oauth.do 0.2.3 → 0.2.4

package/dist/itty.js

@@ -0,0 +1,229 @@
+import * as jose from 'jose';
+
+// src/itty.ts
+var OAUTH_DO_CONFIG = {
+  clientId: "client_01JQYTRXK9ZPD8JPJTKDCRB656",
+  jwksUri: "https://api.workos.com/sso/jwks/client_01JQYTRXK9ZPD8JPJTKDCRB656"
+};
+var TOKEN_CACHE_TTL = 5 * 60;
+var CACHE_URL_PREFIX = "https://oauth.do/_cache/token/";
+async function hashToken(token) {
+  const data = new TextEncoder().encode(token);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function getCachedUser(token) {
+  try {
+    const cache = caches.default;
+    const hash = await hashToken(token);
+    const cacheKey = new Request(`${CACHE_URL_PREFIX}${hash}`);
+    const cached = await cache.match(cacheKey);
+    if (!cached) return null;
+    const data = await cached.json();
+    if (data.expiresAt < Date.now()) return null;
+    return data.user;
+  } catch {
+    return null;
+  }
+}
+async function cacheUser(token, user) {
+  try {
+    const cache = caches.default;
+    const hash = await hashToken(token);
+    const cacheKey = new Request(`${CACHE_URL_PREFIX}${hash}`);
+    const data = { user, expiresAt: Date.now() + TOKEN_CACHE_TTL * 1e3 };
+    const response = new Response(JSON.stringify(data), {
+      headers: { "Cache-Control": `max-age=${TOKEN_CACHE_TTL}` }
+    });
+    await cache.put(cacheKey, response);
+  } catch {
+  }
+}
+function parseCookies(request) {
+  const cookieHeader = request.headers.get("Cookie");
+  if (!cookieHeader) return {};
+  const cookies = {};
+  for (const pair of cookieHeader.split(";")) {
+    const [name, ...rest] = pair.trim().split("=");
+    if (name && rest.length > 0) {
+      cookies[name] = rest.join("=");
+    }
+  }
+  return cookies;
+}
+function extractToken(request, cookieName, headerName) {
+  const authHeader = request.headers.get(headerName);
+  if (authHeader?.startsWith("Bearer ")) {
+    return authHeader.slice(7);
+  }
+  const cookies = parseCookies(request);
+  const cookie = cookies[cookieName];
+  if (cookie) return cookie;
+  return null;
+}
+function payloadToUser(payload) {
+  return {
+    id: payload.sub || "",
+    email: payload.email,
+    name: payload.name,
+    organizationId: payload.org_id,
+    roles: payload.roles,
+    permissions: payload.permissions,
+    metadata: payload.metadata
+  };
+}
+var jwksCache = null;
+var jwksCacheExpiry = 0;
+async function getJwks(jwksUri, cacheTtl) {
+  const now = Date.now();
+  if (jwksCache && jwksCacheExpiry > now) {
+    return jwksCache;
+  }
+  jwksCache = jose.createRemoteJWKSet(new URL(jwksUri));
+  jwksCacheExpiry = now + cacheTtl * 1e3;
+  return jwksCache;
+}
+function createDefaultAuthContext() {
+  return {
+    user: null,
+    userId: null,
+    isAuth: false,
+    token: null
+  };
+}
+function jsonError(message, status) {
+  return new Response(JSON.stringify({ error: message }), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function optionalAuth(options = {}) {
+  const {
+    cookieName = "auth",
+    headerName = "Authorization",
+    clientId = OAUTH_DO_CONFIG.clientId,
+    jwksUri = OAUTH_DO_CONFIG.jwksUri,
+    skip,
+    jwksCacheTtl = 3600
+  } = options;
+  return async (request) => {
+    const authRequest = request;
+    authRequest.auth = createDefaultAuthContext();
+    if (skip?.(request)) {
+      return;
+    }
+    const token = extractToken(request, cookieName, headerName);
+    if (!token) {
+      return;
+    }
+    authRequest.auth.token = token;
+    const cached = await getCachedUser(token);
+    if (cached) {
