequiredError` (e.g. `user.updatePassword`) or resolves to a `Response` with the `403\n * reverification_required` body (your backend with @zautha/backend, @zautha/nextjs or Zautha.AspNetCore), the\n * reverification modal opens and, once the user has verified, `fetcher` runs once more with the same arguments (its\n * token is fresh by then). Closing the modal rejects with `ReverificationCancelledError`. Needs `ui` from @zautha/ui on\n * the provider. The returned function is stable; it always calls the latest `fetcher`.\n */\nexport function useReverification<Args extends unknown[], Result>(\n  fetcher: (...args: Args) => Promise<Result>,\n): (...args: Args) => Promise<Result> {\n  const zautha = useZautha();\n  const latest = useRef(fetcher);\n  useLayoutEffect(() => {\n    latest.current = fetcher;\n  });\n  return useCallback(\n    (...args: Args) => {\n      const call = (...callArgs: Args): Promise<Result> => latest.current(...callArgs);\n      // Before the provider has created the instance no modal can open: the action runs as it is.\n      return zautha === null ? call(...args) : withReverification(zautha, call)(...args);\n    },\n    [zautha],\n  );\n}\n\n/** The signed-in session; null while signed out or while the session is pending (tasks left). */\nexport function useSession(): { isLoaded: boolean; isSignedIn: boolean; session: Session | null } {\n  const state = useZauthaState();\n  const session = activeSession(state);\n  return { isLoaded: isLoadedStatus(state.status), isSignedIn: session !== null, session };\n}\n\nconst noopSubscribe = (): (() => void) => () => undefined;\n\nfunction useResource<T extends SignInResource | SignUpResource>(resource: T | null) {\n  const snapshot = useSyncExternalStore(\n    resource?.subscribe ?? noopSubscribe,\n    () => resource?.snapshot ?? null,\n    () => null,\n  );\n  return snapshot;\n}\n\nexport interface UseSignInResult {\n  isLoaded: boolean;\n  /** The sign-in resource; null until the provider has created the instance. */\n  signIn: SignInResource | null;\n  errors: AttemptErrors;\n  fetchStatus: FetchStatus;\n}\n\nconst NO_ERRORS: AttemptErrors = { fields: {}, global: [] };\n\nexport function useSignIn(): UseSignInResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const snapshot = useResource(zautha?.signIn ?? null);\n  return {\n    isLoaded: isLoadedStatus(state.status),\n    signIn: zautha?.signIn ?? null,\n    errors: snapshot?.errors ?? NO_ERRORS,\n    fetchStatus: snapshot?.fetchStatus ?? \"idle\",\n  };\n}\n\nexport interface UseSignUpResult {\n  isLoaded: boolean;\n  signUp: SignUpResource | null;\n  errors: AttemptErrors;\n  fetchStatus: FetchStatus;\n}\n\nexport function useSignUp(): UseSignUpResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const snapshot = useResource(zautha?.signUp ?? null);\n  return {\n    isLoaded: isLoadedStatus(state.status),\n    signUp: zautha?.signUp ?? null,\n    errors: snapshot?.errors ?? NO_ERRORS,\n    fetchStatus: snapshot?.fetchStatus ?? \"idle\",\n  };\n}\n","import { useEffect, type ReactNode } from \"react\";\nimport { useAuth, type Has, type HasParams } from \"./hooks\";\nimport { useZautha, useZauthaState } from \"./provider\";\n\nexport type ShowWhen = \"signed-in\" | \"signed-out\" | HasParams | ((has: Has) => boolean);\n\n/**\n * Renders `children` when the condition holds, else `fallback`. Renders nothing until Zautha has\n * loaded, so a signed-in user never sees a signed-out flash.\n */\nexport function Show(props: { when: ShowWhen; fallback?: ReactNode; children?: ReactNode }): ReactNode {\n  const { isLoaded, isSignedIn, has } = useAuth();\n  if (!isLoaded) return null;\n  const { when } = props;\n  const pass =\n    when === \"signed-in\"\n      ? isSignedIn\n      : when === \"signed-out\"\n        ? !isSignedIn\n        : typeof when === \"function\"\n          ? when(has)\n          : has(when);\n  return pass ? props.children : (props.fallback ?? null);\n}\n\nexport function ZauthaLoading(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"loading\" ? props.children : null;\n}\n\n/** Loaded, including degraded (network trouble after load: last known state is shown). */\nexport function ZauthaLoaded(props: { children?: ReactNode }): ReactNode {\n  const { status } = useZauthaState();\n  return status === \"ready\" || status === \"degraded\" ? props.children : null;\n}\n\nexport function ZauthaDegraded(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"degraded\" ? props.children : null;\n}\n\nexport function ZauthaFailed(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"failed\" ? props.children : null;\n}\n\n/** Sends a signed-out visitor to sign-in once loaded; renders nothing. */\nexport function RedirectToSignIn(props: { redirectUrl?: string }): ReactNode {\n  const zautha = useZautha();\n  const { isLoaded, isSignedIn } = useAuth();\n  const { redirectUrl } = props;\n  useEffect(() => {\n    if (zautha !== null && isLoaded && !isSignedIn)\n      zautha.redirectToSignIn(redirectUrl === undefined ? {} : { redirectUrl });\n  }, [zautha, isLoaded, isSignedIn, redirectUrl]);\n  return null;\n}\n\nexport function RedirectToSignUp(props: { redirectUrl?: string }): ReactNode {\n  const zautha = useZautha();\n  const { isLoaded, isSignedIn } = useAuth();\n  const { redirectUrl } = props;\n  useEffect(() => {\n    if (zautha !== null && isLoaded && !isSignedIn)\n      zautha.redirectToSignUp(redirectUrl === undefined ? {} : { redirectUrl });\n  }, [zautha, isLoaded, isSignedIn, redirectUrl]);\n  return null;\n}\n","import { Children, cloneElement, isValidElement, type MouseEvent, type ReactElement, type ReactNode } from \"react\";\nimport { useZautha } from \"./provider\";\n\ninterface ButtonProps {\n  /** `redirect` (default) goes to the sign-in page; `modal` opens the prebuilt component (needs `ui`). */\n  mode?: \"redirect\" | \"modal\";\n  redirectUrl?: string;\n  children?: ReactNode;\n}\n\n/** Wraps its single child (or renders a plain button) and wires the click. Unstyled by design. */\nfunction Trigger(props: { children: ReactNode; label: string; onClick: () => void }): ReactNode {\n  const child = Children.count(props.children) === 1 ? Children.only(props.children) : null;\n  if (isValidElement<{ onClick?: (event: MouseEvent) => void }>(child)) {\n    const original = child.props.onClick;\n    return cloneElement(child as ReactElement<{ onClick?: (event: MouseEvent) => void }>, {\n      onClick: (event: MouseEvent) => {\n        original?.(event);\n        if (!event.defaultPrevented) props.onClick();\n      },\n    });\n  }\n  return (\n    <button type=\"button\" onClick={props.onClick}>\n      {props.children ?? props.label}\n    </button>\n  );\n}\n\nexport function SignInButton(props: ButtonProps): ReactNode {\n  const zautha = useZautha();\n  const options = props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl };\n  return (\n    <Trigger\n      label=\"Sign in\"\n      onClick={() => (props.mode === \"modal\" ? zautha?.openSignIn(options) : zautha?.redirectToSignIn(options))}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n\nexport function SignUpButton(props: ButtonProps): ReactNode {\n  const zautha = useZautha();\n  const options = props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl };\n  return (\n    <Trigger\n      label=\"Sign up\"\n      onClick={() => (props.mode === \"modal\" ? zautha?.openSignUp(options) : zautha?.redirectToSignUp(options))}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n\nexport function SignOutButton(props: { redirectUrl?: string; children?: ReactNode }): ReactNode {\n  const zautha = useZautha();\n  return (\n    <Trigger\n      label=\"Sign out\"\n      onClick={() => void zautha?.signOut(props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl })}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n","import type { UiComponentName } from \"@zautha/js\";\nimport { useEffect, useRef, type ReactNode } from \"react\";\nimport { useZautha } from \"./provider\";\n\n/**\n * Mounts a @zautha/ui component into a div once the instance exists; later prop changes update it in\n * place. SSR renders only the empty div.\n */\nfunction Mounted(props: { name: UiComponentName; componentProps: object }): ReactNode {\n  const zautha = useZautha();\n  const ref = useRef<HTMLDivElement>(null);\n  const mountedWith = useRef<object | null>(null);\n  const { name, componentProps } = props;\n\n  useEffect(() => {\n    const element = ref.current;\n    if (zautha === null || element === null) return;\n    zautha.mount(name, element, componentProps);\n    mountedWith.current = componentProps;\n    return () => {\n      mountedWith.current = null;\n      zautha.unmount(element);\n    };\n    // componentProps changes are applied by the effect below without remounting.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [zautha, name]);\n\n  useEffect(() => {\n    const element = ref.current;\n    if (zautha === null || element === null || mountedWith.current === null || mountedWith.current === componentProps)\n      return;\n    mountedWith.current = componentProps;\n    zautha.updateMounted(element, componentProps);\n  }, [zautha, componentProps]);\n\n  return <div ref={ref} />;\n}\n\n// Prop types live in @zautha/ui; they are structural here so @zautha/react has no runtime dependency on it.\nexport function SignIn(props: import(\"@zautha/ui\").SignInProps): ReactNode {\n  return <Mounted name=\"SignIn\" componentProps={props} />;\n}\n\nexport function SignUp(props: import(\"@zautha/ui\").SignUpProps): ReactNode {\n  return <Mounted name=\"SignUp\" componentProps={props} />;\n}\n\n/** The page a provider sends the user back to: finishes the social sign-in or sign-up (see @zautha/ui). */\nexport function AuthenticateWithRedirectCallback(\n  props: import(\"@zautha/ui\").AuthenticateWithRedirectCallbackProps,\n): ReactNode {\n  return <Mounted name=\"AuthenticateWithRedirectCallback\" componentProps={props} />;\n}\n\nexport function UserButton(props: import(\"@zautha/ui\").UserButtonProps): ReactNode {\n  return <Mounted name=\"UserButton\" componentProps={props} />;\n}\n\nexport function UserProfile(props: import(\"@zautha/ui\").UserProfileProps): ReactNode {\n  return <Mounted name=\"UserProfile\" componentProps={props} />;\n}\n\nexport function OAuthConsent(props: import(\"@zautha/ui\").OAuthConsentProps): ReactNode {\n  return <Mounted