hazo_auth 5.3.1 → 6.0.0

package/README.md

@@ -2,6 +2,84 @@
 
 A reusable authentication UI component package powered by Next.js, TailwindCSS, and shadcn. It integrates `hazo_config` for configuration management and `hazo_connect` for data access, enabling future components to stay aligned with platform conventions.
 
+### What's New in v6.0.0 🚨 BREAKING CHANGE
+
+**`TenantAuthResult.organization` / `.organization_id` renamed to `.selected_scope` / `.selected_scope_id`.**
+
+The multi-tenancy model has been scope-based for several releases — `auth.user_scopes`, `auth.scope_access_via`, `auth.scope_ok`, the `hazo_auth_scope_id` cookie, the `X-Hazo-Scope-Id` header. The only holdouts using the legacy "organization" name were two fields on `TenantAuthResult` that were always just *"the currently selected scope"* under the hood. This release eliminates the inconsistency.
+
+> 📖 **Full migration guide:** [MIGRATION.md → v5.x → v6.0](./MIGRATION.md#v5x--v60-organization--selected_scope)
+
+**No behavioral change.** `selected_scope_id` is derived from the same scope-selection cookie/header that `organization_id` was. Wire-format auth responses change field names, but the underlying scope lookup is identical.
+
+**No deprecation shim.** A clean find-replace is the upgrade path. If you absolutely need a transitional period, pin to `hazo_auth@^5.3` until you can do the rename in one shot.
+
+**What to replace (find ↔ replace, all in your app code):**
+
+| Find                                              | Replace with                                       |
+| ------------------------------------------------- | -------------------------------------------------- |
+| `auth.organization`                               | `auth.selected_scope`                              |
+| `auth.organization_id`                            | `auth.selected_scope_id`                           |
+| `import type { TenantOrganization }`              | `import type { SelectedScope }`                    |
+| `: TenantOrganization`                            | `: SelectedScope`                                  |
+| `AuthenticatedTenantAuthWithOrg`                  | `AuthenticatedTenantAuthWithSelectedScope`         |
+
+**Before / after example:**
+
+```typescript
+// BEFORE (v5.x)
+import { hazo_get_tenant_auth } from "hazo_auth/server-lib";
+import type { TenantOrganization } from "hazo_auth";
+
+export async function GET(request: NextRequest) {
+  const auth = await hazo_get_tenant_auth(request);
+  if (!auth.authenticated || !auth.organization) {
+    return NextResponse.json({ error: "no tenant" }, { status: 403 });
+  }
+  const data = await getData(auth.organization_id);  // or auth.organization.id
+  return NextResponse.json({ org: auth.organization, data });
+}
+
+// AFTER (v6.0)
+import { hazo_get_tenant_auth } from "hazo_auth/server-lib";
+import type { SelectedScope } from "hazo_auth";
+
+export async function GET(request: NextRequest) {
+  const auth = await hazo_get_tenant_auth(request);
+  if (!auth.authenticated || !auth.selected_scope) {
+    return NextResponse.json({ error: "no tenant scope" }, { status: 403 });
+  }
+  const data = await getData(auth.selected_scope_id);  // or auth.selected_scope.id
+  return NextResponse.json({ selected_scope: auth.selected_scope, data });
+}
+```
+
+**What did NOT change** (same names, same behavior, same wire format):
+- `auth.user_scopes` — array of all scopes the user has access to
+- `auth.scope_ok`, `auth.scope_access_via` — scope-access fields
+- `hazo_auth_scope_id` cookie name and `X-Hazo-Scope-Id` request header
+- All `Tenant*` type and class names: `TenantAuthResult`, `TenantAuthOptions`, `RequiredTenantAuthResult`, `TenantRequiredError`, `TenantAccessDeniedError`, `hazo_get_tenant_auth`, `require_tenant_auth`, `withAuth`'s `require_tenant` option
+- The error response `{ code: "TENANT_REQUIRED" }` shape — only the human-readable `error` string was rephrased ("Organization context required" → "Tenant scope context required")
+
+**One-liner upgrade for typical consumers:**
+
+```bash
+# Run from your app repo (NOT inside hazo_auth itself).
+# Update the path glob to match your code layout.
+git grep -l "organization\b\|TenantOrganization\|AuthenticatedTenantAuthWithOrg" -- 'src/**' 'app/**' 'lib/**' \
+  | xargs sed -i.bak '
+    s/auth\.organization_id\b/auth.selected_scope_id/g;
+    s/auth\.organization\b/auth.selected_scope/g;
+    s/\bTenantOrganization\b/SelectedScope/g;
+    s/\bAuthenticatedTenantAuthWithOrg\b/AuthenticatedTenantAuthWithSelectedScope/g;
+  '
+# Then: review the diff carefully — sed is blunt. Remove .bak files when satisfied.
+```
+
+> ⚠️ The sed line is a starting point, not a blanket "trust me." It only catches `auth.organization*` and the type names. If you destructure (`const { organization } = auth`), aliased imports (`TenantOrganization as Org`), or reference `organization` for unrelated reasons (HTML autocomplete attribute, your own variables), the script either misses or wrongly rewrites them. **Always diff before committing.**
+
+---
+
 ### What's New in v5.3.1 🔧
 
 **`get_client_ip(request)` exported from `hazo_auth/server-lib`** — extracts the client IP from `x-forwarded-for` (first element), falling back to `x-real-ip`, then `"unknown"`. Previously private to `hazo_get_auth.server.ts`. Useful for consumers that need consistent IP extraction across handlers (e.g., `hazo_feedback` audit logging).
@@ -1644,7 +1722,7 @@ export async function proxy(request: NextRequest) {
 
 #### `hazo_get_tenant_auth` (Recommended for Multi-Tenant Apps)
 
-**New:** Tenant-aware authentication function that extracts scope context from request headers or cookies and returns enriched result with organization information.
+**New:** Tenant-aware authentication function that extracts scope context from request headers or cookies and returns enriched result including the currently selected scope.
 
 **Location:** `src/lib/auth/hazo_get_tenant_auth.server.ts`
 
@@ -1678,8 +1756,9 @@ type TenantAuthResult =
       permissions: string[];
       permission_ok: boolean;
       missing_permissions?: string[];
-      organization: TenantOrganization | null;  // NEW: Tenant context
-      user_scopes: ScopeDetails[];              // NEW: All user's scopes for switching
+      selected_scope: SelectedScope | null;     // Currently selected tenant/scope
+      selected_scope_id: string | null;         // Shorthand for selected_scope?.id
+      user_scopes: ScopeDetails[];              // All user's scopes for switching
       scope_ok: boolean;
     }
   | {
@@ -1687,12 +1766,13 @@ type TenantAuthResult =
       user: null;
       permissions: [];
       permission_ok: false;
-      organization: null;
+      selected_scope: null;
+      selected_scope_id: null;
       user_scopes: [];
       scope_ok: false;
     };
 
-type TenantOrganization = {
+type SelectedScope = {
   id: string;
   name: string;
   slug: string | null;          // URL-friendly identifier
@@ -1734,10 +1814,10 @@ export async function GET(request: NextRequest) {
     return NextResponse.json({ error: "Authentication required" }, { status: 401 });
   }
 
-  if (!auth.organization) {
+  if (!auth.selected_scope) {
     return NextResponse.json(
       {
-        error: "No organization context",
+        error: "No tenant scope context",
         available_scopes: auth.user_scopes.map(s => ({ id: s.id, name: s.name }))
       },
       { status: 403 }
@@ -1745,10 +1825,10 @@ export async function GET(request: NextRequest) {
   }
 