+      authRequest.auth.user = cached;
+      authRequest.auth.userId = cached.id;
+      authRequest.auth.isAuth = true;
+      return;
+    }
+    try {
+      const jwks = await getJwks(jwksUri, jwksCacheTtl);
+      const { payload } = await jose.jwtVerify(token, jwks, {
+        audience: clientId
+      });
+      const user = payloadToUser(payload);
+      authRequest.auth.user = user;
+      authRequest.auth.userId = user.id;
+      authRequest.auth.isAuth = true;
+      await cacheUser(token, user);
+    } catch {
+    }
+  };
+}
+function requireAuth(options = {}) {
+  const { redirectTo, roles, permissions, ...authOptions } = options;
+  return async (request) => {
+    const authRequest = request;
+    if (!authRequest.auth) {
+      await optionalAuth(authOptions)(request);
+    }
+    if (!authRequest.auth.isAuth || !authRequest.auth.user) {
+      if (redirectTo) {
+        return Response.redirect(redirectTo, 302);
+      }
+      return jsonError("Authentication required", 401);
+    }
+    if (roles?.length) {
+      const userRoles = authRequest.auth.user.roles || [];
+      const hasRole = roles.some((r) => userRoles.includes(r));
+      if (!hasRole) {
+        return jsonError("Insufficient permissions", 403);
+      }
+    }
+    if (permissions?.length) {
+      const userPerms = authRequest.auth.user.permissions || [];
+      const hasAllPerms = permissions.every((p) => userPerms.includes(p));
+      if (!hasAllPerms) {
+        return jsonError("Insufficient permissions", 403);
+      }
+    }
+  };
+}
+function apiKey(options) {
+  const { headerName = "X-API-Key", verify } = options;
+  return async (request) => {
+    const authRequest = request;
+    authRequest.auth = createDefaultAuthContext();
+    const key = request.headers.get(headerName);
+    if (!key) {
+      return jsonError("API key required", 401);
+    }
+    const user = await verify(key, request);
+    if (!user) {
+      return jsonError("Invalid API key", 401);
+    }
+    authRequest.auth.user = user;
+    authRequest.auth.userId = user.id;
+    authRequest.auth.isAuth = true;
+    authRequest.auth.token = key;
+  };
+}
+function combined(options) {
+  return async (request) => {
+    const authRequest = request;
+    if (options.auth) {
+      await optionalAuth(options.auth)(request);
+      if (authRequest.auth?.isAuth) {
+        return;
+      }
+    }
+    if (options.apiKey) {
+      const key = request.headers.get(options.apiKey.headerName || "X-API-Key");
+      if (key) {
+        const user = await options.apiKey.verify(key, request);
+        if (user) {
+          if (!authRequest.auth) {
+            authRequest.auth = createDefaultAuthContext();
+          }
+          authRequest.auth.user = user;
+          authRequest.auth.userId = user.id;
+          authRequest.auth.isAuth = true;
+          authRequest.auth.token = key;
+          return;
+        }
+      }
+    }
+    return jsonError("Authentication required", 401);
+  };
+}
+function getAuth(request) {
+  return request.auth || createDefaultAuthContext();
+}
+function isAuthenticated(request) {
+  return request.auth?.isAuth === true;
+}
+function getUser(request) {
+  return request.auth?.user || null;
+}
+
+export { apiKey, combined, getAuth, getUser, isAuthenticated, optionalAuth, requireAuth };
+//# sourceMappingURL=itty.js.map
+//# sourceMappingURL=itty.js.map