name=\"OAuthConsent\" componentProps={props} />;\n}\n"],"mappings":";;;;;;AASA,MAAM,iBAAA,GAAgBA,MAAAA,cAAAA,CAA8C,KAAA,CAAS;;;;;;AAY7E,SAAgB,eAAe,EAAE,gBAAgB,UAAU,GAAG,WAA2C;CACvG,MAAM,CAAC,QAAQ,cAAA,GAAaC,MAAAA,SAAAA,CAAwB,IAAI;CACxD,MAAM,EAAE,IAAI,YAAY,cAAc,WAAW,WAAW,UAAU,iBAAiB;CACvF,MAAM,CAAC,YAAA,GAAWA,MAAAA,SAAAA,QAA6B;EAAE,GAAG;EAAU,cAAc,gBAAgB;CAAK,EAAE;CAEnG,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,MAAM,WAAW,IAAIC,WAAAA,OAAO,gBAAgB;GAC1C,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GACjC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;GACrD,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;GAC/C,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;GAC/C,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS;GAC7C,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;EAGD,UAAU,QAAQ;EAClB,SAAc,KAAK;EACnB,aAAa;GACX,SAAS,QAAQ;GACjB,UAAU,IAAI;EAChB;CAGF,GAAG,CAAC,cAAc,CAAC;CAEnB,MAAM,SAAA,GAAQC,MAAAA,QAAAA,QAAe;EAAE;EAAQ;CAAQ,IAAI,CAAC,QAAQ,OAAO,CAAC;CACpE,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,cAAc,UAAf;EAA+B;EAAQ;CAAiC,CAAA;AACjF;;AAGA,SAAgB,YAA2B;CACzC,OAAO,iBAAiB,CAAC,CAAC;AAC5B;AAEA,SAAS,mBAAuC;CAC9C,MAAM,SAAA,GAAQC,MAAAA,WAAAA,CAAW,aAAa;CACtC,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,mEAAmE;CAC5G,OAAO;AACT;AAEA,MAAM,WAAwB;CAC5B,QAAQ;CACR,aAAa;CACb,QAAQ;CACR,SAAS;CACT,MAAM;CACN,cAAc;AAChB;AACA,MAAM,mBAAiC,KAAA;;AAGvC,SAAgB,iBAA8B;CAC5C,MAAM,EAAE,QAAQ,YAAY,iBAAiB;CAC7C,QAAA,GAAOC,MAAAA,qBAAAA,CACL,QAAQ,aAAa,YACf,QAAQ,YAAY,KAAK,eACzB,OACR;AACF;;;ACtDA,MAAM,kBAAkB,WAA4B,WAAW,WAAW,WAAW;;AAGrF,MAAM,iBAAiB,UACrB,MAAM,SAAS,WAAW,WAAW,MAAM,UAAU;AAEvD,SAAgB,UAAyB;CACvC,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,YAAA,GAAWC,MAAAA,YAAAA,EACd,YAAsC,QAAQ,SAAS,OAAO,KAAK,QAAQ,QAAQ,IAAI,GACxF,CAAC,MAAM,CACT;CACA,MAAM,WAAA,GAAUA,MAAAA,YAAAA,EACb,YAAuC,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,GACpF,CAAC,MAAM,CACT;CAEA,MAAM,UAAU,MAAM,WAAW,YAAY,MAAM,eAAe;CAClE,MAAM,UAAU,cAAc,KAAK;CACnC,MAAM,SAAS,YAAY,OAAQ,SAAS,UAAU,OAAQ,QAAQ;CACtE,MAAM,YAAY,YAAY,OAAQ,SAAS,MAAM,OAAQ,QAAQ;CACrE,MAAM,WAAW,WAAW;CAC5B,MAAM,OAAA,GAAMA,MAAAA,YAAAA,EACT,WAAW,YAAY,OAAO,SAAS,KAAA,KAAa,OAAO,eAAe,KAAA,GAC3E,CAAC,QAAQ,CACX;CACA,OAAO;EACL,UAAU,eAAe,MAAM,MAAM,KAAK,YAAY;EACtD,YAAY;EACZ;EACA;EACA;EACA;EACA;CACF;AACF;;AAGA,SAAgB,UAAiF;CAC/F,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,cAAc,KAAK,MAAM;CAE1C,MAAM,OAAO,CAAC,YAAY,MAAM,SAAS,OAAO,OAAQ,QAAQ,QAAQ;CACxE,OAAO;EAAE,UAAU,eAAe,MAAM,MAAM;EAAG,YAAY;EAAU;CAAK;AAC9E;;;;;;;;;AAUA,SAAgB,kBACd,SACoC;CACpC,MAAM,SAAS,UAAU;CACzB,MAAM,UAAA,GAASC,MAAAA,OAAAA,CAAO,OAAO;CAC7B,CAAA,GAAA,MAAA,gBAAA,OAAsB;EACpB,OAAO,UAAU;CACnB,CAAC;CACD,QAAA,GAAOD,MAAAA,YAAAA,EACJ,GAAG,SAAe;EACjB,MAAM,QAAQ,GAAG,aAAoC,OAAO,QAAQ,GAAG,QAAQ;EAE/E,OAAO,WAAW,OAAO,KAAK,GAAG,IAAI,KAAA,GAAIE,WAAAA,mBAAAA,CAAmB,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI;CACnF,GACA,CAAC,MAAM,CACT;AACF;;AAGA,SAAgB,aAAkF;CAChG,MAAM,QAAQ,eAAe;CAC7B,MAAM,UAAU,cAAc,KAAK;CACnC,OAAO;EAAE,UAAU,eAAe,MAAM,MAAM;EAAG,YAAY,YAAY;EAAM;CAAQ;AACzF;AAEA,MAAM,4BAA0C,KAAA;AAEhD,SAAS,YAAuD,UAAoB;CAMlF,QAAA,GALiBC,MAAAA,qBAAAA,CACf,UAAU,aAAa,qBACjB,UAAU,YAAY,YACtB,IAEM;AAChB;AAUA,MAAM,YAA2B;CAAE,QAAQ,CAAC;CAAG,QAAQ,CAAC;AAAE;AAE1D,SAAgB,YAA6B;CAC3C,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,YAAY,QAAQ,UAAU,IAAI;CACnD,OAAO;EACL,UAAU,eAAe,MAAM,MAAM;EACrC,QAAQ,QAAQ,UAAU;EAC1B,QAAQ,UAAU,UAAU;EAC5B,aAAa,UAAU,eAAe;CACxC;AACF;AASA,SAAgB,YAA6B;CAC3C,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,YAAY,QAAQ,UAAU,IAAI;CACnD,OAAO;EACL,UAAU,eAAe,MAAM,MAAM;EACrC,QAAQ,QAAQ,UAAU;EAC1B,QAAQ,UAAU,UAAU;EAC5B,aAAa,UAAU,eAAe;CACxC;AACF;;;;;;;ACpJA,SAAgB,KAAK,OAAkF;CACrG,MAAM,EAAE,UAAU,YAAY,QAAQ,QAAQ;CAC9C,IAAI,CAAC,UAAU,OAAO;CACtB,MAAM,EAAE,SAAS;CASjB,QAPE,SAAS,cACL,aACA,SAAS,eACP,CAAC,aACD,OAAO,SAAS,aACd,KAAK,GAAG,IACR,IAAI,IAAI,KACJ,MAAM,WAAY,MAAM,YAAY;AACpD;AAEA,SAAgB,cAAc,OAA4C;CACxE,OAAO,eAAe,CAAC,CAAC,WAAW,YAAY,MAAM,WAAW;AAClE;;AAGA,SAAgB,aAAa,OAA4C;CACvE,MAAM,EAAE,WAAW,eAAe;CAClC,OAAO,WAAW,WAAW,WAAW,aAAa,MAAM,WAAW;AACxE;AAEA,SAAgB,eAAe,OAA4C;CACzE,OAAO,eAAe,CAAC,CAAC,WAAW,aAAa,MAAM,WAAW;AACnE;AAEA,SAAgB,aAAa,OAA4C;CACvE,OAAO,eAAe,CAAC,CAAC,WAAW,WAAW,MAAM,WAAW;AACjE;;AAGA,SAAgB,iBAAiB,OAA4C;CAC3E,MAAM,SAAS,UAAU;CACzB,MAAM,EAAE,UAAU,eAAe,QAAQ;CACzC,MAAM,EAAE,gBAAgB;CACxB,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,IAAI,WAAW,QAAQ,YAAY,CAAC,YAClC,OAAO,iBAAiB,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,CAAC;CAC5E,GAAG;EAAC;EAAQ;EAAU;EAAY;CAAW,CAAC;CAC9C,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAA4C;CAC3E,MAAM,SAAS,UAAU;CACzB,MAAM,EAAE,UAAU,eAAe,QAAQ;CACzC,MAAM,EAAE,gBAAgB;CACxB,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,IAAI,WAAW,QAAQ,YAAY,CAAC,YAClC,OAAO,iBAAiB,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,CAAC;CAC5E,GAAG;EAAC;EAAQ;EAAU;EAAY;CAAW,CAAC;CAC9C,OAAO;AACT;;;;ACrDA,SAAS,QAAQ,OAA+E;CAC9F,MAAM,QAAQC,MAAAA,SAAS,MAAM,MAAM,QAAQ,MAAM,IAAIA,MAAAA,SAAS,KAAK,MAAM,QAAQ,IAAI;CACrF,KAAA,GAAIC,MAAAA,eAAAA,CAA0D,KAAK,GAAG;EACpE,MAAM,WAAW,MAAM,MAAM;EAC7B,QAAA,GAAOC,MAAAA,aAAAA,CAAa,OAAkE,EACpF,UAAU,UAAsB;GAC9B,WAAW,KAAK;GAChB,IAAI,CAAC,MAAM,kBAAkB,MAAM,QAAQ;EAC7C,EACF,CAAC;CACH;CACA,OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;EAAQ,MAAK;EAAS,SAAS,MAAM;EAClC,UAAA,MAAM,YAAY,MAAM;CACnB,CAAA;AAEZ;AAEA,SAAgB,aAAa,OAA+B;CAC1D,MAAM,SAAS,UAAU;CACzB,MAAM,UAAU,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;CACxF,OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EACE,OAAM;EACN,eAAgB,MAAM,SAAS,UAAU,QAAQ,WAAW,OAAO,IAAI,QAAQ,iBAAiB,OAAO;EAEtG,UAAA,MAAM;CACA,CAAA;AAEb;AAEA,SAAgB,aAAa,OAA+B;CAC1D,MAAM,SAAS,UAAU;CACzB,MAAM,UAAU,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;CACxF,OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EACE,OAAM;EACN,eAAgB,MAAM,SAAS,UAAU,QAAQ,WAAW,OAAO,IAAI,QAAQ,iBAAiB,OAAO;EAEtG,UAAA,MAAM;CACA,CAAA;AAEb;AAEA,SAAgB,cAAc,OAAkE;CAC9F,MAAM,SAAS,UAAU;CACzB,OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EACE,OAAM;EACN,eAAe,KAAK,QAAQ,QAAQ,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY,CAAC;EAE5G,UAAA,MAAM;CACA,CAAA;AAEb;;;;;;;ACzDA,SAAS,QAAQ,OAAqE;CACpF,MAAM,SAAS,UAAU;CACzB,MAAM,OAAA,GAAMC,MAAAA,OAAAA,CAAuB,IAAI;CACvC,MAAM,eAAA,GAAcA,MAAAA,OAAAA,CAAsB,IAAI;CAC9C,MAAM,EAAE,MAAM,mBAAmB;CAEjC,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,MAAM,UAAU,IAAI;EACpB,IAAI,WAAW,QAAQ,YAAY,MAAM;EACzC,OAAO,MAAM,MAAM,SAAS,cAAc;EAC1C,YAAY,UAAU;EACtB,aAAa;GACX,YAAY,UAAU;GACtB,OAAO,QAAQ,OAAO;EACxB;CAGF,GAAG,CAAC,QAAQ,IAAI,CAAC;CAEjB,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,MAAM,UAAU,IAAI;EACpB,IAAI,WAAW,QAAQ,YAAY,QAAQ,YAAY,YAAY,QAAQ,YAAY,YAAY,gBACjG;EACF,YAAY,UAAU;EACtB,OAAO,cAAc,SAAS,cAAc;CAC9C,GAAG,CAAC,QAAQ,cAAc,CAAC;CAE3B,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAU,IAAM,CAAA;AACzB;AAGA,SAAgB,OAAO,OAAoD;CACzE,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAS,gBAAgB;CAAQ,CAAA;AACxD;AAEA,SAAgB,OAAO,OAAoD;CACzE,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAS,gBAAgB;CAAQ,CAAA;AACxD;;AAGA,SAAgB,iCACd,OACW;CACX,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAmC,gBAAgB;CAAQ,CAAA;AAClF;AAEA,SAAgB,WAAW,OAAwD;CACjF,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAa,gBAAgB;CAAQ,CAAA;AAC5D;AAEA,SAAgB,YAAY,OAAyD;CACnF,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAc,gBAAgB;CAAQ,CAAA;AAC7D;AAEA,SAAgB,aAAa,OAA0D;CACrF,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAe,gBAAgB;CAAQ,CAAA;AAC9D"}
+{"version":3,"file":"index.cjs","names":["createContext","useState","Zautha","useMemo","useContext","useSyncExternalStore","useCallback","checkAuthorization","useRef","withReverification","useSyncExternalStore","Children","isValidElement","cloneElement","useRef"],"sources":["../src/provider.tsx","../src/hooks.ts","../src/control.tsx","../src/buttons.tsx","../src/prebuilt.tsx"],"sourcesContent":["import { Zautha, type ZauthaOptions, type ZauthaState } from \"@zautha/js\";\nimport { createContext, useContext, useEffect, useMemo, useState, useSyncExternalStore, type ReactNode } from \"react\";\n\ninterface ZauthaContextValue {\n  readonly zautha: Zautha | null;\n  /** The snapshot before the instance exists and during server rendering (carries `initialState`). */\n  readonly pending: ZauthaState;\n}\n\nconst ZauthaContext = createContext<ZauthaContextValue | undefined>(undefined);\n\nexport interface ZauthaProviderProps extends Omit<ZauthaOptions, \"fetch\"> {\n  publishableKey: string;\n  children?: ReactNode;\n}\n\n/**\n * Creates the Zautha instance after mount (never during render, so StrictMode's double mount and SSR\n * create no timers or channels), loads it, and disposes it on unmount. Until then hooks report\n * `isLoaded: false`, unless `initialState` (the server's view, e.g. from @zautha/nextjs) says who is signed in.\n */\nexport function ZauthaProvider({ publishableKey, children, ...options }: ZauthaProviderProps): ReactNode {\n  const [zautha, setZautha] = useState<Zautha | null>(null);\n  const { ui, appearance, localization, signInUrl, signUpUrl, navigate, initialState } = options;\n  const [pending] = useState<ZauthaState>(() => ({ ...NO_STATE, initialState: initialState ?? null }));\n\n  useEffect(() => {\n    const instance = new Zautha(publishableKey, {\n      ...(ui === undefined ? {} : { ui }),\n      ...(appearance === undefined ? {} : { appearance }),\n      ...(localization === undefined ? {} : { localization }),\n      ...(signInUrl === undefined ? {} : { signInUrl }),\n      ...(signUpUrl === undefined ? {} : { signUpUrl }),\n      ...(navigate === undefined ? {} : { navigate }),\n      ...(initialState === undefined ? {} : { initialState }),\n    });\n    // The instance is an external system: it is created here, never during render, and published through state.\n    // eslint-disable-next-line react-hooks/set-state-in-effect\n    setZautha(instance);\n    void instance.load();\n    return () => {\n      instance.dispose();\n      setZautha(null);\n    };\n    // Appearance/localization objects are read at mount; changing the key re-creates the instance.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [publishableKey]);\n\n  const value = useMemo(() => ({ zautha, pending }), [zautha, pending]);\n  return <ZauthaContext.Provider value={value}>{children}</ZauthaContext.Provider>;\n}\n\n/** The Zautha instance, or null before the provider has created it. */\nexport function useZautha(): Zautha | null {\n  return useZauthaContext().zautha;\n}\n\nfunction useZauthaContext(): ZauthaContextValue {\n  const value = useContext(ZauthaContext);\n  if (value === undefined) throw new Error(\"Zautha hooks and components must be used inside <ZauthaProvider>.\");\n  return value;\n}\n\nconst NO_STATE: ZauthaState = {\n  status: \"loading\",\n  environment: null,\n  client: null,\n  session: null,\n  user: null,\n  organization: null,\n  initialState: null,\n};\nconst noop = (): (() => void) => () => undefined;\n\n/** Reactive snapshot of the instance state (the loading state, with any initial state, before the instance exists). */\nexport function useZauthaState(): ZauthaState {\n  const { zautha, pending } = useZauthaContext();\n  return useSyncExternalStore(\n    zautha?.subscribe ?? noop,\n    () => zautha?.getSnapshot() ?? pending,\n    () => pending,\n  );\n}\n","import {\n  checkAuthorization,\n  withReverification,\n  type AttemptErrors,\n  type FetchStatus,\n  type Session,\n  type SignInResource,\n  type SignUpResource,\n  type UserResource,\n  type ZauthaState,\n} from \"@zautha/js\";\nimport { useCallback, useLayoutEffect, useRef, useSyncExternalStore } from \"react\";\nimport { useZautha, useZauthaState } from \"./provider\";\n\n/**\n * What `has` checks in the session's active organization: full keys (`org:admin`, `org:invoices:read`). Every condition\n * given must hold; with none, false.\n */\nexport type HasParams = { role?: string; permission?: string };\nexport type Has = (params: HasParams) => boolean;\n\nexport interface UseAuthResult {\n  isLoaded: boolean;\n  isSignedIn: boolean;\n  userId: string | null;\n  sessionId: string | null;\n  /** The active organization (`org_…`); null without one, and while signed out. */\n  orgId: string | null;\n  /** The user's role in it, a full key such as `org:admin`. */\n  orgRole: string | null;\n  /** Its slug; null without one or while the instance has slugs off. */\n  orgSlug: string | null;\n  /** The role's custom permissions, full keys such as `org:invoices:read`. */\n  orgPermissions: readonly string[] | null;\n  getToken: (options?: { skipCache?: boolean }) => Promise<string | null>;\n  signOut: (options?: { redirectUrl?: string }) => Promise<void>;\n  /**\n   * From the session token alone, the same rule as every Zautha SDK and your server: false without an active\n   * organization, and always false for a system permission (`org:sys_…`, never in the token).