   // Access tenant-specific data
-  const data = await getTenantData(auth.organization.id);
+  const data = await getTenantData(auth.selected_scope.id);
 
   return NextResponse.json({
-    organization: auth.organization,
+    selected_scope: auth.selected_scope,
     data,
     // Include available scopes for UI scope switcher
     available_scopes: auth.user_scopes,
@@ -1766,8 +1846,8 @@ export async function GET(request: NextRequest) {
       required_permissions: ["view_reports"],
     });
 
-    // auth.organization is guaranteed non-null here
-    const reports = await getReports(auth.organization.id);
+    // auth.selected_scope is guaranteed non-null here
+    const reports = await getReports(auth.selected_scope.id);
     return NextResponse.json({ reports });
   } catch (error) {
     if (error instanceof HazoAuthError) {
@@ -1817,16 +1897,16 @@ Helper function that wraps `hazo_get_tenant_auth` and throws typed errors for co
 - `TenantRequiredError` (403) - No tenant context in request
 - `TenantAccessDeniedError` (403) - User lacks access to requested tenant
 
-**Returns:** `RequiredTenantAuthResult` with guaranteed non-null `organization`
+**Returns:** `RequiredTenantAuthResult` with guaranteed non-null `selected_scope`
 
 **Example:**
 ```typescript
 export async function GET(request: NextRequest) {
   try {
-    // organization is guaranteed to exist
-    const { organization, user, permissions } = await require_tenant_auth(request);
+    // selected_scope is guaranteed to exist
+    const { selected_scope, user, permissions } = await require_tenant_auth(request);
 
-    const data = await getData(organization.id);
+    const data = await getData(selected_scope.id);
     return NextResponse.json(data);
   } catch (error) {
     if (error instanceof HazoAuthError) {
@@ -1879,10 +1959,10 @@ export const DELETE = withAuth<{ id: string }>(
   { required_permissions: ["admin_system"] }
 );
 
-// With tenant requirement (auth.organization guaranteed non-null)
+// With tenant requirement (auth.selected_scope guaranteed non-null)
 export const GET = withAuth<{ id: string }>(
   async (request, auth, { id }) => {
-    const data = await getData(auth.organization.id, id);
+    const data = await getData(auth.selected_scope.id, id);
     return NextResponse.json(data);
   },
   { require_tenant: true }

package/SETUP_CHECKLIST.md

@@ -1924,10 +1924,10 @@ import { hazo_get_tenant_auth } from "hazo_auth/server-lib";
 export async function GET(request: NextRequest) {
   const auth = await hazo_get_tenant_auth(request);
 
-  if (auth.authenticated && auth.organization) {
-    // auth.organization contains tenant details
+  if (auth.authenticated && auth.selected_scope) {
+    // auth.selected_scope contains the currently selected tenant/scope
     // auth.user_scopes contains all scopes user can access (for UI switcher)
-    const data = await getTenantData(auth.organization.id);
+    const data = await getTenantData(auth.selected_scope.id);
   }
 }
 ```
@@ -1939,8 +1939,8 @@ import { require_tenant_auth, HazoAuthError } from "hazo_auth/server-lib";
 export async function GET(request: NextRequest) {
   try {
     const auth = await require_tenant_auth(request);
-    // auth.organization is guaranteed non-null
-    return NextResponse.json(await getData(auth.organization.id));
+    // auth.selected_scope is guaranteed non-null
+    return NextResponse.json(await getData(auth.selected_scope.id));
   } catch (error) {
     if (error instanceof HazoAuthError) {
       return NextResponse.json(
@@ -1960,7 +1960,7 @@ import { withAuth } from "hazo_auth/server-lib";
 // Auth + params + error handling all automatic
 export const GET = withAuth<{ id: string }>(
   async (request, auth, { id }) => {
-    const data = await getData(auth.organization.id, id);
+    const data = await getData(auth.selected_scope.id, id);
     return NextResponse.json(data);
   },
   { require_tenant: true }
@@ -2009,7 +2009,7 @@ const auth = await hazo_get_tenant_auth(request);
 
 // Return available scopes to frontend
 return NextResponse.json({
-  current_scope: auth.organization,
+  current_scope: auth.selected_scope,
   available_scopes: auth.user_scopes.map(s => ({
     id: s.id,
     name: s.name,

package/cli-src/cli/generate.ts

@@ -127,11 +127,20 @@ ${exports}
 }
 
 function generate_page_content(page: PageDefinition): string {
+  // Next 16 requires page default exports to satisfy `PageProps` (i.e. accept
+  // `{ params?, searchParams? }` and nothing else). Re-exporting the named
+  // component directly fails that check because the component carries custom
+  // props (image_src, layout, …). The wrapper below is a parameter-less
+  // function that returns the component — Next sees a `() => JSX` signature
+  // which trivially satisfies PageProps. Direct JSX consumers still use the
+  // named export from `hazo_auth/pages` and get the full custom-prop API.
   return `// Generated by hazo_auth - do not edit manually
 // Page: /${page.path}
 import { ${page.component_name} } from "hazo_auth/pages";
 
-export default ${page.component_name};
+export default function Page() {
+  return <${page.component_name} />;
+}
 `;
 }
 

package/cli-src/lib/auth/auth_types.ts

@@ -1,4 +1,12 @@
 // file_description: Type definitions and error classes for hazo_get_auth utility
+//
+// Naming note (v6.0.0): the field previously called `organization` (and
+// `organization_id`) on `TenantAuthResult` was renamed to `selected_scope`
+// (and `selected_scope_id`), and the type `TenantOrganization` was renamed
+// to `SelectedScope`. The multi-tenancy model is scopes throughout; the
+// old name was a legacy synonym for "the currently selected scope" derived
+// from the scope-selection cookie/header. No deprecation shim is provided.
+//
 // section: types
 
 /**
@@ -123,10 +131,11 @@ export type ScopeDetails = {
 };
 
 /**
- * Tenant/organization information returned in tenant auth results
- * Simplified view of scope for API responses
+ * Currently selected scope information returned in tenant auth results.
+ * Simplified view of the scope chosen via the scope-selection cookie or
+ * `X-Hazo-Scope-Id` header.
  */
-export type TenantOrganization = {
+export type SelectedScope = {
   id: string;
   name: string;
   slug: string | null;
@@ -167,9 +176,9 @@ export type TenantAuthResult =
       permissions: string[];
       permission_ok: boolean;
       missing_permissions?: string[];
-      organization: TenantOrganization | null;
-      /** Shorthand for organization?.id - commonly used for DB query filters */
-      organization_id: string | null;
+      selected_scope: SelectedScope | null;
+      /** Shorthand for selected_scope?.id - commonly used for DB query filters. */
+      selected_scope_id: string | null;
       user_scopes: ScopeDetails[];
       scope_ok?: boolean;
       scope_access_via?: ScopeAccessInfo;
@@ -179,20 +188,20 @@ export type TenantAuthResult =
       user: null;
       permissions: [];
       permission_ok: false;
-      organization: null;
-      /** Shorthand for organization?.id - commonly used for DB query filters */
-      organization_id: null;
+      selected_scope: null;
+      /** Shorthand for selected_scope?.id - commonly used for DB query filters. */
+      selected_scope_id: null;
       user_scopes: [];
       scope_ok?: false;
     };
 
 /**
- * Guaranteed authenticated result with non-null organization
- * Returned by require_tenant_auth when validation passes
+ * Guaranteed authenticated result with non-null selected_scope.
+ * Returned by require_tenant_auth when validation passes.
  */
 export type RequiredTenantAuthResult = TenantAuthResult & {
   authenticated: true;
-  organization: TenantOrganization;
+  selected_scope: SelectedScope;
 };
 
 // section: tenant_error_classes

package/cli-src/lib/auth/hazo_get_tenant_auth.server.ts

@@ -14,7 +14,7 @@ import type {
   TenantAuthOptions,
   TenantAuthResult,
   RequiredTenantAuthResult,
-  TenantOrganization,
+  SelectedScope,
   ScopeDetails,
 } from "./auth_types";
 import {
@@ -62,15 +62,15 @@ export function extract_scope_id_from_request(
 }
 