package/dist/itty.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/itty.ts"],"names":[],"mappings":";;;AAwFA,IAAM,eAAA,GAAkB;AAAA,EACtB,QAAA,EAAU,mCAAA;AAAA,EACV,OAAA,EAAS;AACX,CAAA;AAEA,IAAM,kBAAkB,CAAA,GAAI,EAAA;AAC5B,IAAM,gBAAA,GAAmB,gCAAA;AASzB,eAAe,UAAU,KAAA,EAAgC;AACvD,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC3C,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAC7D,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA,CACzC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACZ;AAKA,eAAe,cAAc,KAAA,EAAyC;AACpE,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,MAAA,CAAO,OAAA;AACrB,IAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,KAAK,CAAA;AAClC,IAAA,MAAM,WAAW,IAAI,OAAA,CAAQ,GAAG,gBAAgB,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AACzD,IAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,KAAA,CAAM,QAAQ,CAAA;AAEzC,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AAEpB,IAAA,MAAM,IAAA,GAAQ,MAAM,MAAA,CAAO,IAAA,EAAK;AAChC,IAAA,IAAI,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,IAAO,OAAO,IAAA;AAExC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAKA,eAAe,SAAA,CAAU,OAAe,IAAA,EAA+B;AACrE,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,MAAA,CAAO,OAAA;AACrB,IAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,KAAK,CAAA;AAClC,IAAA,MAAM,WAAW,IAAI,OAAA,CAAQ,GAAG,gBAAgB,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AACzD,IAAA,MAAM,IAAA,GAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAK,GAAA,EAAI,GAAI,kBAAkB,GAAA,EAAK;AACpE,IAAA,MAAM,WAAW,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,MAClD,OAAA,EAAS,EAAE,eAAA,EAAiB,CAAA,QAAA,EAAW,eAAe,CAAA,CAAA;AAAG,KAC1D,CAAA;AACD,IAAA,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAU,QAAQ,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAKA,SAAS,aAAa,OAAA,EAA0C;AAC9D,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACjD,EAAA,IAAI,CAAC,YAAA,EAAc,OAAO,EAAC;AAE3B,EAAA,MAAM,UAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,IAAA,IAAQ,YAAA,CAAa,KAAA,CAAM,GAAG,CAAA,EAAG;AAC1C,IAAA,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,IAAA,CAAK,IAAA,EAAK,CAAE,KAAA,CAAM,GAAG,CAAA;AAC7C,IAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG;AAC3B,MAAA,OAAA,CAAQ,IAAI,CAAA,GAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAAA,IAC/B;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAKA,SAAS,YAAA,CAAa,OAAA,EAAkB,UAAA,EAAoB,UAAA,EAAmC;AAE7F,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AACjD,EAAA,IAAI,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACrC,IAAA,OAAO,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,EAC3B;AAGA,EAAA,MAAM,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,EAAA,MAAM,MAAA,GAAS,QAAQ,UAAU,CAAA;AACjC,EAAA,IAAI,QAAQ,OAAO,MAAA;AAEnB,EAAA,OAAO,IAAA;AACT;AAKA,SAAS,cAAc,OAAA,EAA+B;AACpD,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,QAAQ,GAAA,IAAO,EAAA;AAAA,IACnB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,gBAAgB,OAAA,CAAQ,MAAA;AAAA,IACxB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,UAAU,OAAA,CAAQ;AAAA,GACpB;AACF;AAGA,IAAI,SAAA,GAAyC,IAAA;AAC7C,IAAI,eAAA,GAAkB,CAAA;AAKtB,eAAe,OAAA,CAAQ,SAAiB,QAAA,EAAiD;AACvF,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,SAAA,IAAa,kBAAkB,GAAA,EAAK;AACtC,IAAA,OAAO,SAAA;AAAA,EACT;AAEA,EAAA,SAAA,GAAiB,IAAA,CAAA,kBAAA,CAAmB,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AACpD,EAAA,eAAA,GAAkB,MAAM,QAAA,GAAW,GAAA;AACnC,EAAA,OAAO,SAAA;AACT;AAKA,SAAS,wBAAA,GAAwC;AAC/C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA;AAAA,IACN,MAAA,EAAQ,IAAA;AAAA,IACR,MAAA,EAAQ,KAAA;AAAA,IACR,KAAA,EAAO;AAAA,GACT;AACF;AAKA,SAAS,SAAA,CAAU,SAAiB,MAAA,EAA0B;AAC5D,EAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