cauthy-auth 0.19.0 → 0.22.0

package/dist/react.js

@@ -25,6 +25,7 @@ __export(react_exports, {
   CauthyProvider: () => CauthyProvider,
   ForgotPassword: () => ForgotPassword,
   GoogleOneTap: () => GoogleOneTap,
+  OrganizationMembers: () => OrganizationMembers,
   ResetPassword: () => ResetPassword,
   SignIn: () => SignIn,
   SignUp: () => SignUp,
@@ -266,8 +267,14 @@ function createAuthClient(options = {}) {
       return null;
     }
   }
+  const upgradeUrl = (provider, o = {}) => `${base}/me/upgrade/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const linkUrl = (provider, o = {}) => `${base}/me/identities/link/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const socialUrl = (provider, o = {}) => `${base}/sign-in/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
+  const ssoUrl = (target, o = {}) => {
+    const q = new URLSearchParams("connection" in target ? { connection: target.connection } : { email: target.email.trim() });
+    if (o.returnTo) q.set("return_to", o.returnTo);
+    return `${base}/sign-in/sso?${q}`;
+  };
   const passkeyUrl = (o = {}) => {
     const q = new URLSearchParams({ method: "passkey" });
     if (o.returnTo) q.set("return_to", o.returnTo);
@@ -279,11 +286,11 @@ function createAuthClient(options = {}) {
       const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
       if (res.ok) {
         const m = await res.json();
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false };
+    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -298,6 +305,7 @@ function createAuthClient(options = {}) {
   }
   return {
     signIn: {
+      anonymously: (f = {}) => post("/sign-in/anonymous", {}, null, f.captchaToken),
       email: (f) => post("/sign-in/email", { email: f.email, password: f.password }, firstProblem(checkEmail(f.email), checkPassword(f.password)), f.captchaToken),
       mfa: (f) => post("/sign-in/mfa", { code: f.code }, checkCode(f.code)),
       mfaMethods: () => post("/sign-in/mfa/methods", {}, null),
@@ -381,6 +389,11 @@ function createAuthClient(options = {}) {
       socialUrl,
       social(provider, o) {
         window.location.assign(socialUrl(provider, o));
+      },
+      ssoDiscover: (f) => post("/sign-in/sso/discover", { email: f.email.trim() }, checkEmail(f.email)),
+      ssoUrl,
+      sso(target, o) {
+        window.location.assign(ssoUrl(target, o));
       }
     },
     signUp: {
@@ -390,6 +403,24 @@ function createAuthClient(options = {}) {
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
     signOut: () => post("/sign-out", {}, null),
+    organizations: {
+      async list(system) {
+        const body = await read(`/me/organizations${system ? `?system=${encodeURIComponent(system)}` : ""}`);
+        return body && Array.isArray(body.organizations) ? body.organizations : [];
+      },
+      async members(id) {
+        const body = await read(`/me/organizations/members?id=${encodeURIComponent(id)}`);
+        return body && Array.isArray(body.members) ? body.members : null;
+      },
+      async roles(id) {
+        const body = await read(`/me/organizations/roles?id=${encodeURIComponent(id)}`);
+        return body && Array.isArray(body.roles) ? body.roles : null;
+      },
+      add: (id, f) => post("/me/organizations/members/add", { organizationId: id, email: f.email, role: f.role, name: f.name ?? "", locale: f.locale ?? "" }, checkEmail(f.email)),
+      setRole: (id, userId, role) => post("/me/organizations/members/role", { organizationId: id, userId, role }, null),
+      remove: (id, userId) => post("/me/organizations/members/remove", { organizationId: id, userId }, null),
+      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null)
+    },
     account: {
       async get() {
         const body = await read("/me");
@@ -428,6 +459,11 @@ function createAuthClient(options = {}) {
         return body && Array.isArray(body.sessions) ? body.sessions : [];
       },
       signOutEverywhere: () => post("/me/sessions/end", {}, null),
+      upgrade: (f) => post("/me/upgrade", { email: f.email, password: f.password, name: f.name ?? "" }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password))),
+      upgradeUrl,
+      upgradeWith(provider, o) {
+        window.location.assign(upgradeUrl(provider, o));
+      },
       async agents() {
         const body = await read("/me/agents");
         return body && Array.isArray(body.agents) ? body.agents : [];