 /**
- * Builds TenantOrganization from scope details and access info
+ * Builds SelectedScope from scope details and access info.
  * @param scope_details - Full scope details from cache
  * @param is_super_admin - Whether user is accessing as super admin
- * @returns TenantOrganization object
+ * @returns SelectedScope object
  */
-function build_tenant_organization(
+function build_selected_scope(
   scope_details: ScopeDetails,
   is_super_admin: boolean,
-): TenantOrganization {
+): SelectedScope {
   return {
     id: scope_details.id,
     name: scope_details.name,
@@ -96,20 +96,21 @@ function build_tenant_organization(
  * Tenant-aware authentication function
  *
  * Extracts tenant/scope context from request headers or cookies,
- * validates access, and returns enriched result with organization info.
+ * validates access, and returns enriched result including the currently
+ * selected scope.
  *
  * Header priority: X-Hazo-Scope-Id > Cookie
  *
  * @param request - NextRequest object
  * @param options - TenantAuthOptions for customization
- * @returns TenantAuthResult with user, permissions, organization, and user_scopes
+ * @returns TenantAuthResult with user, permissions, selected_scope, and user_scopes
  *
  * @example
  * ```typescript
  * const auth = await hazo_get_tenant_auth(request);
- * if (auth.authenticated && auth.organization) {
+ * if (auth.authenticated && auth.selected_scope) {
  *   // Access tenant-specific data
- *   const data = await getData(auth.organization.id);
+ *   const data = await getData(auth.selected_scope.id);
  * }
  * ```
  */
@@ -136,8 +137,8 @@ export async function hazo_get_tenant_auth(
       user: null,
       permissions: [],
       permission_ok: false,
-      organization: null,
-      organization_id: null,
+      selected_scope: null,
+      selected_scope_id: null,
       user_scopes: [],
       scope_ok: false,
     };
@@ -155,8 +156,8 @@ export async function hazo_get_tenant_auth(
   // User scopes from cache or empty array
   const user_scopes: ScopeDetails[] = cached?.scopes || [];
 
-  // Build organization info if scope access was successful
-  let organization: TenantOrganization | null = null;
+  // Build selected_scope info if scope access was successful
+  let selected_scope: SelectedScope | null = null;
 
   if (scope_id && auth_result.scope_ok && auth_result.scope_access_via) {
     // Find the scope in user's scopes that matches the access_via scope
@@ -165,7 +166,7 @@ export async function hazo_get_tenant_auth(
     );
 