,IACtD,MAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAC/C,CAAA;AACH;AA2BO,SAAS,YAAA,CAAa,OAAA,GAAuB,EAAC,EAAG;AACtD,EAAA,MAAM;AAAA,IACJ,UAAA,GAAa,MAAA;AAAA,IACb,UAAA,GAAa,eAAA;AAAA,IACb,WAAW,eAAA,CAAgB,QAAA;AAAA,IAC3B,UAAU,eAAA,CAAgB,OAAA;AAAA,IAC1B,IAAA;AAAA,IACA,YAAA,GAAe;AAAA,GACjB,GAAI,OAAA;AAEJ,EAAA,OAAO,OAAO,OAAA,KAAoC;AAEhD,IAAA,MAAM,WAAA,GAAc,OAAA;AACpB,IAAA,WAAA,CAAY,OAAO,wBAAA,EAAyB;AAG5C,IAAA,IAAI,IAAA,GAAO,OAAO,CAAA,EAAG;AACnB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAC1D,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA;AAAA,IACF;AAEA,IAAA,WAAA,CAAY,KAAK,KAAA,GAAQ,KAAA;AAGzB,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,KAAK,CAAA;AACxC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,WAAA,CAAY,KAAK,IAAA,GAAO,MAAA;AACxB,MAAA,WAAA,CAAY,IAAA,CAAK,SAAS,MAAA,CAAO,EAAA;AACjC,MAAA,WAAA,CAAY,KAAK,MAAA,GAAS,IAAA;AAC1B,MAAA;AAAA,IACF;AAGA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,OAAA,EAAS,YAAY,CAAA;AAChD,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAW,IAAA,CAAA,SAAA,CAAU,OAAO,IAAA,EAAM;AAAA,QACpD,QAAA,EAAU;AAAA,OACX,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,cAAc,OAAO,CAAA;AAClC,MAAA,WAAA,CAAY,KAAK,IAAA,GAAO,IAAA;AACxB,MAAA,WAAA,CAAY,IAAA,CAAK,SAAS,IAAA,CAAK,EAAA;AAC/B,MAAA,WAAA,CAAY,KAAK,MAAA,GAAS,IAAA;AAG1B,MAAA,MAAM,SAAA,CAAU,OAAO,IAAI,CAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF,CAAA;AACF;AAgBO,SAAS,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAG;AAC5D,EAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAO,WAAA,EAAa,GAAG,aAAY,GAAI,OAAA;AAE3D,EAAA,OAAO,OAAO,OAAA,KAA+C;AAC3D,IAAA,MAAM,WAAA,GAAc,OAAA;AAGpB,IAAA,IAAI,CAAC,YAAY,IAAA,EAAM;AACrB,MAAA,MAAM,YAAA,CAAa,WAAW,CAAA,CAAE,OAAO,CAAA;AAAA,IACzC;AAEA,IAAA,IAAI,CAAC,WAAA,CAAY,IAAA,CAAK,UAAU,CAAC,WAAA,CAAY,KAAK,IAAA,EAAM;AACtD,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAO,QAAA,CAAS,QAAA,CAAS,UAAA,EAAY,GAAG,CAAA;AAAA,MAC1C;AACA,MAAA,OAAO,SAAA,CAAU,2BAA2B,GAAG,CAAA;AAAA,IACjD;AAGA,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,IAAA,CAAK,IAAA,CAAK,SAAS,EAAC;AAClD,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,CAAC,MAAM,SAAA,CAAU,QAAA,CAAS,CAAC,CAAC,CAAA;AACvD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,OAAO,SAAA,CAAU,4BAA4B,GAAG,CAAA;AAAA,MAClD;AAAA,IACF;AAGA,IAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,IAAA,CAAK,IAAA,CAAK,eAAe,EAAC;AACxD,MAAA,MAAM,WAAA,GAAc,YAAY,KAAA,CAAM,CAAC,MAAM,SAAA,CAAU,QAAA,CAAS,CAAC,CAAC,CAAA;AAClE,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,OAAO,SAAA,CAAU,4BAA4B,GAAG,CAAA;AAAA,MAClD;AAAA,IACF;AAAA,EAGF,CAAA;AACF;AAoBO,SAAS,OAAO,OAAA,EAAwB;AAC7C,EAAA,MAAM,EAAE,UAAA,GAAa,WAAA,EAAa,MAAA,EAAO,GAAI,OAAA;AAE7C,EAAA,OAAO,OAAO,OAAA,KAA+C;AAC3D,IAAA,MAAM,WAAA,GAAc,OAAA;AACpB,IAAA,WAAA,CAAY,OAAO,wBAAA,EAAyB;AAE5C,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAC1C,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,OAAO,SAAA,CAAU,oBAAoB,GAAG,CAAA;AAAA,IAC1C;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,GAAA,EAAK,OAAO,CAAA;AACtC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAO,SAAA,CAAU,mBAAmB,GAAG,CAAA;AAAA,IACzC;AAEA,IAAA,WAAA,CAAY,KAAK,IAAA,GAAO,IAAA;AACxB,IAAA,WAAA,CAAY,IAAA,CAAK,SAAS,IAAA,CAAK,EAAA;AAC/B,IAAA,WAAA,CAAY,KAAK,MAAA,GAAS,IAAA;AAC1B,IAAA,WAAA,CAAY,KAAK,KAAA,GAAQ,GAAA;AAAA,EAC3B,CAAA;AACF;AAkBO,SAAS,SAAS,OAAA,EAAyD;AAChF,EAAA,OAAO,OAAO,OAAA,KAA+C;AAC3D,IAAA,MAAM,WAAA,GAAc,OAAA;AAGpB,IAAA,IAAI,QAAQ,IAAA,EAAM;AAChB,MAAA,MAAM,YAAA,CAAa,OAAA,CAAQ,IAAI,CAAA,CAAE,OAAO,CAAA;AACxC,MAAA,IAAI,WAAA,CAAY,MAAM,MAAA,EAAQ;AAC5B,QAAA