\n   */\n  has: Has;\n}\n\nconst isLoadedStatus = (status: string): boolean => status === \"ready\" || status === \"degraded\";\n\n/** The signed-in session: a pending one (tasks left, e.g. setting up two-step verification) counts as signed out. */\nconst activeSession = (state: ZauthaState): Session | null =>\n  state.session?.status === \"active\" ? state.session : null;\n\nexport function useAuth(): UseAuthResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const getToken = useCallback(\n    (options?: { skipCache?: boolean }) => zautha?.getToken(options) ?? Promise.resolve(null),\n    [zautha],\n  );\n  const signOut = useCallback(\n    (options?: { redirectUrl?: string }) => zautha?.signOut(options) ?? Promise.resolve(),\n    [zautha],\n  );\n  // Until the first load settles, the server's initial state (if any) answers, so nothing flickers.\n  const initial = state.status === \"loading\" ? state.initialState : null;\n  const session = activeSession(state);\n  const userId = initial === null ? (session?.userId ?? null) : initial.userId;\n  const sessionId = initial === null ? (session?.id ?? null) : initial.sessionId;\n  const signedIn = userId !== null;\n  const organization = initial === null ? (session === null ? null : state.organization) : initial.organization;\n  const has = useCallback<Has>((params) => checkAuthorization(organization, params), [organization]);\n  return {\n    isLoaded: isLoadedStatus(state.status) || initial !== null,\n    isSignedIn: signedIn,\n    userId,\n    sessionId,\n    orgId: organization?.id ?? null,\n    orgRole: organization?.role ?? null,\n    orgSlug: organization?.slug ?? null,\n    orgPermissions: organization?.permissions ?? null,\n    getToken,\n    signOut,\n    has,\n  };\n}\n\n/** The signed-in user with its self-service actions (`user.update`, `user.createEmailAddress`, …). */\nexport function useUser(): { isLoaded: boolean; isSignedIn: boolean; user: UserResource | null } {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const signedIn = activeSession(state) !== null;\n  // zautha.user is rebuilt only when state.user changes, so the resource is stable between renders.\n  const user = !signedIn || state.user === null ? null : (zautha?.user ?? null);\n  return { isLoaded: isLoadedStatus(state.status), isSignedIn: signedIn, user };\n}\n\n/**\n * Wraps a sensitive action so that it completes after an identity check when it needs one: when `fetcher` throws\n * `ReverificationRequiredError` (e.g. `user.updatePassword`) or resolves to a `Response` with the `403\n * reverification_required` body (your backend with @zautha/backend, @zautha/nextjs or Zautha.AspNetCore), the\n * reverification modal opens and, once the user has verified, `fetcher` runs once more with the same arguments (its\n * token is fresh by then). Closing the modal rejects with `ReverificationCancelledError`. Needs `ui` from @zautha/ui on\n * the provider. The returned function is stable; it always calls the latest `fetcher`.\n */\nexport function useReverification<Args extends unknown[], Result>(\n  fetcher: (...args: Args) => Promise<Result>,\n): (...args: Args) => Promise<Result> {\n  const zautha = useZautha();\n  const latest = useRef(fetcher);\n  useLayoutEffect(() => {\n    latest.current = fetcher;\n  });\n  return useCallback(\n    (...args: Args) => {\n      const call = (...callArgs: Args): Promise<Result> => latest.current(...callArgs);\n      // Before the provider has created the instance no modal can open: the action runs as it is.\n      return zautha === null ? call(...args) : withReverification(zautha, call)(...args);\n    },\n    [zautha],\n  );\n}\n\n/** The signed-in session; null while signed out or while the session is pending (tasks left). */\nexport function useSession(): { isLoaded: boolean; isSignedIn: boolean; session: Session | null } {\n  const state = useZauthaState();\n  const session = activeSession(state);\n  return { isLoaded: isLoadedStatus(state.status), isSignedIn: session !== null, session };\n}\n\nconst noopSubscribe = (): (() => void) => () => undefined;\n\nfunction useResource<T extends SignInResource | SignUpResource>(resource: T | null) {\n  const snapshot = useSyncExternalStore(\n    resource?.subscribe ?? noopSubscribe,\n    () => resource?.snapshot ?? null,\n    () => null,\n  );\n  return snapshot;\n}\n\nexport interface UseSignInResult {\n  isLoaded: boolean;\n  /** The sign-in resource; null until the provider has created the instance. */\n  signIn: SignInResource | null;\n  errors: AttemptErrors;\n  fetchStatus: FetchStatus;\n}\n\nconst NO_ERRORS: AttemptErrors = { fields: {}, global: [] };\n\nexport function useSignIn(): UseSignInResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const snapshot = useResource(zautha?.signIn ?? null);\n  return {\n    isLoaded: isLoadedStatus(state.status),\n    signIn: zautha?.signIn ?? null,\n    errors: snapshot?.errors ?? NO_ERRORS,\n    fetchStatus: snapshot?.fetchStatus ?? \"idle\",\n  };\n}\n\nexport interface UseSignUpResult {\n  isLoaded: boolean;\n  signUp: SignUpResource | null;\n  errors: AttemptErrors;\n  fetchStatus: FetchStatus;\n}\n\nexport function useSignUp(): UseSignUpResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const snapshot = useResource(zautha?.signUp ?? null);\n  return {\n    isLoaded: isLoadedStatus(state.status),\n    signUp: zautha?.signUp ?? null,\n    errors: snapshot?.errors ?? NO_ERRORS,\n    fetchStatus: snapshot?.fetchStatus ?? \"idle\",\n  };\n}\n","import { useEffect, type ReactNode } from \"react\";\nimport { useAuth, type Has, type HasParams } from \"./hooks\";\nimport { useZautha, useZauthaState } from \"./provider\";\n\nexport type ShowWhen = \"signed-in\" | \"signed-out\" | HasParams | ((has: Has) => boolean);\n\n/**\n * Renders `children` when the condition holds, else `fallback`. Renders nothing until Zautha has\n * loaded, so a signed-in user never sees a signed-out flash.\n */\nexport function Show(props: { when: ShowWhen; fallback?: ReactNode; children?: ReactNode }): ReactNode {\n  const { isLoaded, isSignedIn, has } = useAuth();\n  if (!isLoaded) return null;\n  const { when } = props;\n  const pass =\n    when === \"signed-in\"\n      ? isSignedIn\n      : when === \"signed-out\"\n        ? !isSignedIn\n        : typeof when === \"function\"\n          ? when(has)\n          : has(when);\n  return pass ? props.children : (props.fallback ?? null);\n}\n\nexport function ZauthaLoading(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"loading\" ? props.children : null;\n}\n\n/** Loaded, including degraded (network trouble after load: last known state is shown). */\nexport function ZauthaLoaded(props: { children?: ReactNode }): ReactNode {\n  const { status } = useZauthaState();\n  return status === \"ready\" || status === \"degraded\" ? props.children : null;\n}\n\nexport function ZauthaDegraded(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"degraded\" ? props.children : null;\n}\n\nexport function ZauthaFailed(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"failed\" ? props.children : null;\n}\n\n/** Sends a signed-out visitor to sign-in once loaded; renders nothing. */\nexport function RedirectToSignIn(props: { redirectUrl?: string }): ReactNode {\n  const zautha = useZautha();\n  const { isLoaded, isSignedIn } = useAuth();\n  const { redirectUrl } = props;\n  useEffect(() => {\n    if (zautha !== null && isLoaded && !isSignedIn)\n      zautha.redirectToSignIn(redirectUrl === undefined ? {} : { redirectUrl });\n  }, [zautha, isLoaded, isSignedIn, redirectUrl]);\n  return null;\n}\n\nexport function RedirectToSignUp(props: { redirectUrl?: string }): ReactNode {\n  const zautha = useZautha();\n  const { isLoaded, isSignedIn } = useAuth();\n  const { redirectUrl } = props;\n  useEffect(() => {\n    if (zautha !== null && isLoaded && !isSignedIn)\n      zautha.redirectToSignUp(redirectUrl === undefined ? {} : { redirectUrl });\n  }, [zautha, isLoaded, isSignedIn, redirectUrl]);\n  return null;\n}\n","import { Children, cloneElement, isValidElement, type MouseEvent, type ReactElement, type ReactNode } from \"react\";\nimport { useZautha } from \"./provider\";\n\ninterface ButtonProps {\n  /** `redirect` (default) goes to the sign-in page; `modal` opens the prebuilt component (needs `ui`). */\n  mode?: \"redirect\" | \"modal\";\n  redirectUrl?: string;\n  children?: ReactNode;\n}\n\n/** Wraps its single child (or renders a plain button) and wires the click. Unstyled by design. */\nfunction Trigger(props: { children: ReactNode; label: string; onClick: () => void }): ReactNode {\n  const child = Children.count(props.children) === 1 ? Children.only(props.children) : null;\n  if (isValidElement<{ onClick?: (event: MouseEvent) => void }>(child)) {\n    const original = child.props.onClick;\n    return cloneElement(child as ReactElement<{ onClick?: (event: MouseEvent) => void }>, {\n      onClick: (event: MouseEvent) => {\n        original?.(event);\n        if (!event.defaultPrevented) props.onClick();\n      },\n    });\n  }\n  return (\n    <button type=\"button\" onClick={props.onClick}>\n      {props.children ?? props.label}\n    </button>\n  );\n}\n\nexport function SignInButton(props: ButtonProps): ReactNode {\n  const zautha = useZautha();\n  const options = props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl };\n  return (\n    <Trigger\n      label=\"Sign in\"\n      onClick={() => (props.mode === \"modal\" ? zautha?.openSignIn(options) : zautha?.redirectToSignIn(options))}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n\nexport function SignUpButton(props: ButtonProps): ReactNode {\n  const zautha = useZautha();\n  const options = props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl };\n  return (\n    <Trigger\n      label=\"Sign up\"\n      onClick={() => (props.mode === \"modal\" ? zautha?.openSignUp(options) : zautha?.redirectToSignUp(options))}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n\nexport function SignOutButton(props: { redirectUrl?: string; children?: ReactNode }): ReactNode {\n  const zautha = useZautha();\n  return (\n    <Trigger\n      label=\"Sign out\"\n      onClick={() => void zautha?.signOut(props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl })}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n","import type { UiComponentName } from \"@zautha/js\";\nimport { useEffect, useRef, type ReactNode } from \"react\";\nimport { useZautha } from \"./provider\";\n\n/**\n * Mounts a @zautha/ui component into a div once the instance exists; later prop changes update it in\n * place. SSR renders only the empty div.\n */\nfunction Mounted(props: { name: UiComponentName; componentProps: object }): ReactNode {\n  const zautha = useZautha();\n  const ref = useRef<HTMLDivElement>(null);\n  const mountedWith = useRef<object | null>(null);\n  const { name, componentProps } = props;\n\n  useEffect(() => {\n    const element = ref.current;\n    if (zautha === null || element === null) return;\n    zautha.mount(name, element, componentProps);\n    mountedWith.current = componentProps;\n    return () => {\n      mountedWith.current = null;\n      zautha.unmount(element);\n    };\n    // componentProps changes are applied by the effect below without remounting.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [zautha, name]);\n\n  useEffect(() => {\n    const element = ref.current;\n    if (zautha === null || element === null || mountedWith.current === null || mountedWith.current === componentProps)\n      return;\n    mountedWith.current = componentProps;\n    zautha.updateMounted(element, componentProps);\n  }, [zautha, componentProps]);\n\n  return <div ref={ref} />;\n}\n\n// Prop types live in @zautha/ui; they are structural here so @zautha/react has no runtime dependency on it.