     if (access_scope) {
-      organization = build_tenant_organization(
+      selected_scope = build_selected_scope(
         access_scope,
         auth_result.scope_access_via.is_super_admin || false,
       );
@@ -174,7 +175,7 @@ export async function hazo_get_tenant_auth(
       const hazoConnect = get_hazo_connect_instance();
       const scope_result = await get_scope_by_id(hazoConnect, scope_id);
       if (scope_result.success && scope_result.scope) {
-        organization = {
+        selected_scope = {
           id: scope_result.scope.id,
           name: scope_result.scope.name,
           slug: null, // Could fetch from scope if slug column exists
@@ -200,8 +201,8 @@ export async function hazo_get_tenant_auth(
     permissions: auth_result.permissions,
     permission_ok: auth_result.permission_ok,
     missing_permissions: auth_result.missing_permissions,
-    organization,
-    organization_id: organization?.id || null,
+    selected_scope,
+    selected_scope_id: selected_scope?.id || null,
     user_scopes,
     scope_ok: auth_result.scope_ok,
     scope_access_via: auth_result.scope_access_via,
@@ -218,15 +219,15 @@ export async function hazo_get_tenant_auth(
  *
  * @param request - NextRequest object
  * @param options - TenantAuthOptions for customization
- * @returns RequiredTenantAuthResult with guaranteed non-null organization
+ * @returns RequiredTenantAuthResult with guaranteed non-null selected_scope
  * @throws AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedError
  *
  * @example
  * ```typescript
  * try {
  *   const auth = await require_tenant_auth(request);
- *   // auth.organization is guaranteed non-null here
- *   const data = await getData(auth.organization.id);
+ *   // auth.selected_scope is guaranteed non-null here
+ *   const data = await getData(auth.selected_scope.id);
  * } catch (error) {
  *   if (error instanceof HazoAuthError) {
  *     return NextResponse.json(
@@ -257,14 +258,14 @@ export async function require_tenant_auth(
     throw new TenantAccessDeniedError(scope_id, result.user_scopes);
   }
 
-  // Check if organization context is required but missing
-  if (!result.organization) {
+  // Check if scope context is required but missing
+  if (!result.selected_scope) {
     throw new TenantRequiredError(
-      "No organization context provided. Include X-Hazo-Scope-Id header or scope cookie.",
+      "No tenant scope context provided. Include X-Hazo-Scope-Id header or scope cookie.",
       result.user_scopes,
     );
   }
 
-  // Type assertion: at this point we know organization is non-null
+  // Type assertion: at this point we know selected_scope is non-null
   return result as RequiredTenantAuthResult;
 }

package/cli-src/lib/auth/index.ts

@@ -22,7 +22,7 @@ export {
 } from "./hazo_get_tenant_auth.server.js";
 export type {
   ScopeDetails,
-  TenantOrganization,
+  SelectedScope,
   TenantAuthOptions,
   TenantAuthResult,
   RequiredTenantAuthResult,
@@ -50,7 +50,7 @@ export {
 } from "./with_auth.server.js";
 export type {
   AuthenticatedTenantAuth,
-  AuthenticatedTenantAuthWithOrg,
+  AuthenticatedTenantAuthWithSelectedScope,
   WithAuthOptions,
 } from "./with_auth.server";
 

package/cli-src/lib/auth/with_auth.server.ts

@@ -10,7 +10,7 @@ import {
   PermissionError,
   type TenantAuthOptions,
   type TenantAuthResult,
-  type TenantOrganization,
+  type SelectedScope,
   type HazoAuthUser,
   type ScopeDetails,
   type ScopeAccessInfo,
@@ -27,19 +27,19 @@ export type AuthenticatedTenantAuth = {
   permissions: string[];
   permission_ok: boolean;
   missing_permissions?: string[];
-  organization: TenantOrganization | null;
-  organization_id: string | null;
+  selected_scope: SelectedScope | null;
+  selected_scope_id: string | null;
   user_scopes: ScopeDetails[];
   scope_ok?: boolean;
   scope_access_via?: ScopeAccessInfo;
 };
 
 /**
- * Authenticated branch with guaranteed non-null organization
+ * Authenticated branch with guaranteed non-null selected_scope
  */
-export type AuthenticatedTenantAuthWithOrg = AuthenticatedTenantAuth & {
-  organization: TenantOrganization;
-  organization_id: string;
+export type AuthenticatedTenantAuthWithSelectedScope = AuthenticatedTenantAuth & {
+  selected_scope: SelectedScope;
+  selected_scope_id: string;
 };
 
 /**
@@ -48,8 +48,8 @@ export type AuthenticatedTenantAuthWithOrg = AuthenticatedTenantAuth & {
  */
 export type WithAuthOptions = TenantAuthOptions & {
   /**
-   * If true, requires organization context (403 if missing)
-   * Narrows auth type to AuthenticatedTenantAuthWithOrg
+   * If true, requires tenant/scope context (403 if missing)
+   * Narrows auth type to AuthenticatedTenantAuthWithSelectedScope
    */
   require_tenant?: boolean;
 };
@@ -75,7 +75,7 @@ type AuthenticatedHandler<TParams> = (
  */
 type AuthenticatedTenantHandler<TParams> = (
   request: NextRequest,
-  auth: AuthenticatedTenantAuthWithOrg,
+  auth: AuthenticatedTenantAuthWithSelectedScope,
   params: TParams,
 ) => Promise<NextResponse> | NextResponse;
 
@@ -138,7 +138,7 @@ async function resolve_params<TParams>(
  *
  * - Calls `hazo_get_tenant_auth` and returns 401 if not authenticated
  * - Returns 403 if `required_permissions` are specified and not satisfied
- * - Returns 403 if `require_tenant: true` and no organization context
+ * - Returns 403 if `require_tenant: true` and no tenant/scope context
  * - Resolves `await context.params` (Next.js 15 pattern)
  * - Catches HazoAuthError, PermissionError, and unexpected errors
  *
@@ -161,8 +161,8 @@ async function resolve_params<TParams>(
  * // With tenant requirement
  * export const GET = withAuth<{ id: string }>(
  *   async (request, auth, { id }) => {
- *     // auth.organization is guaranteed non-null
- *     const data = await getData(auth.organization.id, id);
+ *     // auth.selected_scope is guaranteed non-null
+ *     const data = await getData(auth.selected_scope.id, id);
  *     return NextResponse.json(data);
  *   },
  *   { require_tenant: true }
@@ -227,10 +227,10 @@ export function withAuth<TParams = Record<string, never>>(
       }
 
       // Check tenant requirement
-      if (options.require_tenant && !auth.organization) {
+      if (options.require_tenant && !auth.selected_scope) {
         return NextResponse.json(
           {
-            error: "Organization context required",
+            error: "Tenant scope context required",
             code: "TENANT_REQUIRED",
           },
           { status: 403 },

package/dist/cli/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/cli/generate.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAiMF,wBAAgB,eAAe,CAAC,OAAO,GAAE,eAAoB,GAAG,IAAI,CA8DnE"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/cli/generate.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AA0MF,wBAAgB,eAAe,CAAC,OAAO,GAAE,eAAoB,GAAG,IAAI,CA8DnE"}

package/dist/cli/generate.js

@@ -93,11 +93,20 @@ ${exports}
 `;
 }
 function generate_page_content(page) {
+    // Next 16 requires page default exports to satisfy `PageProps` (i.e. accept
+    // `{ params?, searchParams? }` and nothing else). Re-exporting the named
+    // component directly fails that check because the component carries custom
+    // props (image_src, layout, …). The wrapper below is a parameter-less
+    // function that returns the component — Next sees a `() => JSX` signature
+    // which trivially satisfies PageProps. Direct JSX consumers still use the
+    // named export from `hazo_auth/pages` and get the full custom-prop API.
     return `// Generated by hazo_auth - do not edit manually
 // Page: /${page.path}
 import { ${page.component_name} } from "hazo_auth/pages";
 
-export default ${page.component_name};
+export default function Page() {
+  return <${page.component_name} />;
+}
 `;
 }
 // section: api_route_generation

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export * from "./contexts/hazo_auth_provider.js";
 export * from "./contexts/hazo_auth_config.js";
 export * from "./components/index.js";
-export type { HazoAuthUser, HazoAuthResult, HazoAuthError, HazoAuthOptions, ScopeDetails, TenantOrganization, TenantAuthOptions, TenantAuthResult, RequiredTenantAuthResult, } from "./lib/auth/auth_types";
+export type { HazoAuthUser, HazoAuthResult, HazoAuthError, HazoAuthOptions, ScopeDetails, SelectedScope, TenantAuthOptions, TenantAuthResult, RequiredTenantAuthResult, } from "./lib/auth/auth_types";
 export { AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedError, } from "./lib/auth/auth_types.js";
 export { cn, merge_class_names } from "./lib/utils.js";
 export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS } from "./lib/constants.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/lib/auth/auth_types.d.ts