;AAAA,MACF;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,OAAA,CAAQ,MAAA,CAAO,cAAc,WAAW,CAAA;AACxE,MAAA,IAAI,GAAA,EAAK;AACP,QAAA,MAAM,OAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,CAAO,KAAK,OAAO,CAAA;AACrD,QAAA,IAAI,IAAA,EAAM;AACR,UAAA,IAAI,CAAC,YAAY,IAAA,EAAM;AACrB,YAAA,WAAA,CAAY,OAAO,wBAAA,EAAyB;AAAA,UAC9C;AACA,UAAA,WAAA,CAAY,KAAK,IAAA,GAAO,IAAA;AACxB,UAAA,WAAA,CAAY,IAAA,CAAK,SAAS,IAAA,CAAK,EAAA;AAC/B,UAAA,WAAA,CAAY,KAAK,MAAA,GAAS,IAAA;AAC1B,UAAA,WAAA,CAAY,KAAK,KAAA,GAAQ,GAAA;AACzB,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,SAAA,CAAU,2BAA2B,GAAG,CAAA;AAAA,EACjD,CAAA;AACF;AASO,SAAS,QAAQ,OAAA,EAA+B;AACrD,EAAA,OAAQ,OAAA,CAAwB,QAAQ,wBAAA,EAAyB;AACnE;AAKO,SAAS,gBAAgB,OAAA,EAA2B;AACzD,EAAA,OAAQ,OAAA,CAAwB,MAAM,MAAA,KAAW,IAAA;AACnD;AAKO,SAAS,QAAQ,OAAA,EAAmC;AACzD,EAAA,OAAQ,OAAA,CAAwB,MAAM,IAAA,IAAQ,IAAA;AAChD","file":"itty.js","sourcesContent":["/**\n * oauth.do/itty - itty-router middleware for authentication\n *\n * Lightweight authentication middleware for Cloudflare Workers using itty-router.\n * Uses jose for JWT verification - no heavy WorkOS SDK dependency.\n *\n * @packageDocumentation\n */\n\nimport type { JWTPayload } from 'jose'\nimport * as jose from 'jose'\n\n// Cloudflare Workers Cache API type\ndeclare const caches: {\n  default: Cache\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Types\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport interface AuthUser {\n  id: string\n  email?: string\n  name?: string\n  organizationId?: string\n  roles?: string[]\n  permissions?: string[]\n  metadata?: Record<string, unknown>\n}\n\nexport interface AuthContext {\n  user: AuthUser | null\n  userId: string | null\n  isAuth: boolean\n  token: string | null\n}\n\n/**\n * Extended request type with auth context\n */\nexport interface AuthRequest extends Request {\n  auth: AuthContext\n}\n\n/**\n * Environment bindings with auth context\n */\nexport interface AuthEnv {\n  auth?: AuthContext\n  [key: string]: unknown\n}\n\nexport interface AuthOptions {\n  /** Cookie name for JWT token (default: 'auth') */\n  cookieName?: string\n  /** Header name for Bearer token (default: 'Authorization') */\n  headerName?: string\n  /** WorkOS Client ID (default: oauth.do client ID) */\n  clientId?: string\n  /** JWKS URI for token verification (default: WorkOS JWKS) */\n  jwksUri?: string\n  /** Skip auth for certain paths */\n  skip?: (request: Request) => boolean\n  /** Cache duration for JWKS in seconds (default: 3600) */\n  jwksCacheTtl?: number\n}\n\nexport interface RequireAuthOptions extends AuthOptions {\n  /** Redirect to login page instead of 401 */\n  redirectTo?: string\n  /** Required roles (any of) */\n  roles?: string[]\n  /** Required permissions (all of) */\n  permissions?: string[]\n}\n\nexport interface ApiKeyOptions {\n  /** Header name (default: 'X-API-Key') */\n  headerName?: string\n  /** Verify function - return user if valid, null if not */\n  verify: (key: string, request: Request) => Promise<AuthUser | null>\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Constants\n// ═══════════════════════════════════════════════════════════════════════════\n\nconst OAUTH_DO_CONFIG = {\n  clientId: 'client_01JQYTRXK9ZPD8JPJTKDCRB656',\n  jwksUri: 'https://api.workos.com/sso/jwks/client_01JQYTRXK9ZPD8JPJTKDCRB656',\n}\n\nconst TOKEN_CACHE_TTL = 5 * 60 // 5 minutes\nconst CACHE_URL_PREFIX = 'https://oauth.do/_cache/token/'\n\n// ═══════════════════════════════════════════════════════════════════════════\n// JWT