@@ -601,7 +637,30 @@ var TEXTS = {
     linkWith: "Link",
     unlink: "Unlink",
     linked: "The account was linked.",
+    ssoOnly: "Your company signs you in to this account.",
+    members: "Members",
+    membersHidden: "Your role here does not let you see the members.",
+    organizationMissing: "You do not belong to this organization.",
+    memberYou: "you",
+    memberInvited: "invited",
+    memberManager: "manages members",
+    memberRole: "Role",
+    memberAdd: "Add member",
+    memberAdded: "{email} is a member now.",
+    memberRemove: "Remove",
+    memberRemoveConfirm: "Remove {who}?",
+    memberLeave: "Leave",
+    memberLeaveConfirm: "Leave {org}? You will need an invitation to come back.",
+    memberInviteAgain: "Send the invitation again",
+    memberInvitationSent: "The invitation is on its way.",
+    yes: "Yes",
+    cancel: "Cancel",
     errors: {
+      not_allowed: "Your role in this organization does not allow that.",
+      last_manager: "Somebody else must manage the members first: give that role to another member.",
+      already_member: "That person already belongs to the organization. Change their role instead.",
+      unknown_role: "Choose one of the roles offered.",
+      user_not_active: "That account is disabled.",
       required: "This is required.",
       invalid_email: "That does not look like an email address.",
       too_short: "Use at least 8 characters.",
@@ -629,7 +688,15 @@ var TEXTS = {
       captcha_failed: "The check that you are not a bot did not pass. Try it again.",
       passkey_failed: "The passkey could not be used. Try again, or sign in another way.",
       passkey_exists: "This device already has a passkey for your account.",
-      passkey_unavailable: "Passkeys cannot be used here."
+      passkey_unavailable: "Passkeys cannot be used here.",
+      sso_required: "This address signs in through its company.",
+      sso_not_found: "No company sign-in answers for this address.",
+      sso_failed: "The sign-in with your company could not be completed. Try again.",
+      sso_unavailable: "Your company's sign-in cannot be reached right now. Try again in a moment.",
+      invalid_assertion: "Your company's answer could not be checked. Try again.",
+      provisioning_disabled: "Your company's sign-in worked, but this workspace has no account for you. Ask its admin to add you.",
+      connection_inactive: "Your company's sign-in is turned off for this workspace.",
+      invalid_grant: "That sign-in expired. Try again."
     }
   },
   es: {
@@ -716,7 +783,30 @@ var TEXTS = {
     linkWith: "Vincular",
     unlink: "Desvincular",
     linked: "La cuenta qued\xF3 vinculada.",
+    ssoOnly: "A esta cuenta entras con el inicio de sesi\xF3n de tu empresa.",
+    members: "Miembros",
+    membersHidden: "Tu rol aqu\xED no te deja ver los miembros.",
+    organizationMissing: "No perteneces a esta organizaci\xF3n.",
+    memberYou: "t\xFA",
+    memberInvited: "invitado",
+    memberManager: "administra los miembros",
+    memberRole: "Rol",
+    memberAdd: "Agregar miembro",
+    memberAdded: "{email} ya es miembro.",
+    memberRemove: "Quitar",
+    memberRemoveConfirm: "\xBFQuitar a {who}?",
+    memberLeave: "Salir",
+    memberLeaveConfirm: "\xBFSalir de {org}? Necesitar\xE1s una invitaci\xF3n para volver.",
+    memberInviteAgain: "Enviar la invitaci\xF3n de nuevo",
+    memberInvitationSent: "La invitaci\xF3n va en camino.",
+    yes: "S\xED",
+    cancel: "Cancelar",
     errors: {
+      not_allowed: "Tu rol en esta organizaci\xF3n no permite eso.",
+      last_manager: "Primero alguien m\xE1s debe administrar los miembros: dale ese rol a otro miembro.",
+      already_member: "Esa persona ya pertenece a la organizaci\xF3n. Cambia su rol.",
+      unknown_role: "Escoge uno de los roles ofrecidos.",
+      user_not_active: "Esa cuenta est\xE1 desactivada.",
       required: "Este dato es obligatorio.",
       invalid_email: "Eso no parece un correo.",
       too_short: "Usa al menos 8 caracteres.",
@@ -744,7 +834,15 @@ var TEXTS = {
       captcha_failed: "La verificaci\xF3n de que no eres un robot no pas\xF3. Int\xE9ntalo de nuevo.",
       passkey_failed: "No se pudo usar la llave de acceso. Intenta de nuevo o entra de otra forma.",
       passkey_exists: "Este dispositivo ya tiene una llave de acceso de tu cuenta.",
-      passkey_unavailable: "Aqu\xED no se pueden usar llaves de acceso."