@@ -103,10 +103,11 @@ export type ScopeDetails = {
     tagline: string | null;
 };
 /**
- * Tenant/organization information returned in tenant auth results
- * Simplified view of scope for API responses
+ * Currently selected scope information returned in tenant auth results.
+ * Simplified view of the scope chosen via the scope-selection cookie or
+ * `X-Hazo-Scope-Id` header.
  */
-export type TenantOrganization = {
+export type SelectedScope = {
     id: string;
     name: string;
     slug: string | null;
@@ -144,9 +145,9 @@ export type TenantAuthResult = {
     permissions: string[];
     permission_ok: boolean;
     missing_permissions?: string[];
-    organization: TenantOrganization | null;
-    /** Shorthand for organization?.id - commonly used for DB query filters */
-    organization_id: string | null;
+    selected_scope: SelectedScope | null;
+    /** Shorthand for selected_scope?.id - commonly used for DB query filters. */
+    selected_scope_id: string | null;
     user_scopes: ScopeDetails[];
     scope_ok?: boolean;
     scope_access_via?: ScopeAccessInfo;
@@ -155,19 +156,19 @@ export type TenantAuthResult = {
     user: null;
     permissions: [];
     permission_ok: false;
-    organization: null;
-    /** Shorthand for organization?.id - commonly used for DB query filters */
-    organization_id: null;
+    selected_scope: null;
+    /** Shorthand for selected_scope?.id - commonly used for DB query filters. */
+    selected_scope_id: null;
     user_scopes: [];
     scope_ok?: false;
 };
 /**
- * Guaranteed authenticated result with non-null organization
- * Returned by require_tenant_auth when validation passes
+ * Guaranteed authenticated result with non-null selected_scope.
+ * Returned by require_tenant_auth when validation passes.
  */
 export type RequiredTenantAuthResult = TenantAuthResult & {
     authenticated: true;
-    organization: TenantOrganization;
+    selected_scope: SelectedScope;
 };
 /**
  * Base error class for all hazo_auth errors

package/dist/lib/auth/auth_types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_types.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth_types.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC/C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GACD;IACE,aAAa,EAAE,KAAK,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,EAAE,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAE/B,mBAAmB,EAAE,MAAM,EAAE;IAC7B,gBAAgB,EAAE,MAAM,EAAE;IAC1B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,qBAAqB,CAAC,EAAE,MAAM;IAC9B,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;gBAJ7C,mBAAmB,EAAE,MAAM,EAAE,EAC7B,gBAAgB,EAAE,MAAM,EAAE,EAC1B,oBAAoB,EAAE,MAAM,EAAE,EAC9B,qBAAqB,CAAC,EAAE,MAAM,YAAA,EAC9B,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA;CAKvD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAEhC,QAAQ,EAAE,MAAM;IAChB,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;gBAD7D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAKvE;AAID;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG;IAChD;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,0EAA0E;IAC1E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GACD;IACE,aAAa,EAAE,KAAK,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,EAAE,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,YAAY,EAAE,IAAI,CAAC;IACnB,0EAA0E;IAC1E,eAAe,EAAE,IAAI,CAAC;IACtB,WAAW,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,aAAa,EAAE,IAAI,CAAC;IACpB,YAAY,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAIF;;;GAGG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAGpB,IAAI,EAAE,MAAM;aACZ,WAAW,EAAE,MAAM;gBAFnC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM;CAKtC;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,aAAa;gBAChD,OAAO,GAAE,MAAkC;CAIxD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,aAAa;aAGlC,WAAW,EAAE,YAAY,EAAE;gBAD3C,OAAO,GAAE,MAAkC,EAC3B,WAAW,GAAE,YAAY,EAAO;CAKnD;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,aAAa;aAEtC,QAAQ,EAAE,MAAM;aAChB,WAAW,EAAE,YAAY,EAAE;gBAD3B,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,YAAY,EAAO;CAKnD"}
+{"version":3,"file":"auth_types.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth_types.ts"],"names":[],"mappings":"AAWA;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC/C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GACD;IACE,aAAa,EAAE,KAAK,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,EAAE,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAE/B,mBAAmB,EAAE,MAAM,EAAE;IAC7B,gBAAgB,EAAE,MAAM,EAAE;IAC1B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,qBAAqB,CAAC,EAAE,MAAM;IAC9B,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;gBAJ7C,mBAAmB,EAAE,MAAM,EAAE,EAC7B,gBAAgB,EAAE,MAAM,EAAE,EAC1B,oBAAoB,EAAE,MAAM,EAAE,EAC9B,qBAAqB,CAAC,EAAE,MAAM,YAAA,EAC9B,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA;CAKvD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAEhC,QAAQ,EAAE,MAAM;IAChB,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;gBAD7D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAKvE;AAID;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG;IAChD;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,6EAA6E;IAC7E,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GACD;IACE,aAAa,EAAE,KAAK,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,EAAE,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,cAAc,EAAE,IAAI,CAAC;IACrB,6EAA6E;IAC7E,iBAAiB,EAAE,IAAI,CAAC;IACxB,WAAW,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,aAAa,EAAE,IAAI,CAAC;IACpB,cAAc,EAAE,aAAa,CAAC;CAC/B,CAAC;AAIF;;;GAGG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAGpB,IAAI,EAAE,MAAM;aACZ,WAAW,EAAE,MAAM;gBAFnC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM;CAKtC;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,aAAa;gBAChD,OAAO,GAAE,MAAkC;CAIxD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,aAAa;aAGlC,WAAW,EAAE,YAAY,EAAE;gBAD3C,OAAO,GAAE,MAAkC,EAC3B,WAAW,GAAE,YAAY,EAAO;CAKnD;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,aAAa;aAEtC,QAAQ,EAAE,MAAM;aAChB,WAAW,EAAE,YAAY,EAAE;gBAD3B,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,YAAY,EAAO;CAKnD"}

package/dist/lib/auth/auth_types.js

@@ -1,4 +1,12 @@
 // file_description: Type definitions and error classes for hazo_get_auth utility
+//
+// Naming note (v6.0.0): the field previously called `organization` (and
+// `organization_id`) on `TenantAuthResult` was renamed to `selected_scope`
+// (and `selected_scope_id`), and the type `TenantOrganization` was renamed
+// to `SelectedScope`. The multi-tenancy model is scopes throughout; the
+// old name was a legacy synonym for "the currently selected scope" derived
+// from the scope-selection cookie/header. No deprecation shim is provided.
+//
 // section: types
 /**
  * Custom error class for permission denials

package/dist/lib/auth/hazo_get_tenant_auth.server.d.ts

@@ -13,20 +13,21 @@ export declare function extract_scope_id_from_request(request: NextRequest, opti
  * Tenant-aware authentication function
  *
  * Extracts tenant/scope context from request headers or cookies,
- * validates access, and returns enriched result with organization info.
+ * validates access, and returns enriched result including the currently
+ * selected scope.
  *
  * Header priority: X-Hazo-Scope-Id > Cookie
  *
  * @param request - NextRequest object
  * @param options - TenantAuthOptions for customization
- * @returns TenantAuthResult with user, permissions, organization, and user_scopes
+ * @returns TenantAuthResult with user, permissions, selected_scope, and user_scopes
  *
  * @example
  * ```typescript
  * const auth = await hazo_get_tenant_auth(request);
- * if (auth.authenticated && auth.organization) {
+ * if (auth.authenticated && auth.selected_scope) {
  *   // Access tenant-specific data
- *   const data = await getData(auth.organization.id);
+ *   const data = await getData(auth.selected_scope.id);
  * }
  * ```
  */
@@ -41,15 +42,15 @@ export declare function hazo_get_tenant_auth(request: NextRequest, options?: Ten
  *
  * @param request - NextRequest object
  * @param options - TenantAuthOptions for customization
- * @returns RequiredTenantAuthResult with guaranteed non-null organization
+ * @returns RequiredTenantAuthResult with guaranteed non-null selected_scope
  * @throws AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedError
  *
  * @example
  * ```typescript
  * try {
  *   const auth = await require_tenant_auth(request);
- *   // auth.organization is guaranteed non-null here
- *   const data = await getData(auth.organization.id);
+ *   // auth.selected_scope is guaranteed non-null here
+ *   const data = await getData(auth.selected_scope.id);
  * } catch (error) {
  *   if (error instanceof HazoAuthError) {
  *     return NextResponse.json(