\nexport function SignIn(props: import(\"@zautha/ui\").SignInProps): ReactNode {\n  return <Mounted name=\"SignIn\" componentProps={props} />;\n}\n\nexport function SignUp(props: import(\"@zautha/ui\").SignUpProps): ReactNode {\n  return <Mounted name=\"SignUp\" componentProps={props} />;\n}\n\n/** The page a provider sends the user back to: finishes the social sign-in or sign-up (see @zautha/ui). */\nexport function AuthenticateWithRedirectCallback(\n  props: import(\"@zautha/ui\").AuthenticateWithRedirectCallbackProps,\n): ReactNode {\n  return <Mounted name=\"AuthenticateWithRedirectCallback\" componentProps={props} />;\n}\n\nexport function UserButton(props: import(\"@zautha/ui\").UserButtonProps): ReactNode {\n  return <Mounted name=\"UserButton\" componentProps={props} />;\n}\n\nexport function UserProfile(props: import(\"@zautha/ui\").UserProfileProps): ReactNode {\n  return <Mounted name=\"UserProfile\" componentProps={props} />;\n}\n\nexport function OAuthConsent(props: import(\"@zautha/ui\").OAuthConsentProps): ReactNode {\n  return <Mounted name=\"OAuthConsent\" componentProps={props} />;\n}\n"],"mappings":";;;;;;AASA,MAAM,iBAAA,GAAgBA,MAAAA,cAAAA,CAA8C,KAAA,CAAS;;;;;;AAY7E,SAAgB,eAAe,EAAE,gBAAgB,UAAU,GAAG,WAA2C;CACvG,MAAM,CAAC,QAAQ,cAAA,GAAaC,MAAAA,SAAAA,CAAwB,IAAI;CACxD,MAAM,EAAE,IAAI,YAAY,cAAc,WAAW,WAAW,UAAU,iBAAiB;CACvF,MAAM,CAAC,YAAA,GAAWA,MAAAA,SAAAA,QAA6B;EAAE,GAAG;EAAU,cAAc,gBAAgB;CAAK,EAAE;CAEnG,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,MAAM,WAAW,IAAIC,WAAAA,OAAO,gBAAgB;GAC1C,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GACjC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;GACrD,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;GAC/C,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;GAC/C,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS;GAC7C,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;EAGD,UAAU,QAAQ;EAClB,SAAc,KAAK;EACnB,aAAa;GACX,SAAS,QAAQ;GACjB,UAAU,IAAI;EAChB;CAGF,GAAG,CAAC,cAAc,CAAC;CAEnB,MAAM,SAAA,GAAQC,MAAAA,QAAAA,QAAe;EAAE;EAAQ;CAAQ,IAAI,CAAC,QAAQ,OAAO,CAAC;CACpE,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,cAAc,UAAf;EAA+B;EAAQ;CAAiC,CAAA;AACjF;;AAGA,SAAgB,YAA2B;CACzC,OAAO,iBAAiB,CAAC,CAAC;AAC5B;AAEA,SAAS,mBAAuC;CAC9C,MAAM,SAAA,GAAQC,MAAAA,WAAAA,CAAW,aAAa;CACtC,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,mEAAmE;CAC5G,OAAO;AACT;AAEA,MAAM,WAAwB;CAC5B,QAAQ;CACR,aAAa;CACb,QAAQ;CACR,SAAS;CACT,MAAM;CACN,cAAc;CACd,cAAc;AAChB;AACA,MAAM,mBAAiC,KAAA;;AAGvC,SAAgB,iBAA8B;CAC5C,MAAM,EAAE,QAAQ,YAAY,iBAAiB;CAC7C,QAAA,GAAOC,MAAAA,qBAAAA,CACL,QAAQ,aAAa,YACf,QAAQ,YAAY,KAAK,eACzB,OACR;AACF;;;ACvCA,MAAM,kBAAkB,WAA4B,WAAW,WAAW,WAAW;;AAGrF,MAAM,iBAAiB,UACrB,MAAM,SAAS,WAAW,WAAW,MAAM,UAAU;AAEvD,SAAgB,UAAyB;CACvC,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,YAAA,GAAWC,MAAAA,YAAAA,EACd,YAAsC,QAAQ,SAAS,OAAO,KAAK,QAAQ,QAAQ,IAAI,GACxF,CAAC,MAAM,CACT;CACA,MAAM,WAAA,GAAUA,MAAAA,YAAAA,EACb,YAAuC,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,GACpF,CAAC,MAAM,CACT;CAEA,MAAM,UAAU,MAAM,WAAW,YAAY,MAAM,eAAe;CAClE,MAAM,UAAU,cAAc,KAAK;CACnC,MAAM,SAAS,YAAY,OAAQ,SAAS,UAAU,OAAQ,QAAQ;CACtE,MAAM,YAAY,YAAY,OAAQ,SAAS,MAAM,OAAQ,QAAQ;CACrE,MAAM,WAAW,WAAW;CAC5B,MAAM,eAAe,YAAY,OAAQ,YAAY,OAAO,OAAO,MAAM,eAAgB,QAAQ;CACjG,MAAM,OAAA,GAAMA,MAAAA,YAAAA,EAAkB,YAAA,GAAWC,WAAAA,mBAAAA,CAAmB,cAAc,MAAM,GAAG,CAAC,YAAY,CAAC;CACjG,OAAO;EACL,UAAU,eAAe,MAAM,MAAM,KAAK,YAAY;EACtD,YAAY;EACZ;EACA;EACA,OAAO,cAAc,MAAM;EAC3B,SAAS,cAAc,QAAQ;EAC/B,SAAS,cAAc,QAAQ;EAC/B,gBAAgB,cAAc,eAAe;EAC7C;EACA;EACA;CACF;AACF;;AAGA,SAAgB,UAAiF;CAC/F,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,cAAc,KAAK,MAAM;CAE1C,MAAM,OAAO,CAAC,YAAY,MAAM,SAAS,OAAO,OAAQ,QAAQ,QAAQ;CACxE,OAAO;EAAE,UAAU,eAAe,MAAM,MAAM;EAAG,YAAY;EAAU;CAAK;AAC9E;;;;;;;;;AAUA,SAAgB,kBACd,SACoC;CACpC,MAAM,SAAS,UAAU;CACzB,MAAM,UAAA,GAASC,MAAAA,OAAAA,CAAO,OAAO;CAC7B,CAAA,GAAA,MAAA,gBAAA,OAAsB;EACpB,OAAO,UAAU;CACnB,CAAC;CACD,QAAA,GAAOF,MAAAA,YAAAA,EACJ,GAAG,SAAe;EACjB,MAAM,QAAQ,GAAG,aAAoC,OAAO,QAAQ,GAAG,QAAQ;EAE/E,OAAO,WAAW,OAAO,KAAK,GAAG,IAAI,KAAA,GAAIG,WAAAA,mBAAAA,CAAmB,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI;CACnF,GACA,CAAC,MAAM,CACT;AACF;;AAGA,SAAgB,aAAkF;CAChG,MAAM,QAAQ,eAAe;CAC7B,MAAM,UAAU,cAAc,KAAK;CACnC,OAAO;EAAE,UAAU,eAAe,MAAM,MAAM;EAAG,YAAY,YAAY;EAAM;CAAQ;AACzF;AAEA,MAAM,4BAA0C,KAAA;AAEhD,SAAS,YAAuD,UAAoB;CAMlF,QAAA,GALiBC,MAAAA,qBAAAA,CACf,UAAU,aAAa,qBACjB,UAAU,YAAY,YACtB,IAEM;AAChB;AAUA,MAAM,YAA2B;CAAE,QAAQ,CAAC;CAAG,QAAQ,CAAC;AAAE;AAE1D,SAAgB,YAA6B;CAC3C,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,YAAY,QAAQ,UAAU,IAAI;CACnD,OAAO;EACL,UAAU,eAAe,MAAM,MAAM;EACrC,QAAQ,QAAQ,UAAU;EAC1B,QAAQ,UAAU,UAAU;EAC5B,aAAa,UAAU,eAAe;CACxC;AACF;AASA,SAAgB,YAA6B;CAC3C,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,YAAY,QAAQ,UAAU,IAAI;CACnD,OAAO;EACL,UAAU,eAAe,MAAM,MAAM;EACrC,QAAQ,QAAQ,UAAU;EAC1B,QAAQ,UAAU,UAAU;EAC5B,aAAa,UAAU,eAAe;CACxC;AACF;;;;;;;ACtKA,SAAgB,KAAK,OAAkF;CACrG,MAAM,EAAE,UAAU,YAAY,QAAQ,QAAQ;CAC9C,IAAI,CAAC,UAAU,OAAO;CACtB,MAAM,EAAE,SAAS;CASjB,QAPE,SAAS,cACL,aACA,SAAS,eACP,CAAC,aACD,OAAO,SAAS,aACd,KAAK,GAAG,IACR,IAAI,IAAI,KACJ,MAAM,WAAY,MAAM,YAAY;AACpD;AAEA,SAAgB,cAAc,OAA4C;CACxE,OAAO,eAAe,CAAC,CAAC,WAAW,YAAY,MAAM,WAAW;AAClE;;AAGA,SAAgB,aAAa,OAA4C;CACvE,MAAM,EAAE,WAAW,eAAe;CAClC,OAAO,WAAW,WAAW,WAAW,aAAa,MAAM,WAAW;AACxE;AAEA,SAAgB,eAAe,OAA4C;CACzE,OAAO,eAAe,CAAC,CAAC,WAAW,aAAa,MAAM,WAAW;AACnE;AAEA,SAAgB,aAAa,OAA4C;CACvE,OAAO,eAAe,CAAC,CAAC,WAAW,WAAW,MAAM,WAAW;AACjE;;AAGA,SAAgB,iBAAiB,OAA4C;CAC3E,MAAM,SAAS,UAAU;CACzB,MAAM,EAAE,UAAU,eAAe,QAAQ;CACzC,MAAM,EAAE,gBAAgB;CACxB,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,IAAI,WAAW,QAAQ,YAAY,CAAC,YAClC,OAAO,iBAAiB,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,CAAC;CAC5E,GAAG;EAAC;EAAQ;EAAU;EAAY;CAAW,CAAC;CAC9C,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAA4C;CAC3E,MAAM,SAAS,UAAU;CACzB,MAAM,EAAE,UAAU,eAAe,QAAQ;CACzC,MAAM,EAAE,gBAAgB;CACxB,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,IAAI,WAAW,QAAQ,YAAY,CAAC,YAClC,OAAO,iBAAiB,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,CAAC;CAC5E,GAAG;EAAC;EAAQ;EAAU;EAAY;CAAW,CAAC;CAC9C,OAAO;AACT;;;;ACrDA,SAAS,QAAQ,OAA+E;CAC9F,MAAM,QAAQC,MAAAA,SAAS,MAAM,MAAM,QAAQ,MAAM,IAAIA,MAAAA,SAAS,KAAK,MAAM,QAAQ,IAAI;CACrF,KAAA,GAAIC,MAAAA,eAAAA,CAA0D,KAAK,GAAG;EACpE,MAAM,WAAW,MAAM,MAAM;EAC7B,QAAA,GAAOC,MAAAA,aAAAA,CAAa,OAAkE,EACpF,UAAU,UAAsB;GAC9B,WAAW,KAAK;GAChB,IAAI,CAAC,MAAM,kBAAkB,MAAM,QAAQ;EAC7C,EACF,CAAC;CACH;CACA,OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;EAAQ,MAAK;EAAS,SAAS,MAAM;EAClC,UAAA,MAAM,YAAY,MAAM;CACnB,CAAA;AAEZ;AAEA,SAAgB,aAAa,OAA+B;CAC1D,MAAM,SAAS,UAAU;CACzB,MAAM,UAAU,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;CACxF,OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EACE,OAAM;EACN,eAAgB,MAAM,SAAS,UAAU,QAAQ,WAAW,OAAO,IAAI,QAAQ,iBAAiB,OAAO;EAEtG,UAAA,MAAM;CACA,CAAA;AAEb;AAEA,SAAgB,aAAa,OAA+B;CAC1D,MAAM,SAAS,UAAU;CACzB,MAAM,UAAU,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;CACxF,OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EACE,OAAM;EACN,eAAgB,MAAM,SAAS,UAAU,QAAQ,WAAW,OAAO,IAAI,QAAQ,iBAAiB,OAAO;EAEtG,UAAA,MAAM;CACA,CAAA;AAEb;AAEA,SAAgB,cAAc,OAAkE;CAC9F,MAAM,SAAS,UAAU;CACzB,OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EACE,OAAM;EACN,eAAe,KAAK,QAAQ,QAAQ,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY,CAAC;EAE5G,UAAA,MAAM;CACA,CAAA;AAEb;;;;;;;ACzDA,SAAS,QAAQ,OAAqE;CACpF,MAAM,SAAS,UAAU;CACzB,MAAM,OAAA,GAAMC,MAAAA,OAAAA,CAAuB,IAAI;CACvC,MAAM,eAAA,GAAcA,MAAAA,OAAAA,CAAsB,IAAI;CAC9C,MAAM,EAAE,MAAM,mBAAmB;CAEjC,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,MAAM,UAAU,IAAI;EACpB,IAAI,WAAW,QAAQ,YAAY,MAAM;EACzC,OAAO,MAAM,MAAM,SAAS,cAAc;EAC1C,YAAY,UAAU;EACtB,aAAa;GACX,YAAY,UAAU;GACtB,OAAO,QAAQ,OAAO;EACxB;CAGF,GAAG,CAAC,QAAQ,IAAI,CAAC;CAEjB,CAAA,GAAA,MAAA,UAAA,OAAgB;EACd,MAAM,UAAU,IAAI;EACpB,IAAI,WAAW,QAAQ,YAAY,QAAQ,YAAY,YAAY,QAAQ,YAAY,YAAY,gBACjG;EACF,YAAY,UAAU;EACtB,OAAO,cAAc,SAAS,cAAc;CAC9C,GAAG,CAAC,QAAQ,cAAc,CAAC;CAE3B,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAU,IAAM,CAAA;AACzB;AAGA,SAAgB,OAAO,OAAoD;CACzE,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAS,gBAAgB;CAAQ,CAAA;AACxD;AAEA,SAAgB,OAAO,OAAoD;CACzE,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAS,gBAAgB;CAAQ,CAAA;AACxD;;AAGA,SAAgB,iCACd,OACW;CACX,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAmC,gBAAgB;CAAQ,CAAA;AAClF;AAEA,SAAgB,WAAW,OAAwD;CACjF,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAa,gBAAgB;CAAQ,CAAA;AAC5D;AAEA,SAAgB,YAAY,OAAyD;CACnF,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAc,gBAAgB;CAAQ,CAAA;AAC7D;AAEA,SAAgB,aAAa,OAA0D;CACrF,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;EAAS,MAAK;EAAe,gBAAgB;CAAQ,CAAA;AAC9D"}

package/dist/index.d.cts

@@ -16,7 +16,10 @@ export declare function ZauthaProvider({ publishableKey, children, ...options }:
 export declare function useZautha(): Zautha | null;
 //#endregion
 //#region src/hooks.d.ts
-/** Authorization check. In 3a there are no organization claims yet, so role/permission checks are false. */
+/**
+ * What `has` checks in the session's active organization: full keys (`org:admin`, `org:invoices:read`). Every condition
+ * given must hold; with none, false.
+ */
 type HasParams = {
   role?: string;
   permission?: string;
@@ -27,12 +30,24 @@ interface UseAuthResult {
   isSignedIn: boolean;
   userId: string | null;
   sessionId: string | null;
+  /** The active organization (`org_…`); null without one, and while signed out. */
+  orgId: string | null;
+  /** The user's role in it, a full key such as `org:admin`. */
+  orgRole: string | null;
+  /** Its slug; null without one or while the instance has slugs off. */
+  orgSlug: string | null;
+  /** The role's custom permissions, full keys such as `org:invoices:read`. */
+  orgPermissions: readonly string[] | null;
   getToken: (options?: {
     skipCache?: boolean;
   }) => Promise<string | null>;
   signOut: (options?: {
     redirectUrl?: string;
   }) => Promise<void>;
+  /**
+   * From the session token alone, the same rule as every Zautha SDK and your server: false without an active
+   * organization, and always false for a system permission (`org:sys_…`, never in the token).
+   */
   has: Has;
 }
 export declare function useAuth(): UseAuthResult;

package/dist/index.d.mts

@@ -16,7 +16,10 @@ export declare function ZauthaProvider({ publishableKey, children, ...options }:
 export declare function useZautha(): Zautha | null;
 //#endregion
 //#region src/hooks.d.ts
-/** Authorization check. In 3a there are no organization claims yet, so role/permission checks are false. */
+/**
+ * What `has` checks in the session's active organization: full keys (`org:admin`, `org:invoices:read`). Every condition
+ * given must hold; with none, false.
+ */
 type HasParams = {
   role?: string;
   permission?: string;
@@ -27,12 +30,24 @@ interface UseAuthResult {
   isSignedIn: boolean;
   userId: string | null;
   sessionId: string | null;
+  /** The active organization (`org_…`); null without one, and while signed out. */
+  orgId: string | null;
+  /** The user's role in it, a full key such as `org:admin`. */
+  orgRole: string | null;
+  /** Its slug; null without one or while the instance has slugs off. */
+  orgSlug: string | null;
+  /** The role's custom permissions, full keys such as `org:invoices:read`. */
+  orgPermissions: readonly string[] | null;
   getToken: (options?: {
     skipCache?: boolean;
   }) => Promise<string | null>;
   signOut: (options?: {
     redirectUrl?: string;
   }) => Promise<void>;
+  /**
+   * From the session token alone, the same rule as every Zautha SDK and your server: false without an active
+   * organization, and always false for a system permission (`org:sys_…`, never in the token).