+      passkey_unavailable: "Aqu\xED no se pueden usar llaves de acceso.",
+      sso_required: "Este correo entra con el inicio de sesi\xF3n de su empresa.",
+      sso_not_found: "Ninguna empresa usa inicio de sesi\xF3n propio con este correo.",
+      sso_failed: "No se pudo completar el ingreso con tu empresa. Intenta de nuevo.",
+      sso_unavailable: "Ahora no se puede llegar al inicio de sesi\xF3n de tu empresa. Intenta en un momento.",
+      invalid_assertion: "No se pudo verificar la respuesta de tu empresa. Intenta de nuevo.",
+      provisioning_disabled: "El ingreso con tu empresa funcion\xF3, pero este workspace no tiene una cuenta para ti. P\xEDdele a su admin que te agregue.",
+      connection_inactive: "El inicio de sesi\xF3n de tu empresa est\xE1 apagado en este workspace.",
+      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo."
     }
   }
 };
@@ -937,6 +1035,25 @@ function SignIn(props) {
   };
   const autofill = (0, import_react.useRef)(null);
   const [offer, setOffer] = (0, import_react.useState)(0);
+  const [company, setCompany] = (0, import_react.useState)(null);
+  (0, import_react.useEffect)(() => {
+    if (!methods?.sso || checkEmail(email) !== null) return setCompany(null);
+    let current = true;
+    const t = setTimeout(() => {
+      void auth.signIn.ssoDiscover({ email }).then((r) => {
+        if (current) setCompany(r.ok && r.status === "found" ? r.connection : null);
+      });
+    }, 350);
+    return () => {
+      current = false;
+      clearTimeout(t);
+    };
+  }, [email, methods]);
+  const toCompany = () => {
+    autofill.current?.abort();
+    f.setBusy(true);
+    auth.signIn.sso({ email }, { returnTo: props.returnTo });
+  };
   (0, import_react.useEffect)(() => {
     void auth.methods().then(setMethods);
     const back = returnedError();
@@ -969,9 +1086,11 @@ function SignIn(props) {
     autofill.current?.abort();
     f.setBusy(true);
     f.setError(null);
+    if (step === "password" && company?.enforced) return toCompany();
     const r = step === "code" ? await auth.signIn.mfa({ code }) : step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token });
     f.setBusy(false);
     if (step === "password") challenge.renew();
+    if (!r.ok && r.error.code === "sso_required") return toCompany();
     if (!r.ok) {
       setOffer((n) => n + 1);
       return f.setError(r.error);
@@ -997,6 +1116,7 @@ function SignIn(props) {
     const r = await auth.signIn.magicLink({ email, captchaToken: challenge.token, create: props.createAccounts, returnTo: props.returnTo });
     f.setBusy(false);
     challenge.renew();
+    if (!r.ok && r.error.code === "sso_required") return toCompany();
     if (!r.ok) return f.setError(r.error);
     setStep("sent");
   };
@@ -1031,23 +1151,31 @@ function SignIn(props) {
     methods?.passkey && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
     ((methods?.providers.length ?? 0) > 0 || methods?.passkey) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-      Field,
-      {
-        f,
-        name: "password",
-        type: "password",
-        label: f.t.password,
-        value: password,
-        autoComplete: "current-password",
-        required: true,
-        onChange: setPassword,
-        aside: props.links?.forgotPassword ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.forgotPassword, children: f.t.forgotPassword }) : void 0
-      }
-    ),
-    challenge.node,
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signIn }),
-    methods?.magicLink && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendLink(), children: f.t.emailMeALink }),
+    company && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(f.Button, { type: "button", disabled: f.busy, className: f.cx(company.enforced ? "button" : "providerButton"), onClick: toCompany, children: [
+      f.t.continueWith,
+      " ",
+      company.name
+    ] }),
+    company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.ssoOnly }),
+    !company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        Field,
+        {
+          f,
+          name: "password",
+          type: "password",
+          label: f.t.password,
+          value: password,
+          autoComplete: "current-password",
+          required: true,
+          onChange: setPassword,