package/dist/lib/auth/hazo_get_tenant_auth.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hazo_get_tenant_auth.server.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/hazo_get_tenant_auth.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EAGzB,MAAM,cAAc,CAAC;AAqBtB;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,iBAAiB,GACzB,MAAM,GAAG,SAAS,CAYpB;AAiCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CA0F3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CA0BnC"}
+{"version":3,"file":"hazo_get_tenant_auth.server.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/hazo_get_tenant_auth.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EAGzB,MAAM,cAAc,CAAC;AAqBtB;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,iBAAiB,GACzB,MAAM,GAAG,SAAS,CAYpB;AAiCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CA0F3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CA0BnC"}

package/dist/lib/auth/hazo_get_tenant_auth.server.js

@@ -39,12 +39,12 @@ export function extract_scope_id_from_request(request, options) {
     return cookie_value;
 }
 /**
- * Builds TenantOrganization from scope details and access info
+ * Builds SelectedScope from scope details and access info.
  * @param scope_details - Full scope details from cache
  * @param is_super_admin - Whether user is accessing as super admin
- * @returns TenantOrganization object
+ * @returns SelectedScope object
  */
-function build_tenant_organization(scope_details, is_super_admin) {
+function build_selected_scope(scope_details, is_super_admin) {
     return {
         id: scope_details.id,
         name: scope_details.name,
@@ -67,20 +67,21 @@ function build_tenant_organization(scope_details, is_super_admin) {
  * Tenant-aware authentication function
  *
  * Extracts tenant/scope context from request headers or cookies,
- * validates access, and returns enriched result with organization info.
+ * validates access, and returns enriched result including the currently
+ * selected scope.
  *
  * Header priority: X-Hazo-Scope-Id > Cookie
  *
  * @param request - NextRequest object
  * @param options - TenantAuthOptions for customization
- * @returns TenantAuthResult with user, permissions, organization, and user_scopes
+ * @returns TenantAuthResult with user, permissions, selected_scope, and user_scopes
  *
  * @example
  * ```typescript
  * const auth = await hazo_get_tenant_auth(request);
- * if (auth.authenticated && auth.organization) {
+ * if (auth.authenticated && auth.selected_scope) {
  *   // Access tenant-specific data
- *   const data = await getData(auth.organization.id);
+ *   const data = await getData(auth.selected_scope.id);
  * }
  * ```
  */
@@ -98,8 +99,8 @@ export async function hazo_get_tenant_auth(request, options = {}) {
             user: null,
             permissions: [],
             permission_ok: false,
-            organization: null,
-            organization_id: null,
+            selected_scope: null,
+            selected_scope_id: null,
             user_scopes: [],
             scope_ok: false,
         };
@@ -110,20 +111,20 @@ export async function hazo_get_tenant_auth(request, options = {}) {
     const cached = cache.get(auth_result.user.id);
     // User scopes from cache or empty array
     const user_scopes = (cached === null || cached === void 0 ? void 0 : cached.scopes) || [];
-    // Build organization info if scope access was successful
-    let organization = null;
+    // Build selected_scope info if scope access was successful
+    let selected_scope = null;
     if (scope_id && auth_result.scope_ok && auth_result.scope_access_via) {
         // Find the scope in user's scopes that matches the access_via scope
         const access_scope = user_scopes.find((s) => { var _a; return s.id === ((_a = auth_result.scope_access_via) === null || _a === void 0 ? void 0 : _a.scope_id); });
         if (access_scope) {
-            organization = build_tenant_organization(access_scope, auth_result.scope_access_via.is_super_admin || false);
+            selected_scope = build_selected_scope(access_scope, auth_result.scope_access_via.is_super_admin || false);
         }
         else if (auth_result.scope_access_via.is_super_admin) {
             // Super admin accessing scope they're not assigned to - fetch scope details
             const hazoConnect = get_hazo_connect_instance();
             const scope_result = await get_scope_by_id(hazoConnect, scope_id);
             if (scope_result.success && scope_result.scope) {
-                organization = {
+                selected_scope = {
                     id: scope_result.scope.id,
                     name: scope_result.scope.name,
                     slug: null, // Could fetch from scope if slug column exists
@@ -148,8 +149,8 @@ export async function hazo_get_tenant_auth(request, options = {}) {
         permissions: auth_result.permissions,
         permission_ok: auth_result.permission_ok,
         missing_permissions: auth_result.missing_permissions,
-        organization,
-        organization_id: (organization === null || organization === void 0 ? void 0 : organization.id) || null,
+        selected_scope,
+        selected_scope_id: (selected_scope === null || selected_scope === void 0 ? void 0 : selected_scope.id) || null,
         user_scopes,
         scope_ok: auth_result.scope_ok,
         scope_access_via: auth_result.scope_access_via,
@@ -165,15 +166,15 @@ export async function hazo_get_tenant_auth(request, options = {}) {
  *
  * @param request - NextRequest object
  * @param options - TenantAuthOptions for customization
- * @returns RequiredTenantAuthResult with guaranteed non-null organization
+ * @returns RequiredTenantAuthResult with guaranteed non-null selected_scope
  * @throws AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedError
  *
  * @example
  * ```typescript
  * try {
  *   const auth = await require_tenant_auth(request);
- *   // auth.organization is guaranteed non-null here
- *   const data = await getData(auth.organization.id);
+ *   // auth.selected_scope is guaranteed non-null here
+ *   const data = await getData(auth.selected_scope.id);
  * } catch (error) {
  *   if (error instanceof HazoAuthError) {
  *     return NextResponse.json(
@@ -197,10 +198,10 @@ export async function require_tenant_auth(request, options = {}) {
     if (scope_id && !result.scope_ok) {
         throw new TenantAccessDeniedError(scope_id, result.user_scopes);
     }
-    // Check if organization context is required but missing
-    if (!result.organization) {
-        throw new TenantRequiredError("No organization context provided. Include X-Hazo-Scope-Id header or scope cookie.", result.user_scopes);
+    // Check if scope context is required but missing
+    if (!result.selected_scope) {
+        throw new TenantRequiredError("No tenant scope context provided. Include X-Hazo-Scope-Id header or scope cookie.", result.user_scopes);
     }
-    // Type assertion: at this point we know organization is non-null
+    // Type assertion: at this point we know selected_scope is non-null
     return result;
 }

package/dist/lib/auth/index.d.ts

@@ -4,12 +4,12 @@ export { get_authenticated_user, require_auth, is_authenticated, } from "./auth_
 export type { AuthResult, AuthUser } from "./auth_utils.server";
 export { ensure_anon_id } from "./ensure_anon_id.server.js";
 export { hazo_get_tenant_auth, require_tenant_auth, extract_scope_id_from_request, } from "./hazo_get_tenant_auth.server.js";
-export type { ScopeDetails, TenantOrganization, TenantAuthOptions, TenantAuthResult, RequiredTenantAuthResult, } from "./auth_types";
+export type { ScopeDetails, SelectedScope, TenantAuthOptions, TenantAuthResult, RequiredTenantAuthResult, } from "./auth_types";
 export { HazoAuthError, AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedError, } from "./auth_types.js";
 export { get_server_auth_user } from "./server_auth.js";
 export type { ServerAuthResult } from "./server_auth";
 export { withAuth, withOptionalAuth, hasPermission, hasAllPermissions, hasAnyPermission, requirePermission, requireAllPermissions, } from "./with_auth.server.js";
-export type { AuthenticatedTenantAuth, AuthenticatedTenantAuthWithOrg, WithAuthOptions, } from "./with_auth.server";
+export type { AuthenticatedTenantAuth, AuthenticatedTenantAuthWithSelectedScope, WithAuthOptions, } from "./with_auth.server";
 export { get_auth_cache, reset_auth_cache } from "./auth_cache.js";
 export { get_rate_limiter, reset_rate_limiter } from "./auth_rate_limiter.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAC;AAG7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGhE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,uBAAuB,EACvB,8BAA8B,EAC9B,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAC;AAG7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGhE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,uBAAuB,EACvB,wCAAwC,EACxC,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/lib/auth/with_auth.server.d.ts

@@ -1,6 +1,6 @@
 import "server-only";
 import { NextRequest, NextResponse } from "next/server";
-import { type TenantAuthOptions, type TenantAuthResult, type TenantOrganization, type HazoAuthUser, type ScopeDetails, type ScopeAccessInfo } from "./auth_types.js";
+import { type TenantAuthOptions, type TenantAuthResult, type SelectedScope, type HazoAuthUser, type ScopeDetails, type ScopeAccessInfo } from "./auth_types.js";
 /**
  * Authenticated branch of TenantAuthResult - guaranteed authenticated: true
  */
@@ -10,18 +10,18 @@ export type AuthenticatedTenantAuth = {
     permissions: string[];
     permission_ok: boolean;
     missing_permissions?: string[];
-    organization: TenantOrganization | null;
-    organization_id: string | null;
+    selected_scope: SelectedScope | null;
+    selected_scope_id: string | null;
     user_scopes: ScopeDetails[];
     scope_ok?: boolean;
     scope_access_via?: ScopeAccessInfo;
 };
 /**
- * Authenticated branch with guaranteed non-null organization