+   */
   has: Has;
 }
 export declare function useAuth(): UseAuthResult;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 "use client";
-import { ReverificationCancelledError, ReverificationRequiredError, Zautha, ZauthaApiError, ZauthaCaptchaError, ZauthaError, ZauthaNetworkError, ZauthaOfflineError, ZauthaPasskeyError, isReverificationCancelledError, isReverificationRequiredError, isZauthaApiError, isZauthaCaptchaError, isZauthaError, isZauthaNetworkError, isZauthaOfflineError, isZauthaPasskeyError, withReverification } from "@zautha/js";
+import { ReverificationCancelledError, ReverificationRequiredError, Zautha, ZauthaApiError, ZauthaCaptchaError, ZauthaError, ZauthaNetworkError, ZauthaOfflineError, ZauthaPasskeyError, checkAuthorization, isReverificationCancelledError, isReverificationRequiredError, isZauthaApiError, isZauthaCaptchaError, isZauthaError, isZauthaNetworkError, isZauthaOfflineError, isZauthaPasskeyError, withReverification } from "@zautha/js";
 import { Children, cloneElement, createContext, isValidElement, useCallback, useContext, useEffect, useLayoutEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/provider.tsx
@@ -57,6 +57,7 @@ const NO_STATE = {
 	client: null,
 	session: null,
 	user: null,
+	organization: null,
 	initialState: null
 };
 const noop = () => () => void 0;
@@ -80,12 +81,17 @@ function useAuth() {
 	const userId = initial === null ? session?.userId ?? null : initial.userId;
 	const sessionId = initial === null ? session?.id ?? null : initial.sessionId;
 	const signedIn = userId !== null;
-	const has = useCallback((params) => signedIn && params.role === void 0 && params.permission === void 0, [signedIn]);
+	const organization = initial === null ? session === null ? null : state.organization : initial.organization;
+	const has = useCallback((params) => checkAuthorization(organization, params), [organization]);
 	return {
 		isLoaded: isLoadedStatus(state.status) || initial !== null,
 		isSignedIn: signedIn,
 		userId,
 		sessionId,
+		orgId: organization?.id ?? null,
+		orgRole: organization?.role ?? null,
+		orgSlug: organization?.slug ?? null,
+		orgPermissions: organization?.permissions ?? null,
 		getToken,
 		signOut,
 		has

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/provider.tsx","../src/hooks.ts","../src/control.tsx","../src/buttons.tsx","../src/prebuilt.tsx"],"sourcesContent":["import { Zautha, type ZauthaOptions, type ZauthaState } from \"@zautha/js\";\nimport { createContext, useContext, useEffect, useMemo, useState, useSyncExternalStore, type ReactNode } from \"react\";\n\ninterface ZauthaContextValue {\n  readonly zautha: Zautha | null;\n  /** The snapshot before the instance exists and during server rendering (carries `initialState`). */\n  readonly pending: ZauthaState;\n}\n\nconst ZauthaContext = createContext<ZauthaContextValue | undefined>(undefined);\n\nexport interface ZauthaProviderProps extends Omit<ZauthaOptions, \"fetch\"> {\n  publishableKey: string;\n  children?: ReactNode;\n}\n\n/**\n * Creates the Zautha instance after mount (never during render, so StrictMode's double mount and SSR\n * create no timers or channels), loads it, and disposes it on unmount. Until then hooks report\n * `isLoaded: false`, unless `initialState` (the server's view, e.g. from @zautha/nextjs) says who is signed in.\n */\nexport function ZauthaProvider({ publishableKey, children, ...options }: ZauthaProviderProps): ReactNode {\n  const [zautha, setZautha] = useState<Zautha | null>(null);\n  const { ui, appearance, localization, signInUrl, signUpUrl, navigate, initialState } = options;\n  const [pending] = useState<ZauthaState>(() => ({ ...NO_STATE, initialState: initialState ?? null }));\n\n  useEffect(() => {\n    const instance = new Zautha(publishableKey, {\n      ...(ui === undefined ? {} : { ui }),\n      ...(appearance === undefined ? {} : { appearance }),\n      ...(localization === undefined ? {} : { localization }),\n      ...(signInUrl === undefined ? {} : { signInUrl }),\n      ...(signUpUrl === undefined ? {} : { signUpUrl }),\n      ...(navigate === undefined ? {} : { navigate }),\n      ...(initialState === undefined ? {} : { initialState }),\n    });\n    // The instance is an external system: it is created here, never during render, and published through state.\n    // eslint-disable-next-line react-hooks/set-state-in-effect\n    setZautha(instance);\n    void instance.load();\n    return () => {\n      instance.dispose();\n      setZautha(null);\n    };\n    // Appearance/localization objects are read at mount; changing the key re-creates the instance.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [publishableKey]);\n\n  const value = useMemo(() => ({ zautha, pending }), [zautha, pending]);\n  return <ZauthaContext.Provider value={value}>{children}</ZauthaContext.Provider>;\n}\n\n/** The Zautha instance, or null before the provider has created it. */\nexport function useZautha(): Zautha | null {\n  return useZauthaContext().zautha;\n}\n\nfunction useZauthaContext(): ZauthaContextValue {\n  const value = useContext(ZauthaContext);\n  if (value === undefined) throw new Error(\"Zautha hooks and components must be used inside <ZauthaProvider>.\");\n  return value;\n}\n\nconst NO_STATE: ZauthaState = {\n  status: \"loading\",\n  environment: null,\n  client: null,\n  session: null,\n  user: null,\n  initialState: null,\n};\nconst noop = (): (() => void) => () => undefined;\n\n/** Reactive snapshot of the instance state (the loading state, with any initial state, before the instance exists). */\nexport function useZauthaState(): ZauthaState {\n  const { zautha, pending } = useZauthaContext();\n  return useSyncExternalStore(\n    zautha?.subscribe ?? noop,\n    () => zautha?.getSnapshot() ?? pending,\n    () => pending,\n  );\n}\n","import {\n  withReverification,\n  type AttemptErrors,\n  type FetchStatus,\n  type Session,\n  type SignInResource,\n  type SignUpResource,\n  type UserResource,\n  type ZauthaState,\n} from \"@zautha/js\";\nimport { useCallback, useLayoutEffect, useRef, useSyncExternalStore } from \"react\";\nimport { useZautha, useZauthaState } from \"./provider\";\n\n/** Authorization check. In 3a there are no organization claims yet, so role/permission checks are false. */\nexport type HasParams = { role?: string; permission?: string };\nexport type Has = (params: HasParams) => boolean;\n\nexport interface UseAuthResult {\n  isLoaded: boolean;\n  isSignedIn: boolean;\n  userId: string | null;\n  sessionId: string | null;\n  getToken: (options?: { skipCache?: boolean }) => Promise<string | null>;\n  signOut: (options?: { redirectUrl?: string }) => Promise<void>;\n  has: Has;\n}\n\nconst isLoadedStatus = (status: string): boolean => status === \"ready\" || status === \"degraded\";\n\n/** The signed-in session: a pending one (tasks left, e.g. setting up two-step verification) counts as signed out. */\nconst activeSession = (state: ZauthaState): Session | null =>\n  state.session?.status === \"active\" ? state.session : null;\n\nexport function useAuth(): UseAuthResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const getToken = useCallback(\n    (options?: { skipCache?: boolean }) => zautha?.getToken(options) ?? Promise.resolve(null),\n    [zautha],\n  );\n  const signOut = useCallback(\n    (options?: { redirectUrl?: string }) => zautha?.signOut(options) ?? Promise.resolve(),\n    [zautha],\n  );\n  // Until the first load settles, the server's initial state (if any) answers, so nothing flickers.\n  const initial = state.status === \"loading\" ? state.initialState : null;\n  const session = activeSession(state);\n  const userId = initial === null ? (session?.userId ?? null) : initial.userId;\n  const sessionId = initial === null ? (session?.id ?? null) : initial.sessionId;\n  const signedIn = userId !== null;\n  const has = useCallback<Has>(\n    (params) => signedIn && params.role === undefined && params.permission === undefined,\n    [signedIn],\n  );\n  return {\n    isLoaded: isLoadedStatus(state.status) || initial !== null,\n    isSignedIn: signedIn,\n    userId,\n    sessionId,\n    getToken,\n    signOut,\n    has,\n  };\n}\n\n/** The signed-in user with its self-service actions (`user.update`, `user.createEmailAddress`, …). */\nexport function useUser(): { isLoaded: boolean; isSignedIn: boolean; user: UserResource | null } {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const signedIn = activeSession(state) !== null;\n  // zautha.user is rebuilt only when state.user changes, so the resource is stable between renders.\n  const user = !signedIn || state.user === null ? null : (zautha?.user ?? null);\n  return { isLoaded: isLoadedStatus(state.status), isSignedIn: signedIn, user };\n}\n\n/**\n * Wraps a sensitive action so that it completes after an identity check when it needs one: when `fetcher` throws\n * `ReverificationRequiredError` (e.g. `user.updatePassword`) or resolves to a `Response` with the `403\n * reverification_required` body (your backend with @zautha/backend, @zautha/nextjs or Zautha.AspNetCore), the\n * reverification modal opens and, once the user has verified, `fetcher` runs once more with the same arguments (its\n * token is fresh by then). Closing the modal rejects with `ReverificationCancelledError`. Needs `ui` from @zautha/ui on\n * the provider. The returned function is stable; it always calls the latest `fetcher`.\n */\nexport function useReverification<Args extends unknown[], Result>(\n  fetcher: (...args: Args) => Promise<Result>,\n): (...args: Args) => Promise<Result> {\n  const zautha = useZautha();\n  const latest = useRef(fetcher);\n  useLayoutEffect(() => {\n    latest.current = fetcher;\n  });\n  return useCallback(\n    (...args: Args) => {\n      const call = (...callArgs: Args): Promise<Result> => latest.current(...callArgs);\n      // Before the provider has created the instance no modal can open: the action runs as it is.\n      return zautha === null ? call(...args) : withReverification(zautha, call)(...args);\n    },\n    [zautha],\n  );\n}\n\n/** The signed-in session; null while signed out or while the session is pending (tasks left). */\nexport function useSession(): { isLoaded: boolean; isSignedIn: boolean; session: Session | null } {\n  const state = useZauthaState();\n  const session = activeSession(state);\n  return { isLoaded: isLoadedStatus(state.status), isSignedIn: session !== null, session };\n}\n\nconst noopSubscribe = (): (() => void) => () => undefined;\n\nfunction useResource<T extends SignInResource | SignUpResource>(resource: T | null) {\n  const snapshot = useSyncExternalStore(\n    resource?.subscribe ?? noopSubscribe,\n    () => resource?.snapshot ?? null,\n    () => null,\n  );\n  return snapshot;\n}\n\nexport interface UseSignInResult {\n  isLoaded: boolean;\n  /** The sign-in resource; null until the provider has created the instance. */\n  signIn: SignInResource | null;\n  errors: AttemptErrors;\n  fetchStatus: FetchStatus;\n}\n\nconst NO_ERRORS: AttemptErrors = { fields: {}, global: [] };\n\nexport function useSignIn(): UseSignInResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const snapshot = useResource(zautha?.signIn ?? null);\n  return {\n    isLoaded: isLoadedStatus(state.status),\n    signIn: zautha?.signIn ?? null,\n    errors: snapshot?.errors ?? NO_ERRORS,\n    fetchStatus: snapshot?.fetchStatus ?? \"idle\",\n  };\n}\n\nexport interface UseSignUpResult {\n  isLoaded: boolean;\n  signUp: SignUpResource | null;\n  errors: AttemptErrors;\n  fetchStatus: FetchStatus;\n}\n\nexport function useSignUp(): UseSignUpResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const snapshot = useResource(zautha?.signUp ?? null);\n  return {\n    isLoaded: isLoadedStatus(state.status),\n    signUp: zautha?.signUp ?? null,\n    errors: snapshot?.errors ?? NO_ERRORS,\n    fetchStatus: snapshot?.fetchStatus ?? \"idle\",\n  };\n}\n","import { useEffect, type ReactNode } from \"react\";\nimport { useAuth, type Has, type HasParams } from \"./hooks\";\nimport { useZautha, useZauthaState } from \"./provider\";\n\nexport type ShowWhen = \"signed-in\" | \"signed-out\" | HasParams | ((has: Has) => boolean);\n\n/**\n * Renders `children` when the condition holds, else `fallback`. Renders nothing until Zautha has\n * loaded, so a signed-in user never sees a signed-out flash.