+          aside: props.links?.forgotPassword ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: props.links.forgotPassword, children: f.t.forgotPassword }) : void 0
+        }
+      ),
+      challenge.node,
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signIn })
+    ] }),
+    methods?.magicLink && !company?.enforced && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendLink(), children: f.t.emailMeALink }),
     methods?.signUp !== false && props.links?.signUp && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { className: f.cx("footer"), children: [
       f.t.noAccount,
       " ",
@@ -1082,7 +1210,7 @@ function SignUp(props) {
     e.preventDefault();
     f.setBusy(true);
     f.setError(null);
-    const r = await auth.signUp.email({ name, email, password, captchaToken: challenge.token });
+    const r = auth.session?.user.isAnonymous === true ? await auth.account.upgrade({ name, email, password }) : await auth.signUp.email({ name, email, password, captchaToken: challenge.token });
     f.setBusy(false);
     challenge.renew();
     if (!r.ok) return f.setError(r.error);
@@ -1252,6 +1380,130 @@ function Account(props) {
     ] })
   ] });
 }
+function OrganizationMembers(props) {
+  const auth = useAuth();
+  const { root } = useForm(props);
+  const { f, done, setDone, run } = useSection(props);
+  const problem = f.error && f.error.field !== "email" ? f.error : null;
+  const [seat, setSeat] = (0, import_react.useState)(void 0);
+  const [members, setMembers] = (0, import_react.useState)(null);
+  const [roles, setRoles] = (0, import_react.useState)([]);
+  const [email, setEmail] = (0, import_react.useState)("");
+  const [role, setRole] = (0, import_react.useState)("");
+  const [asking, setAsking] = (0, import_react.useState)(null);
+  const id = props.organizationId;
+  const when = props.formatDate ?? ((iso) => new Date(iso).toLocaleDateString());
+  const load = async () => {
+    const [list, people, choices] = await Promise.all([auth.organizations.list(), auth.organizations.members(id), auth.organizations.roles(id)]);
+    setSeat(list.find((o) => o.id === id) ?? null);
+    setMembers(people);
+    setRoles(choices ?? []);
+    if (choices && choices.length > 0 && !choices.some((c) => c.role === role)) setRole(choices[0].role);
+  };
+  (0, import_react.useEffect)(() => {
+    void load();
+  }, [id]);
+  if (seat === void 0) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, "aria-busy": "true" });
+  if (seat === null) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.organizationMissing }) });
+  const manage = seat.can.manageMembers;
+  const label = (r) => roles.find((c) => c.role === r)?.name || r;
+  const add = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.organizations.add(id, { email, role, locale: props.locale }));
+    if (!r.ok) return;
+    setEmail("");
+    setDone(f.t.memberAdded.replace("{email}", r.member.email));
+    await load();
+  };
+  const change = async (m, next) => {
+    const r = await run(() => auth.organizations.setRole(id, m.userId, next));
+    if (r.ok) await load();
+  };
+  const remove = async (m) => {
+    setAsking(null);
+    const r = await run(() => auth.organizations.remove(id, m.userId));
+    if (!r.ok) return;
+    if (m.you) setSeat(null);
+    else await load();
+  };
+  const inviteAgain = async (m) => {
+    const r = await run(() => auth.organizations.inviteAgain(id, m.userId, { locale: props.locale }));
+    if (r.ok) setDone(f.t.memberInvitationSent);
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("account"), ...root, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("h2", { className: f.cx("heading"), children: [
+        f.t.members,
+        " \xB7 ",
+        seat.name
+      ] }),
+      problem && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(problem) }),
+      members === null ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.membersHidden }),
+        auth.session && (asking === auth.session.user.id ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { role: "group", "aria-label": f.t.memberLeave, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: f.t.memberLeaveConfirm.replace("{org}", seat.name) }),
+          " ",
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            f.Button,
+            {
+              type: "button",
+              disabled: f.busy,
+              className: f.cx("providerButton"),