+ * Authenticated branch with guaranteed non-null selected_scope
  */
-export type AuthenticatedTenantAuthWithOrg = AuthenticatedTenantAuth & {
-    organization: TenantOrganization;
-    organization_id: string;
+export type AuthenticatedTenantAuthWithSelectedScope = AuthenticatedTenantAuth & {
+    selected_scope: SelectedScope;
+    selected_scope_id: string;
 };
 /**
  * Options for withAuth/withOptionalAuth wrappers
@@ -29,8 +29,8 @@ export type AuthenticatedTenantAuthWithOrg = AuthenticatedTenantAuth & {
  */
 export type WithAuthOptions = TenantAuthOptions & {
     /**
-     * If true, requires organization context (403 if missing)
-     * Narrows auth type to AuthenticatedTenantAuthWithOrg
+     * If true, requires tenant/scope context (403 if missing)
+     * Narrows auth type to AuthenticatedTenantAuthWithSelectedScope
      */
     require_tenant?: boolean;
 };
@@ -47,7 +47,7 @@ type AuthenticatedHandler<TParams> = (request: NextRequest, auth: AuthenticatedT
 /**
  * Handler function signature for withAuth with require_tenant
  */
-type AuthenticatedTenantHandler<TParams> = (request: NextRequest, auth: AuthenticatedTenantAuthWithOrg, params: TParams) => Promise<NextResponse> | NextResponse;
+type AuthenticatedTenantHandler<TParams> = (request: NextRequest, auth: AuthenticatedTenantAuthWithSelectedScope, params: TParams) => Promise<NextResponse> | NextResponse;
 /**
  * Handler function signature for withOptionalAuth
  */
@@ -57,7 +57,7 @@ type OptionalAuthHandler<TParams> = (request: NextRequest, auth: TenantAuthResul
  *
  * - Calls `hazo_get_tenant_auth` and returns 401 if not authenticated
  * - Returns 403 if `required_permissions` are specified and not satisfied
- * - Returns 403 if `require_tenant: true` and no organization context
+ * - Returns 403 if `require_tenant: true` and no tenant/scope context
  * - Resolves `await context.params` (Next.js 15 pattern)
  * - Catches HazoAuthError, PermissionError, and unexpected errors
  *
@@ -80,8 +80,8 @@ type OptionalAuthHandler<TParams> = (request: NextRequest, auth: TenantAuthResul
  * // With tenant requirement
  * export const GET = withAuth<{ id: string }>(
  *   async (request, auth, { id }) => {
- *     // auth.organization is guaranteed non-null
- *     const data = await getData(auth.organization.id, id);
+ *     // auth.selected_scope is guaranteed non-null
+ *     const data = await getData(auth.selected_scope.id, id);
  *     return NextResponse.json(data);
  *   },
  *   { require_tenant: true }

package/dist/lib/auth/with_auth.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with_auth.server.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/with_auth.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAItB;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,uBAAuB,GAAG;IACrE,YAAY,EAAE,kBAAkB,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG;IAChD;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,KAAK,YAAY,CAAC,OAAO,IAAI;IAC3B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,KAAK,oBAAoB,CAAC,OAAO,IAAI,CACnC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;AAE1C;;GAEG;AACH,KAAK,0BAA0B,CAAC,OAAO,IAAI,CACzC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,8BAA8B,EACpC,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;AAE1C;;GAEG;AACH,KAAK,mBAAmB,CAAC,OAAO,IAAI,CAClC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;AA+C1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACtD,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,EAC5C,OAAO,EAAE,eAAe,GAAG;IAAE,cAAc,EAAE,IAAI,CAAA;CAAE,GAClD,CACD,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,KAC5B,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,wBAAgB,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACtD,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC,EACtC,OAAO,CAAC,EAAE,eAAe,GACxB,CACD,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,KAC5B,OAAO,CAAC,YAAY,CAAC,CAAC;AAsE3B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAC9D,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACrC,OAAO,GAAE,iBAAsB,GAC9B,CACD,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,KAC5B,OAAO,CAAC,YAAY,CAAC,CAazB;AAID;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,uBAAuB,EAC7B,UAAU,EAAE,MAAM,GACjB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,uBAAuB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,uBAAuB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,uBAAuB,EAC7B,UAAU,EAAE,MAAM,GACjB,IAAI,CAQN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,uBAAuB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,IAAI,CASN"}
+{"version":3,"file":"with_auth.server.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/with_auth.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAItB;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,wCAAwC,GAAG,uBAAuB,GAAG;IAC/E,cAAc,EAAE,aAAa,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG;IAChD;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,KAAK,YAAY,CAAC,OAAO,IAAI;IAC3B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,KAAK,oBAAoB,CAAC,OAAO,IAAI,CACnC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;AAE1C;;GAEG;AACH,KAAK,0BAA0B,CAAC,OAAO,IAAI,CACzC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,wCAAwC,EAC9C,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;AAE1C;;GAEG;AACH,KAAK,mBAAmB,CAAC,OAAO,IAAI,CAClC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;AA+C1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACtD,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,EAC5C,OAAO,EAAE,eAAe,GAAG;IAAE,cAAc,EAAE,IAAI,CAAA;CAAE,GAClD,CACD,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,KAC5B,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,wBAAgB,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACtD,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC,EACtC,OAAO,CAAC,EAAE,eAAe,GACxB,CACD,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,KAC5B,OAAO,CAAC,YAAY,CAAC,CAAC;AAsE3B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAC9D,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACrC,OAAO,GAAE,iBAAsB,GAC9B,CACD,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,KAC5B,OAAO,CAAC,YAAY,CAAC,CAazB;AAID;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,uBAAuB,EAC7B,UAAU,EAAE,MAAM,GACjB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,uBAAuB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,uBAAuB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,uBAAuB,EAC7B,UAAU,EAAE,MAAM,GACjB,IAAI,CAQN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,uBAAuB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,IAAI,CASN"}

package/dist/lib/auth/with_auth.server.js

@@ -50,9 +50,9 @@ export function withAuth(handler, options = {}) {
                 })), { status: 403 });
             }
             // Check tenant requirement
-            if (options.require_tenant && !auth.organization) {
+            if (options.require_tenant && !auth.selected_scope) {
                 return NextResponse.json({
-                    error: "Organization context required",
+                    error: "Tenant scope context required",
                     code: "TENANT_REQUIRED",
                 }, { status: 403 });
             }

package/dist/server_pages/forgot_password.d.ts

@@ -50,6 +50,6 @@ export type ForgotPasswordPageProps = {
  * @param props - Optional visual and navigation customization props
  * @returns Server-rendered forgot password page
  */
-export default function ForgotPasswordPage({ image_src, image_alt, image_background_color, sign_in_path, sign_in_label, }?: ForgotPasswordPageProps): import("react/jsx-runtime").JSX.Element;
+export default function ForgotPasswordPage(props: ForgotPasswordPageProps): import("react/jsx-runtime").JSX.Element;
 export { ForgotPasswordPage };
 //# sourceMappingURL=forgot_password.d.ts.map

package/dist/server_pages/forgot_password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgot_password.d.ts","sourceRoot":"","sources":["../../src/server_pages/forgot_password.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,EACzC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,YAAgD,EAChD,aAAkD,GACnD,GAAE,uBAA4B,2CA0B9B;AAGD,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"forgot_password.d.ts","sourceRoot":"","sources":["../../src/server_pages/forgot_password.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,2CAiCxE;AAGD,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/server_pages/forgot_password.js

@@ -31,7 +31,8 @@ import { DEFAULT_FORGOT_PASSWORD } from "../lib/config/default_config.js";
  * @param props - Optional visual and navigation customization props
  * @returns Server-rendered forgot password page
  */
-export default function ForgotPasswordPage({ image_src, image_alt, image_background_color, sign_in_path = DEFAULT_FORGOT_PASSWORD.loginPath, sign_in_label = DEFAULT_FORGOT_PASSWORD.loginLabel, } = {}) {
+export default function ForgotPasswordPage(props) {
+    const { image_src, image_alt, image_background_color, sign_in_path = DEFAULT_FORGOT_PASSWORD.loginPath, sign_in_label = DEFAULT_FORGOT_PASSWORD.loginLabel, } = props !== null && props !== void 0 ? props : {};
     // Load configuration from INI file (with defaults including asset images)
     const config = get_forgot_password_config();
     // Use props if provided, otherwise fall back to config (which includes default asset image)

package/dist/server_pages/login.d.ts

@@ -52,6 +52,6 @@ export type LoginPageProps = {
  * @param props - Optional visual customization props
  * @returns Server-rendered login page
  */
-export default function LoginPage({ image_src, image_alt, image_background_color, layout, }?: LoginPageProps): import("react/jsx-runtime").JSX.Element;
+export default function LoginPage(props: LoginPageProps): import("react/jsx-runtime").JSX.Element;
 export { LoginPage };
 //# sourceMappingURL=login.d.ts.map