\n */\nexport function Show(props: { when: ShowWhen; fallback?: ReactNode; children?: ReactNode }): ReactNode {\n  const { isLoaded, isSignedIn, has } = useAuth();\n  if (!isLoaded) return null;\n  const { when } = props;\n  const pass =\n    when === \"signed-in\"\n      ? isSignedIn\n      : when === \"signed-out\"\n        ? !isSignedIn\n        : typeof when === \"function\"\n          ? when(has)\n          : has(when);\n  return pass ? props.children : (props.fallback ?? null);\n}\n\nexport function ZauthaLoading(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"loading\" ? props.children : null;\n}\n\n/** Loaded, including degraded (network trouble after load: last known state is shown). */\nexport function ZauthaLoaded(props: { children?: ReactNode }): ReactNode {\n  const { status } = useZauthaState();\n  return status === \"ready\" || status === \"degraded\" ? props.children : null;\n}\n\nexport function ZauthaDegraded(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"degraded\" ? props.children : null;\n}\n\nexport function ZauthaFailed(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"failed\" ? props.children : null;\n}\n\n/** Sends a signed-out visitor to sign-in once loaded; renders nothing. */\nexport function RedirectToSignIn(props: { redirectUrl?: string }): ReactNode {\n  const zautha = useZautha();\n  const { isLoaded, isSignedIn } = useAuth();\n  const { redirectUrl } = props;\n  useEffect(() => {\n    if (zautha !== null && isLoaded && !isSignedIn)\n      zautha.redirectToSignIn(redirectUrl === undefined ? {} : { redirectUrl });\n  }, [zautha, isLoaded, isSignedIn, redirectUrl]);\n  return null;\n}\n\nexport function RedirectToSignUp(props: { redirectUrl?: string }): ReactNode {\n  const zautha = useZautha();\n  const { isLoaded, isSignedIn } = useAuth();\n  const { redirectUrl } = props;\n  useEffect(() => {\n    if (zautha !== null && isLoaded && !isSignedIn)\n      zautha.redirectToSignUp(redirectUrl === undefined ? {} : { redirectUrl });\n  }, [zautha, isLoaded, isSignedIn, redirectUrl]);\n  return null;\n}\n","import { Children, cloneElement, isValidElement, type MouseEvent, type ReactElement, type ReactNode } from \"react\";\nimport { useZautha } from \"./provider\";\n\ninterface ButtonProps {\n  /** `redirect` (default) goes to the sign-in page; `modal` opens the prebuilt component (needs `ui`). */\n  mode?: \"redirect\" | \"modal\";\n  redirectUrl?: string;\n  children?: ReactNode;\n}\n\n/** Wraps its single child (or renders a plain button) and wires the click. Unstyled by design. */\nfunction Trigger(props: { children: ReactNode; label: string; onClick: () => void }): ReactNode {\n  const child = Children.count(props.children) === 1 ? Children.only(props.children) : null;\n  if (isValidElement<{ onClick?: (event: MouseEvent) => void }>(child)) {\n    const original = child.props.onClick;\n    return cloneElement(child as ReactElement<{ onClick?: (event: MouseEvent) => void }>, {\n      onClick: (event: MouseEvent) => {\n        original?.(event);\n        if (!event.defaultPrevented) props.onClick();\n      },\n    });\n  }\n  return (\n    <button type=\"button\" onClick={props.onClick}>\n      {props.children ?? props.label}\n    </button>\n  );\n}\n\nexport function SignInButton(props: ButtonProps): ReactNode {\n  const zautha = useZautha();\n  const options = props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl };\n  return (\n    <Trigger\n      label=\"Sign in\"\n      onClick={() => (props.mode === \"modal\" ? zautha?.openSignIn(options) : zautha?.redirectToSignIn(options))}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n\nexport function SignUpButton(props: ButtonProps): ReactNode {\n  const zautha = useZautha();\n  const options = props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl };\n  return (\n    <Trigger\n      label=\"Sign up\"\n      onClick={() => (props.mode === \"modal\" ? zautha?.openSignUp(options) : zautha?.redirectToSignUp(options))}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n\nexport function SignOutButton(props: { redirectUrl?: string; children?: ReactNode }): ReactNode {\n  const zautha = useZautha();\n  return (\n    <Trigger\n      label=\"Sign out\"\n      onClick={() => void zautha?.signOut(props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl })}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n","import type { UiComponentName } from \"@zautha/js\";\nimport { useEffect, useRef, type ReactNode } from \"react\";\nimport { useZautha } from \"./provider\";\n\n/**\n * Mounts a @zautha/ui component into a div once the instance exists; later prop changes update it in\n * place. SSR renders only the empty div.\n */\nfunction Mounted(props: { name: UiComponentName; componentProps: object }): ReactNode {\n  const zautha = useZautha();\n  const ref = useRef<HTMLDivElement>(null);\n  const mountedWith = useRef<object | null>(null);\n  const { name, componentProps } = props;\n\n  useEffect(() => {\n    const element = ref.current;\n    if (zautha === null || element === null) return;\n    zautha.mount(name, element, componentProps);\n    mountedWith.current = componentProps;\n    return () => {\n      mountedWith.current = null;\n      zautha.unmount(element);\n    };\n    // componentProps changes are applied by the effect below without remounting.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [zautha, name]);\n\n  useEffect(() => {\n    const element = ref.current;\n    if (zautha === null || element === null || mountedWith.current === null || mountedWith.current === componentProps)\n      return;\n    mountedWith.current = componentProps;\n    zautha.updateMounted(element, componentProps);\n  }, [zautha, componentProps]);\n\n  return <div ref={ref} />;\n}\n\n// Prop types live in @zautha/ui; they are structural here so @zautha/react has no runtime dependency on it.\nexport function SignIn(props: import(\"@zautha/ui\").SignInProps): ReactNode {\n  return <Mounted name=\"SignIn\" componentProps={props} />;\n}\n\nexport function SignUp(props: import(\"@zautha/ui\").SignUpProps): ReactNode {\n  return <Mounted name=\"SignUp\" componentProps={props} />;\n}\n\n/** The page a provider sends the user back to: finishes the social sign-in or sign-up (see @zautha/ui). */\nexport function AuthenticateWithRedirectCallback(\n  props: import(\"@zautha/ui\").AuthenticateWithRedirectCallbackProps,\n): ReactNode {\n  return <Mounted name=\"AuthenticateWithRedirectCallback\" componentProps={props} />;\n}\n\nexport function UserButton(props: import(\"@zautha/ui\").UserButtonProps): ReactNode {\n  return <Mounted name=\"UserButton\" componentProps={props} />;\n}\n\nexport function UserProfile(props: import(\"@zautha/ui\").UserProfileProps): ReactNode {\n  return <Mounted name=\"UserProfile\" componentProps={props} />;\n}\n\nexport function OAuthConsent(props: import(\"@zautha/ui\").OAuthConsentProps): ReactNode {\n  return <Mounted name=\"OAuthConsent\" componentProps={props} />;\n}\n"],"mappings":";;;;;AASA,MAAM,gBAAgB,cAA8C,KAAA,CAAS;;;;;;AAY7E,SAAgB,eAAe,EAAE,gBAAgB,UAAU,GAAG,WAA2C;CACvG,MAAM,CAAC,QAAQ,aAAa,SAAwB,IAAI;CACxD,MAAM,EAAE,IAAI,YAAY,cAAc,WAAW,WAAW,UAAU,iBAAiB;CACvF,MAAM,CAAC,WAAW,gBAA6B;EAAE,GAAG;EAAU,cAAc,gBAAgB;CAAK,EAAE;CAEnG,gBAAgB;EACd,MAAM,WAAW,IAAI,OAAO,gBAAgB;GAC1C,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GACjC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;GACrD,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;GAC/C,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;GAC/C,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS;GAC7C,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;EAGD,UAAU,QAAQ;EAClB,SAAc,KAAK;EACnB,aAAa;GACX,SAAS,QAAQ;GACjB,UAAU,IAAI;EAChB;CAGF,GAAG,CAAC,cAAc,CAAC;CAEnB,MAAM,QAAQ,eAAe;EAAE;EAAQ;CAAQ,IAAI,CAAC,QAAQ,OAAO,CAAC;CACpE,OAAO,oBAAC,cAAc,UAAf;EAA+B;EAAQ;CAAiC,CAAA;AACjF;;AAGA,SAAgB,YAA2B;CACzC,OAAO,iBAAiB,CAAC,CAAC;AAC5B;AAEA,SAAS,mBAAuC;CAC9C,MAAM,QAAQ,WAAW,aAAa;CACtC,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,mEAAmE;CAC5G,OAAO;AACT;AAEA,MAAM,WAAwB;CAC5B,QAAQ;CACR,aAAa;CACb,QAAQ;CACR,SAAS;CACT,MAAM;CACN,cAAc;AAChB;AACA,MAAM,mBAAiC,KAAA;;AAGvC,SAAgB,iBAA8B;CAC5C,MAAM,EAAE,QAAQ,YAAY,iBAAiB;CAC7C,OAAO,qBACL,QAAQ,aAAa,YACf,QAAQ,YAAY,KAAK,eACzB,OACR;AACF;;;ACtDA,MAAM,kBAAkB,WAA4B,WAAW,WAAW,WAAW;;AAGrF,MAAM,iBAAiB,UACrB,MAAM,SAAS,WAAW,WAAW,MAAM,UAAU;AAEvD,SAAgB,UAAyB;CACvC,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,aACd,YAAsC,QAAQ,SAAS,OAAO,KAAK,QAAQ,QAAQ,IAAI,GACxF,CAAC,MAAM,CACT;CACA,MAAM,UAAU,aACb,YAAuC,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,GACpF,CAAC,MAAM,CACT;CAEA,MAAM,UAAU,MAAM,WAAW,YAAY,MAAM,eAAe;CAClE,MAAM,UAAU,cAAc,KAAK;CACnC,MAAM,SAAS,YAAY,OAAQ,SAAS,UAAU,OAAQ,QAAQ;CACtE,MAAM,YAAY,YAAY,OAAQ,SAAS,MAAM,OAAQ,QAAQ;CACrE,MAAM,WAAW,WAAW;CAC5B,MAAM,MAAM,aACT,WAAW,YAAY,OAAO,SAAS,KAAA,KAAa,OAAO,eAAe,KAAA,GAC3E,CAAC,QAAQ,CACX;CACA,OAAO;EACL,UAAU,eAAe,MAAM,MAAM,KAAK,YAAY;EACtD,YAAY;EACZ;EACA;EACA;EACA;EACA;CACF;AACF;;AAGA,SAAgB,UAAiF;CAC/F,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,cAAc,KAAK,MAAM;CAE1C,MAAM,OAAO,CAAC,YAAY,MAAM,SAAS,OAAO,OAAQ,QAAQ,QAAQ;CACxE,OAAO;EAAE,UAAU,eAAe,MAAM,MAAM;EAAG,YAAY;EAAU;CAAK;AAC9E;;;;;;;;;AAUA,SAAgB,kBACd,SACoC;CACpC,MAAM,SAAS,UAAU;CACzB,MAAM,SAAS,OAAO,OAAO;CAC7B,sBAAsB;EACpB,OAAO,UAAU;CACnB,CAAC;CACD,OAAO,aACJ,GAAG,SAAe;EACjB,MAAM,QAAQ,GAAG,aAAoC,OAAO,QAAQ,GAAG,QAAQ;EAE/E,OAAO,WAAW,OAAO,KAAK,GAAG,IAAI,IAAI,mBAAmB,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI;CACnF,GACA,CAAC,MAAM,CACT;AACF;;AAGA,SAAgB,aAAkF;CAChG,MAAM,QAAQ,eAAe;CAC7B,MAAM,UAAU,cAAc,KAAK;CACnC,OAAO;EAAE,UAAU,eAAe,MAAM,MAAM;EAAG,YAAY,YAAY;EAAM;CAAQ;AACzF;AAEA,MAAM,4BAA0C,KAAA;AAEhD,SAAS,YAAuD,UAAoB;CAMlF,OALiB,qBACf,UAAU,aAAa,qBACjB,UAAU,YAAY,YACtB,IAEM;AAChB;AAUA,MAAM,YAA2B;CAAE,QAAQ,CAAC;CAAG,QAAQ,CAAC;AAAE;AAE1D,SAAgB,YAA6B;CAC3C,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,YAAY,QAAQ,UAAU,IAAI;CACnD,OAAO;EACL,UAAU,eAAe,MAAM,MAAM;EACrC,QAAQ,QAAQ,UAAU;EAC1B,QAAQ,UAAU,UAAU;EAC5B,aAAa,UAAU,eAAe;CACxC;AACF;AASA,SAAgB,YAA6B;CAC3C,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,YAAY,QAAQ,UAAU,IAAI;CACnD,OAAO;EACL,UAAU,eAAe,MAAM,MAAM;EACrC,QAAQ,QAAQ,UAAU;EAC1B,QAAQ,UAAU,UAAU;EAC5B,aAAa,UAAU,eAAe;CACxC;AACF;;;;;;;ACpJA,SAAgB,KAAK,OAAkF;CACrG,MAAM,EAAE,UAAU,YAAY,QAAQ,QAAQ;CAC9C,IAAI,CAAC,UAAU,OAAO;CACtB,MAAM,EAAE,SAAS;CASjB,QAPE,SAAS,cACL,aACA,SAAS,eACP,CAAC,aACD,OAAO,SAAS,aACd,KAAK,GAAG,IACR,IAAI,IAAI,KACJ,MAAM,WAAY,MAAM,YAAY;AACpD;AAEA,SAAgB,cAAc,OAA4C;CACxE,OAAO,eAAe,CAAC,CAAC,WAAW,YAAY,MAAM,WAAW;AAClE;;AAGA,SAAgB,aAAa,OAA4C;CACvE,MAAM,EAAE,WAAW,eAAe;CAClC,OAAO,WAAW,WAAW,WAAW,aAAa,MAAM,WAAW;AACxE;AAEA,SAAgB,eAAe,OAA4C;CACzE,OAAO,eAAe,CAAC,CAAC,WAAW,aAAa,MAAM,WAAW;AACnE;AAEA,SAAgB,aAAa,OAA4C;CACvE,OAAO,eAAe,CAAC,CAAC,WAAW,WAAW,MAAM,WAAW;AACjE;;AAGA,SAAgB,iBAAiB,OAA4C;CAC3E,MAAM,SAAS,UAAU;CACzB,MAAM,EAAE,UAAU,eAAe,QAAQ;CACzC,MAAM,EAAE,gBAAgB;CACxB,gBAAgB;EACd,IAAI,WAAW,QAAQ,YAAY,CAAC,YAClC,OAAO,iBAAiB,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,CAAC;CAC5E,GAAG;EAAC;EAAQ;EAAU;EAAY;CAAW,CAAC;CAC9C,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAA4C;CAC3E,MAAM,SAAS,UAAU;CACzB,MAAM,EAAE,UAAU,eAAe,QAAQ;CACzC,MAAM,EAAE,gBAAgB;CACxB,gBAAgB;EACd,IAAI,WAAW,QAAQ,YAAY,CAAC,YAClC,OAAO,iBAAiB,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,CAAC;CAC5E,GAAG;EAAC;EAAQ;EAAU;EAAY;CAAW,CAAC;CAC9C,OAAO;AACT;;;;ACrDA,SAAS,QAAQ,OAA+E;CAC9F,MAAM,QAAQ,SAAS,MAAM,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,MAAM,QAAQ,IAAI;CACrF,IAAI,eAA0D,KAAK,GAAG;EACpE,MAAM,WAAW,MAAM,MAAM;EAC7B,OAAO,aAAa,OAAkE,EACpF,UAAU,UAAsB;GAC9B,WAAW,KAAK;GAChB,IAAI,CAAC,MAAM,kBAAkB,MAAM,QAAQ;EAC7C,EACF,CAAC;CACH;CACA,OACE,oBAAC,UAAD;EAAQ,MAAK;EAAS,SAAS,MAAM;EAClC,UAAA,MAAM,YAAY,MAAM;CACnB,CAAA;AAEZ;AAEA,SAAgB,aAAa,OAA+B;CAC1D,MAAM,SAAS,UAAU;CACzB,MAAM,UAAU,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;CACxF,OACE,oBAAC,SAAD;EACE,OAAM;EACN,eAAgB,MAAM,SAAS,UAAU,QAAQ,WAAW,OAAO,IAAI,QAAQ,iBAAiB,OAAO;EAEtG,UAAA,MAAM;CACA,CAAA;AAEb;AAEA,SAAgB,aAAa,OAA+B;CAC1D,MAAM,SAAS,UAAU;CACzB,MAAM,UAAU,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;CACxF,OACE,oBAAC,SAAD;EACE,OAAM;EACN,eAAgB,MAAM,SAAS,UAAU,QAAQ,WAAW,OAAO,IAAI,QAAQ,iBAAiB,OAAO;EAEtG,UAAA,MAAM;CACA,CAAA;AAEb;AAEA,SAAgB,cAAc,OAAkE;CAC9F,MAAM,SAAS,UAAU;CACzB,OACE,oBAAC,SAAD;EACE,OAAM;EACN,eAAe,KAAK,QAAQ,QAAQ,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY,CAAC;EAE5G,UAAA,MAAM;CACA,CAAA;AAEb;;;;;;;ACzDA,SAAS,QAAQ,OAAqE;CACpF,MAAM,SAAS,UAAU;CACzB,MAAM,MAAM,OAAuB,IAAI;CACvC,MAAM,cAAc,OAAsB,IAAI;CAC9C,MAAM,EAAE,MAAM,mBAAmB;CAEjC,gBAAgB;EACd,MAAM,UAAU,IAAI;EACpB,IAAI,WAAW,QAAQ,YAAY,MAAM;EACzC,OAAO,MAAM,MAAM,SAAS,cAAc;EAC1C,YAAY,UAAU;EACtB,aAAa;GACX,YAAY,UAAU;GACtB,OAAO,QAAQ,OAAO;EACxB;CAGF,GAAG,CAAC,QAAQ,IAAI,CAAC;CAEjB,gBAAgB;EACd,MAAM,UAAU,IAAI;EACpB,IAAI,WAAW,QAAQ,YAAY,QAAQ,YAAY,YAAY,QAAQ,YAAY,YAAY,gBACjG;EACF,YAAY,UAAU;EACtB,OAAO,cAAc,SAAS,cAAc;CAC9C,GAAG,CAAC,QAAQ,cAAc,CAAC;CAE3B,OAAO,oBAAC,OAAD,EAAU,IAAM,CAAA;AACzB;AAGA,SAAgB,OAAO,OAAoD;CACzE,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAS,gBAAgB;CAAQ,CAAA;AACxD;AAEA,SAAgB,OAAO,OAAoD;CACzE,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAS,gBAAgB;CAAQ,CAAA;AACxD;;AAGA,SAAgB,iCACd,OACW;CACX,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAmC,gBAAgB;CAAQ,CAAA;AAClF;AAEA,SAAgB,WAAW,OAAwD;CACjF,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAa,gBAAgB;CAAQ,CAAA;AAC5D;AAEA,SAAgB,YAAY,OAAyD;CACnF,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAc,gBAAgB;CAAQ,CAAA;AAC7D;AAEA,SAAgB,aAAa,OAA0D;CACrF,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAe,gBAAgB;CAAQ,CAAA;AAC9D"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/provider.tsx","../src/hooks.ts","../src/control.tsx","../src/buttons.tsx","../src/prebuilt.tsx"],"sourcesContent":["import { Zautha, type ZauthaOptions, type ZauthaState } from \"@zautha/js\";\nimport { createContext, useContext, useEffect, useMemo, useState, useSyncExternalStore, type ReactNode } from \"react\";\n\ninterface ZauthaContextValue {\n  readonly zautha: Zautha | null;\n  /** The snapshot before the instance exists and during server rendering (carries `initialState`). */\n  readonly pending: ZauthaState;\n}\n\nconst ZauthaContext = createContext<ZauthaContextValue | undefined>(undefined);\n\nexport interface ZauthaProviderProps extends Omit<ZauthaOptions, \"fetch\"> {\n  publishableKey: string;\n  children?: ReactNode;\n}\n\n/**\n * Creates the Zautha instance after mount (never during render, so StrictMode's double mount and SSR\n * create no timers or channels), loads it, and disposes it on unmount. Until then hooks report\n * `isLoaded: false`, unless `initialState` (the server's view, e.g. from @zautha/nextjs) says who is signed in.