+              onClick: () => void remove({ userId: auth.session.user.id, you: true }),
+              children: f.t.yes
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
+        ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(auth.session.user.id), children: f.t.memberLeave }))
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: members.map((m) => {
+        const who = m.name || m.email;
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
+            who,
+            m.name ? ` \xB7 ${m.email}` : "",
+            m.you ? ` (${f.t.memberYou})` : "",
+            m.invited ? ` \xB7 ${f.t.memberInvited}` : "",
+            m.manager ? ` \xB7 ${f.t.memberManager}` : "",
+            " \xB7 ",
+            when(m.since)
+          ] }),
+          " ",
+          manage && roles.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "select",
+            {
+              "aria-label": `${f.t.memberRole}: ${who}`,
+              className: f.cx("input"),
+              value: m.role,
+              disabled: f.busy,
+              onChange: (e) => void change(m, e.target.value),
+              children: roles.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: c.role, children: c.name || c.role }, c.role))
+            }
+          ) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: label(m.role) }),
+          " ",
+          asking === m.userId ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { role: "group", "aria-label": m.you ? f.t.memberLeave : f.t.memberRemove, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: m.you ? f.t.memberLeaveConfirm.replace("{org}", seat.name) : f.t.memberRemoveConfirm.replace("{who}", who) }),
+            " ",
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void remove(m), children: f.t.yes }),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
+          ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+            manage && m.invited && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void inviteAgain(m), children: f.t.memberInviteAgain }),
+            (manage || m.you) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(m.userId), children: m.you ? f.t.memberLeave : f.t.memberRemove })
+          ] })
+        ] }, m.userId);
+      }) }),
+      done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
+    ] }),
+    manage && roles.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: add, noValidate: true, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.memberAdd }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "off", required: true, onChange: setEmail }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("field"), children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: f.cx("label"), children: f.t.memberRole }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("select", { name: "role", className: f.cx("input"), value: role, onChange: (e) => setRole(e.target.value), children: roles.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: c.role, children: c.name || c.role }, c.role)) })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.memberAdd })
+    ] })
+  ] });
+}
 function PasskeysPart({ props, account, accountUrl, when }) {
   const auth = useAuth();
   const { f, done, setDone, run, general } = useSection(props);
@@ -1673,6 +1925,7 @@ function useAuth() {
       ...client,
       signIn: {
         ...client.signIn,
+        anonymously: (f) => then(client.signIn.anonymously(f)),
         email: (f) => then(client.signIn.email(f)),
         mfa: (f) => then(client.signIn.mfa(f)),
         magicLinkVerify: (f) => then(client.signIn.magicLinkVerify(f)),
@@ -1688,7 +1941,9 @@ function useAuth() {
         // What is on screen says the new name, and knows when the session ended.
         update: (f) => then(client.account.update(f)),
         changePassword: (f) => then(client.account.changePassword(f)),
-        signOutEverywhere: () => then(client.account.signOutEverywhere())
+        signOutEverywhere: () => then(client.account.signOutEverywhere()),
+        // The guest is now the account: what is on screen says so.
+        upgrade: (f) => then(client.account.upgrade(f))
       },
       session,
       status,
@@ -1702,6 +1957,7 @@ function useAuth() {
   CauthyProvider,
   ForgotPassword,
   GoogleOneTap,
+  OrganizationMembers,
   ResetPassword,
   SignIn,
   SignUp,