package/dist/server_pages/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/server_pages/login.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AASrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACrC,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,OAAO,UAAU,SAAS,CAAC,EAChC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,MAAqB,GACtB,GAAE,cAAmB,2CA2DrB;AAGD,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/server_pages/login.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AASrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACrC,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,OAAO,UAAU,SAAS,CAAC,KAAK,EAAE,cAAc,2CAiEtD;AAGD,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/server_pages/login.js

@@ -32,7 +32,8 @@ import { FloatingHomeLink } from "../components/layouts/shared/components/floati
  * @param props - Optional visual customization props
  * @returns Server-rendered login page
  */
-export default function LoginPage({ image_src, image_alt, image_background_color, layout = "two_column", } = {}) {
+export default function LoginPage(props) {
+    const { image_src, image_alt, image_background_color, layout = "two_column", } = props !== null && props !== void 0 ? props : {};
     // Load configuration from INI file (with defaults including asset images)
     const config = get_login_config();
     // Use props if provided, otherwise fall back to config (which includes default asset image)

package/dist/server_pages/my_settings.d.ts

@@ -50,6 +50,6 @@ export type MySettingsPageProps = {
  * @param props - Optional className for custom styling
  * @returns Server-rendered my settings component
  */
-export default function MySettingsPage({ className, }?: MySettingsPageProps): import("react/jsx-runtime").JSX.Element;
+export default function MySettingsPage(props: MySettingsPageProps): import("react/jsx-runtime").JSX.Element;
 export { MySettingsPage };
 //# sourceMappingURL=my_settings.d.ts.map

package/dist/server_pages/my_settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"my_settings.d.ts","sourceRoot":"","sources":["../../src/server_pages/my_settings.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,MAAM,MAAM,mBAAmB,GAAG;IAChC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,EACrC,SAAS,GACV,GAAE,mBAAwB,2CAgC1B;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"my_settings.d.ts","sourceRoot":"","sources":["../../src/server_pages/my_settings.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,MAAM,MAAM,mBAAmB,GAAG;IAChC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,KAAK,EAAE,mBAAmB,2CAiChE;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/server_pages/my_settings.js

@@ -52,7 +52,8 @@ import { AuthPageShell } from "../components/layouts/shared/components/auth_page
  * @param props - Optional className for custom styling
  * @returns Server-rendered my settings component
  */
-export default function MySettingsPage({ className, } = {}) {
+export default function MySettingsPage(props) {
+    const { className } = props !== null && props !== void 0 ? props : {};
     // Load configuration from INI file (with defaults)
     const config = get_my_settings_config();
     // Render layout with all server-initialized configuration, wrapped in AuthPageShell for navbar support

package/dist/server_pages/register.d.ts

@@ -48,6 +48,6 @@ export type RegisterPageProps = {
  * @param props - Optional visual customization props
  * @returns Server-rendered register page
  */
-export default function RegisterPage({ image_src, image_alt, image_background_color, layout, }?: RegisterPageProps): import("react/jsx-runtime").JSX.Element;
+export default function RegisterPage(props: RegisterPageProps): import("react/jsx-runtime").JSX.Element;
 export { RegisterPage };
 //# sourceMappingURL=register.d.ts.map

package/dist/server_pages/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/server_pages/register.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AASrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACrC,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,EACnC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,MAAqB,GACtB,GAAE,iBAAsB,2CAiDxB;AAGD,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/server_pages/register.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AASrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACrC,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,KAAK,EAAE,iBAAiB,2CAuD5D;AAGD,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/server_pages/register.js

@@ -34,7 +34,8 @@ import { FloatingHomeLink } from "../components/layouts/shared/components/floati
  * @param props - Optional visual customization props
  * @returns Server-rendered register page
  */
-export default function RegisterPage({ image_src, image_alt, image_background_color, layout = "two_column", } = {}) {
+export default function RegisterPage(props) {
+    const { image_src, image_alt, image_background_color, layout = "two_column", } = props !== null && props !== void 0 ? props : {};
     // Load configuration from INI file (with defaults including asset images)
     const config = get_register_config();
     // Use props if provided, otherwise fall back to config (which includes default asset image)

package/dist/server_pages/reset_password.d.ts

@@ -41,6 +41,6 @@ export type ResetPasswordPageProps = {
  * @param props - Optional visual customization props
  * @returns Server-rendered reset password page
  */
-export default function ResetPasswordPage({ image_src, image_alt, image_background_color, }?: ResetPasswordPageProps): import("react/jsx-runtime").JSX.Element;
+export default function ResetPasswordPage(props: ResetPasswordPageProps): import("react/jsx-runtime").JSX.Element;
 export { ResetPasswordPage };
 //# sourceMappingURL=reset_password.d.ts.map

package/dist/server_pages/reset_password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset_password.d.ts","sourceRoot":"","sources":["../../src/server_pages/reset_password.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAOrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,sBAAsB,GAAG;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,EACxC,SAAS,EACT,SAAS,EACT,sBAAsB,GACvB,GAAE,sBAA2B,2CA6B7B;AAGD,OAAO,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"reset_password.d.ts","sourceRoot":"","sources":["../../src/server_pages/reset_password.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAOrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,sBAAsB,GAAG;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,2CAkCtE;AAGD,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/server_pages/reset_password.js

@@ -31,7 +31,8 @@ import { AuthPageShell } from "../components/layouts/shared/components/auth_page
  * @param props - Optional visual customization props
  * @returns Server-rendered reset password page
  */
-export default function ResetPasswordPage({ image_src, image_alt, image_background_color, } = {}) {
+export default function ResetPasswordPage(props) {
+    const { image_src, image_alt, image_background_color, } = props !== null && props !== void 0 ? props : {};
     // Load configuration from INI file (with defaults including asset images)
     const config = get_reset_password_config();
     // Use props if provided, otherwise fall back to config (which includes default asset image)

package/dist/server_pages/verify_email.d.ts

@@ -50,6 +50,6 @@ export type VerifyEmailPageProps = {
  * @param props - Optional visual and behavior customization props
  * @returns Server-rendered email verification page
  */
-export default function VerifyEmailPage({ image_src, image_alt, image_background_color, redirect_delay, login_path, }?: VerifyEmailPageProps): import("react/jsx-runtime").JSX.Element;
+export default function VerifyEmailPage(props: VerifyEmailPageProps): import("react/jsx-runtime").JSX.Element;
 export { VerifyEmailPage };
 //# sourceMappingURL=verify_email.d.ts.map

package/dist/server_pages/verify_email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify_email.d.ts","sourceRoot":"","sources":["../../src/server_pages/verify_email.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,EACtC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,cAAyD,EACzD,UAAiD,GAClD,GAAE,oBAAyB,2CA0B3B;AAGD,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"verify_email.d.ts","sourceRoot":"","sources":["../../src/server_pages/verify_email.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,KAAK,EAAE,oBAAoB,2CAiClE;AAGD,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/server_pages/verify_email.js

@@ -31,7 +31,8 @@ import { DEFAULT_EMAIL_VERIFICATION } from "../lib/config/default_config.js";
  * @param props - Optional visual and behavior customization props
  * @returns Server-rendered email verification page
  */
-export default function VerifyEmailPage({ image_src, image_alt, image_background_color, redirect_delay = DEFAULT_EMAIL_VERIFICATION.redirectDelay, login_path = DEFAULT_EMAIL_VERIFICATION.loginPath, } = {}) {
+export default function VerifyEmailPage(props) {
+    const { image_src, image_alt, image_background_color, redirect_delay = DEFAULT_EMAIL_VERIFICATION.redirectDelay, login_path = DEFAULT_EMAIL_VERIFICATION.loginPath, } = props !== null && props !== void 0 ? props : {};
     // Load configuration from INI file (with defaults including asset images)
     const config = get_email_verification_config();
     // Use props if provided, otherwise fall back to config (which includes default asset image)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "5.3.1",
+  "version": "6.0.0",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",
@@ -250,7 +250,7 @@
     "@radix-ui/react-tabs": "^1.1.0",
     "@radix-ui/react-tooltip": "^1.2.0",
     "hazo_config": "^2.1.0",
-    "hazo_connect": "^2.4.0",
+    "hazo_connect": "^2.6.0",
     "hazo_logs": "^1.0.13",
     "hazo_notify": "^3.0.0",
     "hazo_ui": "^2.7.0",
@@ -374,7 +374,7 @@
     "eslint-plugin-storybook": "^10.0.6",
     "@tailwindcss/postcss": "^4.2.4",
     "hazo_config": "^2.1.0",
-    "hazo_connect": "^2.4.0",
+    "hazo_connect": "^2.6.0",
     "hazo_logs": "^1.0.13",
     "hazo_notify": "^3.0.0",
     "hazo_ui": "^2.7.0",