\n */\nexport function ZauthaProvider({ publishableKey, children, ...options }: ZauthaProviderProps): ReactNode {\n  const [zautha, setZautha] = useState<Zautha | null>(null);\n  const { ui, appearance, localization, signInUrl, signUpUrl, navigate, initialState } = options;\n  const [pending] = useState<ZauthaState>(() => ({ ...NO_STATE, initialState: initialState ?? null }));\n\n  useEffect(() => {\n    const instance = new Zautha(publishableKey, {\n      ...(ui === undefined ? {} : { ui }),\n      ...(appearance === undefined ? {} : { appearance }),\n      ...(localization === undefined ? {} : { localization }),\n      ...(signInUrl === undefined ? {} : { signInUrl }),\n      ...(signUpUrl === undefined ? {} : { signUpUrl }),\n      ...(navigate === undefined ? {} : { navigate }),\n      ...(initialState === undefined ? {} : { initialState }),\n    });\n    // The instance is an external system: it is created here, never during render, and published through state.\n    // eslint-disable-next-line react-hooks/set-state-in-effect\n    setZautha(instance);\n    void instance.load();\n    return () => {\n      instance.dispose();\n      setZautha(null);\n    };\n    // Appearance/localization objects are read at mount; changing the key re-creates the instance.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [publishableKey]);\n\n  const value = useMemo(() => ({ zautha, pending }), [zautha, pending]);\n  return <ZauthaContext.Provider value={value}>{children}</ZauthaContext.Provider>;\n}\n\n/** The Zautha instance, or null before the provider has created it. */\nexport function useZautha(): Zautha | null {\n  return useZauthaContext().zautha;\n}\n\nfunction useZauthaContext(): ZauthaContextValue {\n  const value = useContext(ZauthaContext);\n  if (value === undefined) throw new Error(\"Zautha hooks and components must be used inside <ZauthaProvider>.\");\n  return value;\n}\n\nconst NO_STATE: ZauthaState = {\n  status: \"loading\",\n  environment: null,\n  client: null,\n  session: null,\n  user: null,\n  organization: null,\n  initialState: null,\n};\nconst noop = (): (() => void) => () => undefined;\n\n/** Reactive snapshot of the instance state (the loading state, with any initial state, before the instance exists). */\nexport function useZauthaState(): ZauthaState {\n  const { zautha, pending } = useZauthaContext();\n  return useSyncExternalStore(\n    zautha?.subscribe ?? noop,\n    () => zautha?.getSnapshot() ?? pending,\n    () => pending,\n  );\n}\n","import {\n  checkAuthorization,\n  withReverification,\n  type AttemptErrors,\n  type FetchStatus,\n  type Session,\n  type SignInResource,\n  type SignUpResource,\n  type UserResource,\n  type ZauthaState,\n} from \"@zautha/js\";\nimport { useCallback, useLayoutEffect, useRef, useSyncExternalStore } from \"react\";\nimport { useZautha, useZauthaState } from \"./provider\";\n\n/**\n * What `has` checks in the session's active organization: full keys (`org:admin`, `org:invoices:read`). Every condition\n * given must hold; with none, false.\n */\nexport type HasParams = { role?: string; permission?: string };\nexport type Has = (params: HasParams) => boolean;\n\nexport interface UseAuthResult {\n  isLoaded: boolean;\n  isSignedIn: boolean;\n  userId: string | null;\n  sessionId: string | null;\n  /** The active organization (`org_…`); null without one, and while signed out. */\n  orgId: string | null;\n  /** The user's role in it, a full key such as `org:admin`. */\n  orgRole: string | null;\n  /** Its slug; null without one or while the instance has slugs off. */\n  orgSlug: string | null;\n  /** The role's custom permissions, full keys such as `org:invoices:read`. */\n  orgPermissions: readonly string[] | null;\n  getToken: (options?: { skipCache?: boolean }) => Promise<string | null>;\n  signOut: (options?: { redirectUrl?: string }) => Promise<void>;\n  /**\n   * From the session token alone, the same rule as every Zautha SDK and your server: false without an active\n   * organization, and always false for a system permission (`org:sys_…`, never in the token).\n   */\n  has: Has;\n}\n\nconst isLoadedStatus = (status: string): boolean => status === \"ready\" || status === \"degraded\";\n\n/** The signed-in session: a pending one (tasks left, e.g. setting up two-step verification) counts as signed out. */\nconst activeSession = (state: ZauthaState): Session | null =>\n  state.session?.status === \"active\" ? state.session : null;\n\nexport function useAuth(): UseAuthResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const getToken = useCallback(\n    (options?: { skipCache?: boolean }) => zautha?.getToken(options) ?? Promise.resolve(null),\n    [zautha],\n  );\n  const signOut = useCallback(\n    (options?: { redirectUrl?: string }) => zautha?.signOut(options) ?? Promise.resolve(),\n    [zautha],\n  );\n  // Until the first load settles, the server's initial state (if any) answers, so nothing flickers.\n  const initial = state.status === \"loading\" ? state.initialState : null;\n  const session = activeSession(state);\n  const userId = initial === null ? (session?.userId ?? null) : initial.userId;\n  const sessionId = initial === null ? (session?.id ?? null) : initial.sessionId;\n  const signedIn = userId !== null;\n  const organization = initial === null ? (session === null ? null : state.organization) : initial.organization;\n  const has = useCallback<Has>((params) => checkAuthorization(organization, params), [organization]);\n  return {\n    isLoaded: isLoadedStatus(state.status) || initial !== null,\n    isSignedIn: signedIn,\n    userId,\n    sessionId,\n    orgId: organization?.id ?? null,\n    orgRole: organization?.role ?? null,\n    orgSlug: organization?.slug ?? null,\n    orgPermissions: organization?.permissions ?? null,\n    getToken,\n    signOut,\n    has,\n  };\n}\n\n/** The signed-in user with its self-service actions (`user.update`, `user.createEmailAddress`, …). */\nexport function useUser(): { isLoaded: boolean; isSignedIn: boolean; user: UserResource | null } {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const signedIn = activeSession(state) !== null;\n  // zautha.user is rebuilt only when state.user changes, so the resource is stable between renders.\n  const user = !signedIn || state.user === null ? null : (zautha?.user ?? null);\n  return { isLoaded: isLoadedStatus(state.status), isSignedIn: signedIn, user };\n}\n\n/**\n * Wraps a sensitive action so that it completes after an identity check when it needs one: when `fetcher` throws\n * `ReverificationRequiredError` (e.g. `user.updatePassword`) or resolves to a `Response` with the `403\n * reverification_required` body (your backend with @zautha/backend, @zautha/nextjs or Zautha.AspNetCore), the\n * reverification modal opens and, once the user has verified, `fetcher` runs once more with the same arguments (its\n * token is fresh by then). Closing the modal rejects with `ReverificationCancelledError`. Needs `ui` from @zautha/ui on\n * the provider. The returned function is stable; it always calls the latest `fetcher`.\n */\nexport function useReverification<Args extends unknown[], Result>(\n  fetcher: (...args: Args) => Promise<Result>,\n): (...args: Args) => Promise<Result> {\n  const zautha = useZautha();\n  const latest = useRef(fetcher);\n  useLayoutEffect(() => {\n    latest.current = fetcher;\n  });\n  return useCallback(\n    (...args: Args) => {\n      const call = (...callArgs: Args): Promise<Result> => latest.current(...callArgs);\n      // Before the provider has created the instance no modal can open: the action runs as it is.\n      return zautha === null ? call(...args) : withReverification(zautha, call)(...args);\n    },\n    [zautha],\n  );\n}\n\n/** The signed-in session; null while signed out or while the session is pending (tasks left). */\nexport function useSession(): { isLoaded: boolean; isSignedIn: boolean; session: Session | null } {\n  const state = useZauthaState();\n  const session = activeSession(state);\n  return { isLoaded: isLoadedStatus(state.status), isSignedIn: session !== null, session };\n}\n\nconst noopSubscribe = (): (() => void) => () => undefined;\n\nfunction useResource<T extends SignInResource | SignUpResource>(resource: T | null) {\n  const snapshot = useSyncExternalStore(\n    resource?.subscribe ?? noopSubscribe,\n    () => resource?.snapshot ?? null,\n    () => null,\n  );\n  return snapshot;\n}\n\nexport interface UseSignInResult {\n  isLoaded: boolean;\n  /** The sign-in resource; null until the provider has created the instance. */\n  signIn: SignInResource | null;\n  errors: AttemptErrors;\n  fetchStatus: FetchStatus;\n}\n\nconst NO_ERRORS: AttemptErrors = { fields: {}, global: [] };\n\nexport function useSignIn(): UseSignInResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const snapshot = useResource(zautha?.signIn ?? null);\n  return {\n    isLoaded: isLoadedStatus(state.status),\n    signIn: zautha?.signIn ?? null,\n    errors: snapshot?.errors ?? NO_ERRORS,\n    fetchStatus: snapshot?.fetchStatus ?? \"idle\",\n  };\n}\n\nexport interface UseSignUpResult {\n  isLoaded: boolean;\n  signUp: SignUpResource | null;\n  errors: AttemptErrors;\n  fetchStatus: FetchStatus;\n}\n\nexport function useSignUp(): UseSignUpResult {\n  const zautha = useZautha();\n  const state = useZauthaState();\n  const snapshot = useResource(zautha?.signUp ?? null);\n  return {\n    isLoaded: isLoadedStatus(state.status),\n    signUp: zautha?.signUp ?? null,\n    errors: snapshot?.errors ?? NO_ERRORS,\n    fetchStatus: snapshot?.fetchStatus ?? \"idle\",\n  };\n}\n","import { useEffect, type ReactNode } from \"react\";\nimport { useAuth, type Has, type HasParams } from \"./hooks\";\nimport { useZautha, useZauthaState } from \"./provider\";\n\nexport type ShowWhen = \"signed-in\" | \"signed-out\" | HasParams | ((has: Has) => boolean);\n\n/**\n * Renders `children` when the condition holds, else `fallback`. Renders nothing until Zautha has\n * loaded, so a signed-in user never sees a signed-out flash.\n */\nexport function Show(props: { when: ShowWhen; fallback?: ReactNode; children?: ReactNode }): ReactNode {\n  const { isLoaded, isSignedIn, has } = useAuth();\n  if (!isLoaded) return null;\n  const { when } = props;\n  const pass =\n    when === \"signed-in\"\n      ? isSignedIn\n      : when === \"signed-out\"\n        ? !isSignedIn\n        : typeof when === \"function\"\n          ? when(has)\n          : has(when);\n  return pass ? props.children : (props.fallback ?? null);\n}\n\nexport function ZauthaLoading(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"loading\" ? props.children : null;\n}\n\n/** Loaded, including degraded (network trouble after load: last known state is shown). */\nexport function ZauthaLoaded(props: { children?: ReactNode }): ReactNode {\n  const { status } = useZauthaState();\n  return status === \"ready\" || status === \"degraded\" ? props.children : null;\n}\n\nexport function ZauthaDegraded(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"degraded\" ? props.children : null;\n}\n\nexport function ZauthaFailed(props: { children?: ReactNode }): ReactNode {\n  return useZauthaState().status === \"failed\" ? props.children : null;\n}\n\n/** Sends a signed-out visitor to sign-in once loaded; renders nothing. */\nexport function RedirectToSignIn(props: { redirectUrl?: string }): ReactNode {\n  const zautha = useZautha();\n  const { isLoaded, isSignedIn } = useAuth();\n  const { redirectUrl } = props;\n  useEffect(() => {\n    if (zautha !== null && isLoaded && !isSignedIn)\n      zautha.redirectToSignIn(redirectUrl === undefined ? {} : { redirectUrl });\n  }, [zautha, isLoaded, isSignedIn, redirectUrl]);\n  return null;\n}\n\nexport function RedirectToSignUp(props: { redirectUrl?: string }): ReactNode {\n  const zautha = useZautha();\n  const { isLoaded, isSignedIn } = useAuth();\n  const { redirectUrl } = props;\n  useEffect(() => {\n    if (zautha !== null && isLoaded && !isSignedIn)\n      zautha.redirectToSignUp(redirectUrl === undefined ? {} : { redirectUrl });\n  }, [zautha, isLoaded, isSignedIn, redirectUrl]);\n  return null;\n}\n","import { Children, cloneElement, isValidElement, type MouseEvent, type ReactElement, type ReactNode } from \"react\";\nimport { useZautha } from \"./provider\";\n\ninterface ButtonProps {\n  /** `redirect` (default) goes to the sign-in page; `modal` opens the prebuilt component (needs `ui`). */\n  mode?: \"redirect\" | \"modal\";\n  redirectUrl?: string;\n  children?: ReactNode;\n}\n\n/** Wraps its single child (or renders a plain button) and wires the click. Unstyled by design. */\nfunction Trigger(props: { children: ReactNode; label: string; onClick: () => void }): ReactNode {\n  const child = Children.count(props.children) === 1 ? Children.only(props.children) : null;\n  if (isValidElement<{ onClick?: (event: MouseEvent) => void }>(child)) {\n    const original = child.props.onClick;\n    return cloneElement(child as ReactElement<{ onClick?: (event: MouseEvent) => void }>, {\n      onClick: (event: MouseEvent) => {\n        original?.(event);\n        if (!event.defaultPrevented) props.onClick();\n      },\n    });\n  }\n  return (\n    <button type=\"button\" onClick={props.onClick}>\n      {props.children ?? props.label}\n    </button>\n  );\n}\n\nexport function SignInButton(props: ButtonProps): ReactNode {\n  const zautha = useZautha();\n  const options = props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl };\n  return (\n    <Trigger\n      label=\"Sign in\"\n      onClick={() => (props.mode === \"modal\" ? zautha?.openSignIn(options) : zautha?.redirectToSignIn(options))}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n\nexport function SignUpButton(props: ButtonProps): ReactNode {\n  const zautha = useZautha();\n  const options = props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl };\n  return (\n    <Trigger\n      label=\"Sign up\"\n      onClick={() => (props.mode === \"modal\" ? zautha?.openSignUp(options) : zautha?.redirectToSignUp(options))}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n\nexport function SignOutButton(props: { redirectUrl?: string; children?: ReactNode }): ReactNode {\n  const zautha = useZautha();\n  return (\n    <Trigger\n      label=\"Sign out\"\n      onClick={() => void zautha?.signOut(props.redirectUrl === undefined ? {} : { redirectUrl: props.redirectUrl })}\n    >\n      {props.children}\n    </Trigger>\n  );\n}\n","import type { UiComponentName } from \"@zautha/js\";\nimport { useEffect, useRef, type ReactNode } from \"react\";\nimport { useZautha } from \"./provider\";\n\n/**\n * Mounts a @zautha/ui component into a div once the instance exists; later prop changes update it in\n * place. SSR renders only the empty div.\n */\nfunction Mounted(props: { name: UiComponentName; componentProps: object }): ReactNode {\n  const zautha = useZautha();\n  const ref = useRef<HTMLDivElement>(null);\n  const mountedWith = useRef<object | null>(null);\n  const { name, componentProps } = props;\n\n  useEffect(() => {\n    const element = ref.current;\n    if (zautha === null || element === null) return;\n    zautha.mount(name, element, componentProps);\n    mountedWith.current = componentProps;\n    return () => {\n      mountedWith.current = null;\n      zautha.unmount(element);\n    };\n    // componentProps changes are applied by the effect below without remounting.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [zautha, name]);\n\n  useEffect(() => {\n    const element = ref.current;\n    if (zautha === null || element === null || mountedWith.current === null || mountedWith.current === componentProps)\n      return;\n    mountedWith.current = componentProps;\n    zautha.updateMounted(element, componentProps);\n  }, [zautha, componentProps]);\n\n  return <div ref={ref} />;\n}\n\n// Prop types live in @zautha/ui; they are structural here so @zautha/react has no runtime dependency on it.\nexport function SignIn(props: import(\"@zautha/ui\").SignInProps): ReactNode {\n  return <Mounted name=\"SignIn\" componentProps={props} />;\n}\n\nexport function SignUp(props: import(\"@zautha/ui\").SignUpProps): ReactNode {\n  return <Mounted name=\"SignUp\" componentProps={props} />;\n}\n\n/** The page a provider sends the user back to: finishes the social sign-in or sign-up (see @zautha/ui). */\nexport function AuthenticateWithRedirectCallback(\n  props: import(\"@zautha/ui\").AuthenticateWithRedirectCallbackProps,\n): ReactNode {\n  return <Mounted name=\"AuthenticateWithRedirectCallback\" componentProps={props} />;\n}\n\nexport function UserButton(props: import(\"@zautha/ui\").UserButtonProps): ReactNode {\n  return <Mounted name=\"UserButton\" componentProps={props} />;\n}\n\nexport function UserProfile(props: import(\"@zautha/ui\").UserProfileProps): ReactNode {\n  return <Mounted name=\"UserProfile\" componentProps={props} />;\n}\n\nexport function OAuthConsent(props: import(\"@zautha/ui\").OAuthConsentProps): ReactNode {\n  return <Mounted name=\"OAuthConsent\" componentProps={props} />;\n}\n"],"mappings":";;;;;AASA,MAAM,gBAAgB,cAA8C,KAAA,CAAS;;;;;;AAY7E,SAAgB,eAAe,EAAE,gBAAgB,UAAU,GAAG,WAA2C;CACvG,MAAM,CAAC,QAAQ,aAAa,SAAwB,IAAI;CACxD,MAAM,EAAE,IAAI,YAAY,cAAc,WAAW,WAAW,UAAU,iBAAiB;CACvF,MAAM,CAAC,WAAW,gBAA6B;EAAE,GAAG;EAAU,cAAc,gBAAgB;CAAK,EAAE;CAEnG,gBAAgB;EACd,MAAM,WAAW,IAAI,OAAO,gBAAgB;GAC1C,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GACjC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;GACrD,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;GAC/C,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;GAC/C,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS;GAC7C,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;EAGD,UAAU,QAAQ;EAClB,SAAc,KAAK;EACnB,aAAa;GACX,SAAS,QAAQ;GACjB,UAAU,IAAI;EAChB;CAGF,GAAG,CAAC,cAAc,CAAC;CAEnB,MAAM,QAAQ,eAAe;EAAE;EAAQ;CAAQ,IAAI,CAAC,QAAQ,OAAO,CAAC;CACpE,OAAO,oBAAC,cAAc,UAAf;EAA+B;EAAQ;CAAiC,CAAA;AACjF;;AAGA,SAAgB,YAA2B;CACzC,OAAO,iBAAiB,CAAC,CAAC;AAC5B;AAEA,SAAS,mBAAuC;CAC9C,MAAM,QAAQ,WAAW,aAAa;CACtC,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,mEAAmE;CAC5G,OAAO;AACT;AAEA,MAAM,WAAwB;CAC5B,QAAQ;CACR,aAAa;CACb,QAAQ;CACR,SAAS;CACT,MAAM;CACN,cAAc;CACd,cAAc;AAChB;AACA,MAAM,mBAAiC,KAAA;;AAGvC,SAAgB,iBAA8B;CAC5C,MAAM,EAAE,QAAQ,YAAY,iBAAiB;CAC7C,OAAO,qBACL,QAAQ,aAAa,YACf,QAAQ,YAAY,KAAK,eACzB,OACR;AACF;;;ACvCA,MAAM,kBAAkB,WAA4B,WAAW,WAAW,WAAW;;AAGrF,MAAM,iBAAiB,UACrB,MAAM,SAAS,WAAW,WAAW,MAAM,UAAU;AAEvD,SAAgB,UAAyB;CACvC,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,aACd,YAAsC,QAAQ,SAAS,OAAO,KAAK,QAAQ,QAAQ,IAAI,GACxF,CAAC,MAAM,CACT;CACA,MAAM,UAAU,aACb,YAAuC,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,GACpF,CAAC,MAAM,CACT;CAEA,MAAM,UAAU,MAAM,WAAW,YAAY,MAAM,eAAe;CAClE,MAAM,UAAU,cAAc,KAAK;CACnC,MAAM,SAAS,YAAY,OAAQ,SAAS,UAAU,OAAQ,QAAQ;CACtE,MAAM,YAAY,YAAY,OAAQ,SAAS,MAAM,OAAQ,QAAQ;CACrE,MAAM,WAAW,WAAW;CAC5B,MAAM,eAAe,YAAY,OAAQ,YAAY,OAAO,OAAO,MAAM,eAAgB,QAAQ;CACjG,MAAM,MAAM,aAAkB,WAAW,mBAAmB,cAAc,MAAM,GAAG,CAAC,YAAY,CAAC;CACjG,OAAO;EACL,UAAU,eAAe,MAAM,MAAM,KAAK,YAAY;EACtD,YAAY;EACZ;EACA;EACA,OAAO,cAAc,MAAM;EAC3B,SAAS,cAAc,QAAQ;EAC/B,SAAS,cAAc,QAAQ;EAC/B,gBAAgB,cAAc,eAAe;EAC7C;EACA;EACA;CACF;AACF;;AAGA,SAAgB,UAAiF;CAC/F,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,cAAc,KAAK,MAAM;CAE1C,MAAM,OAAO,CAAC,YAAY,MAAM,SAAS,OAAO,OAAQ,QAAQ,QAAQ;CACxE,OAAO;EAAE,UAAU,eAAe,MAAM,MAAM;EAAG,YAAY;EAAU;CAAK;AAC9E;;;;;;;;;AAUA,SAAgB,kBACd,SACoC;CACpC,MAAM,SAAS,UAAU;CACzB,MAAM,SAAS,OAAO,OAAO;CAC7B,sBAAsB;EACpB,OAAO,UAAU;CACnB,CAAC;CACD,OAAO,aACJ,GAAG,SAAe;EACjB,MAAM,QAAQ,GAAG,aAAoC,OAAO,QAAQ,GAAG,QAAQ;EAE/E,OAAO,WAAW,OAAO,KAAK,GAAG,IAAI,IAAI,mBAAmB,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI;CACnF,GACA,CAAC,MAAM,CACT;AACF;;AAGA,SAAgB,aAAkF;CAChG,MAAM,QAAQ,eAAe;CAC7B,MAAM,UAAU,cAAc,KAAK;CACnC,OAAO;EAAE,UAAU,eAAe,MAAM,MAAM;EAAG,YAAY,YAAY;EAAM;CAAQ;AACzF;AAEA,MAAM,4BAA0C,KAAA;AAEhD,SAAS,YAAuD,UAAoB;CAMlF,OALiB,qBACf,UAAU,aAAa,qBACjB,UAAU,YAAY,YACtB,IAEM;AAChB;AAUA,MAAM,YAA2B;CAAE,QAAQ,CAAC;CAAG,QAAQ,CAAC;AAAE;AAE1D,SAAgB,YAA6B;CAC3C,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,YAAY,QAAQ,UAAU,IAAI;CACnD,OAAO;EACL,UAAU,eAAe,MAAM,MAAM;EACrC,QAAQ,QAAQ,UAAU;EAC1B,QAAQ,UAAU,UAAU;EAC5B,aAAa,UAAU,eAAe;CACxC;AACF;AASA,SAAgB,YAA6B;CAC3C,MAAM,SAAS,UAAU;CACzB,MAAM,QAAQ,eAAe;CAC7B,MAAM,WAAW,YAAY,QAAQ,UAAU,IAAI;CACnD,OAAO;EACL,UAAU,eAAe,MAAM,MAAM;EACrC,QAAQ,QAAQ,UAAU;EAC1B,QAAQ,UAAU,UAAU;EAC5B,aAAa,UAAU,eAAe;CACxC;AACF;;;;;;;ACtKA,SAAgB,KAAK,OAAkF;CACrG,MAAM,EAAE,UAAU,YAAY,QAAQ,QAAQ;CAC9C,IAAI,CAAC,UAAU,OAAO;CACtB,MAAM,EAAE,SAAS;CASjB,QAPE,SAAS,cACL,aACA,SAAS,eACP,CAAC,aACD,OAAO,SAAS,aACd,KAAK,GAAG,IACR,IAAI,IAAI,KACJ,MAAM,WAAY,MAAM,YAAY;AACpD;AAEA,SAAgB,cAAc,OAA4C;CACxE,OAAO,eAAe,CAAC,CAAC,WAAW,YAAY,MAAM,WAAW;AAClE;;AAGA,SAAgB,aAAa,OAA4C;CACvE,MAAM,EAAE,WAAW,eAAe;CAClC,OAAO,WAAW,WAAW,WAAW,aAAa,MAAM,WAAW;AACxE;AAEA,SAAgB,eAAe,OAA4C;CACzE,OAAO,eAAe,CAAC,CAAC,WAAW,aAAa,MAAM,WAAW;AACnE;AAEA,SAAgB,aAAa,OAA4C;CACvE,OAAO,eAAe,CAAC,CAAC,WAAW,WAAW,MAAM,WAAW;AACjE;;AAGA,SAAgB,iBAAiB,OAA4C;CAC3E,MAAM,SAAS,UAAU;CACzB,MAAM,EAAE,UAAU,eAAe,QAAQ;CACzC,MAAM,EAAE,gBAAgB;CACxB,gBAAgB;EACd,IAAI,WAAW,QAAQ,YAAY,CAAC,YAClC,OAAO,iBAAiB,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,CAAC;CAC5E,GAAG;EAAC;EAAQ;EAAU;EAAY;CAAW,CAAC;CAC9C,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAA4C;CAC3E,MAAM,SAAS,UAAU;CACzB,MAAM,EAAE,UAAU,eAAe,QAAQ;CACzC,MAAM,EAAE,gBAAgB;CACxB,gBAAgB;EACd,IAAI,WAAW,QAAQ,YAAY,CAAC,YAClC,OAAO,iBAAiB,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,CAAC;CAC5E,GAAG;EAAC;EAAQ;EAAU;EAAY;CAAW,CAAC;CAC9C,OAAO;AACT;;;;ACrDA,SAAS,QAAQ,OAA+E;CAC9F,MAAM,QAAQ,SAAS,MAAM,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,MAAM,QAAQ,IAAI;CACrF,IAAI,eAA0D,KAAK,GAAG;EACpE,MAAM,WAAW,MAAM,MAAM;EAC7B,OAAO,aAAa,OAAkE,EACpF,UAAU,UAAsB;GAC9B,WAAW,KAAK;GAChB,IAAI,CAAC,MAAM,kBAAkB,MAAM,QAAQ;EAC7C,EACF,CAAC;CACH;CACA,OACE,oBAAC,UAAD;EAAQ,MAAK;EAAS,SAAS,MAAM;EAClC,UAAA,MAAM,YAAY,MAAM;CACnB,CAAA;AAEZ;AAEA,SAAgB,aAAa,OAA+B;CAC1D,MAAM,SAAS,UAAU;CACzB,MAAM,UAAU,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;CACxF,OACE,oBAAC,SAAD;EACE,OAAM;EACN,eAAgB,MAAM,SAAS,UAAU,QAAQ,WAAW,OAAO,IAAI,QAAQ,iBAAiB,OAAO;EAEtG,UAAA,MAAM;CACA,CAAA;AAEb;AAEA,SAAgB,aAAa,OAA+B;CAC1D,MAAM,SAAS,UAAU;CACzB,MAAM,UAAU,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;CACxF,OACE,oBAAC,SAAD;EACE,OAAM;EACN,eAAgB,MAAM,SAAS,UAAU,QAAQ,WAAW,OAAO,IAAI,QAAQ,iBAAiB,OAAO;EAEtG,UAAA,MAAM;CACA,CAAA;AAEb;AAEA,SAAgB,cAAc,OAAkE;CAC9F,MAAM,SAAS,UAAU;CACzB,OACE,oBAAC,SAAD;EACE,OAAM;EACN,eAAe,KAAK,QAAQ,QAAQ,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY,CAAC;EAE5G,UAAA,MAAM;CACA,CAAA;AAEb;;;;;;;ACzDA,SAAS,QAAQ,OAAqE;CACpF,MAAM,SAAS,UAAU;CACzB,MAAM,MAAM,OAAuB,IAAI;CACvC,MAAM,cAAc,OAAsB,IAAI;CAC9C,MAAM,EAAE,MAAM,mBAAmB;CAEjC,gBAAgB;EACd,MAAM,UAAU,IAAI;EACpB,IAAI,WAAW,QAAQ,YAAY,MAAM;EACzC,OAAO,MAAM,MAAM,SAAS,cAAc;EAC1C,YAAY,UAAU;EACtB,aAAa;GACX,YAAY,UAAU;GACtB,OAAO,QAAQ,OAAO;EACxB;CAGF,GAAG,CAAC,QAAQ,IAAI,CAAC;CAEjB,gBAAgB;EACd,MAAM,UAAU,IAAI;EACpB,IAAI,WAAW,QAAQ,YAAY,QAAQ,YAAY,YAAY,QAAQ,YAAY,YAAY,gBACjG;EACF,YAAY,UAAU;EACtB,OAAO,cAAc,SAAS,cAAc;CAC9C,GAAG,CAAC,QAAQ,cAAc,CAAC;CAE3B,OAAO,oBAAC,OAAD,EAAU,IAAM,CAAA;AACzB;AAGA,SAAgB,OAAO,OAAoD;CACzE,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAS,gBAAgB;CAAQ,CAAA;AACxD;AAEA,SAAgB,OAAO,OAAoD;CACzE,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAS,gBAAgB;CAAQ,CAAA;AACxD;;AAGA,SAAgB,iCACd,OACW;CACX,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAmC,gBAAgB;CAAQ,CAAA;AAClF;AAEA,SAAgB,WAAW,OAAwD;CACjF,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAa,gBAAgB;CAAQ,CAAA;AAC5D;AAEA,SAAgB,YAAY,OAAyD;CACnF,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAc,gBAAgB;CAAQ,CAAA;AAC7D;AAEA,SAAgB,aAAa,OAA0D;CACrF,OAAO,oBAAC,SAAD;EAAS,MAAK;EAAe,gBAAgB;CAAQ,CAAA;AAC9D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zautha/react",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "private": false,
   "description": "React bindings for Zautha: provider, hooks, <Show>, buttons and prebuilt components.",
   "license": "MIT",
@@ -31,12 +31,12 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@zautha/js": "^0.7.0"
+    "@zautha/js": "^0.9.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "@zautha/ui": "^0.7.0"
+    "@zautha/ui": "^0.9.0"
   },
   "devDependencies": {
     "@size-limit/preset-small-lib": "14.0.1",
@@ -44,7 +44,7 @@
     "@testing-library/user-event": "14.6.7",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
-    "@zautha/ui": "0.7.0",
+    "@zautha/ui": "0.9.0",
     "happy-dom": "20.14.5",
     "msw": "2.15.0",
     "react": "19.3.0",