Utilities\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * Hash a token for cache key (avoids storing raw tokens in cache)\n */\nasync function hashToken(token: string): Promise<string> {\n  const data = new TextEncoder().encode(token)\n  const hashBuffer = await crypto.subtle.digest('SHA-256', data)\n  return Array.from(new Uint8Array(hashBuffer))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * Get cached user from Cache API\n */\nasync function getCachedUser(token: string): Promise<AuthUser | null> {\n  try {\n    const cache = caches.default\n    const hash = await hashToken(token)\n    const cacheKey = new Request(`${CACHE_URL_PREFIX}${hash}`)\n    const cached = await cache.match(cacheKey)\n\n    if (!cached) return null\n\n    const data = (await cached.json()) as { user: AuthUser; expiresAt: number }\n    if (data.expiresAt < Date.now()) return null\n\n    return data.user\n  } catch {\n    return null\n  }\n}\n\n/**\n * Cache user in Cache API\n */\nasync function cacheUser(token: string, user: AuthUser): Promise<void> {\n  try {\n    const cache = caches.default\n    const hash = await hashToken(token)\n    const cacheKey = new Request(`${CACHE_URL_PREFIX}${hash}`)\n    const data = { user, expiresAt: Date.now() + TOKEN_CACHE_TTL * 1000 }\n    const response = new Response(JSON.stringify(data), {\n      headers: { 'Cache-Control': `max-age=${TOKEN_CACHE_TTL}` },\n    })\n    await cache.put(cacheKey, response)\n  } catch {\n    // Cache failures are non-fatal\n  }\n}\n\n/**\n * Parse cookies from request\n */\nfunction parseCookies(request: Request): Record<string, string> {\n  const cookieHeader = request.headers.get('Cookie')\n  if (!cookieHeader) return {}\n\n  const cookies: Record<string, string> = {}\n  for (const pair of cookieHeader.split(';')) {\n    const [name, ...rest] = pair.trim().split('=')\n    if (name && rest.length > 0) {\n      cookies[name] = rest.join('=')\n    }\n  }\n  return cookies\n}\n\n/**\n * Extract JWT from request (cookie or Bearer header)\n */\nfunction extractToken(request: Request, cookieName: string, headerName: string): string | null {\n  // Try Bearer header first\n  const authHeader = request.headers.get(headerName)\n  if (authHeader?.startsWith('Bearer ')) {\n    return authHeader.slice(7)\n  }\n\n  // Try cookie\n  const cookies = parseCookies(request)\n  const cookie = cookies[cookieName]\n  if (cookie) return cookie\n\n  return null\n}\n\n/**\n * Convert JWT payload to AuthUser\n */\nfunction payloadToUser(payload: JWTPayload): AuthUser {\n  return {\n    id: payload.sub || '',\n    email: payload.email as string | undefined,\n    name: payload.name as string | undefined,\n    organizationId: payload.org_id as string | undefined,\n    roles: payload.roles as string[] | undefined,\n    permissions: payload.permissions as string[] | undefined,\n    metadata: payload.metadata as Record<string, unknown> | undefined,\n  }\n}\n\n// JWKS cache (module-level, persists across requests)\nlet jwksCache: jose.JWTVerifyGetKey | null = null\nlet jwksCacheExpiry = 0\n\n/**\n * Get JWKS verifier with caching\n */\nasync function getJwks(jwksUri: string, cacheTtl: number): Promise<jose.JWTVerifyGetKey> {\n  const now = Date.now()\n  if (jwksCache && jwksCacheExpiry > now) {\n    return jwksCache\n  }\n\n  jwksCache = jose.createRemoteJWKSet(new URL(jwksUri))\n  jwksCacheExpiry = now + cacheTtl * 1000\n  return jwksCache\n}\n\n/**\n * Create default auth context\n */\nfunction createDefaultAuthContext(): AuthContext {\n  return {\n    user: null,\n    userId: null,\n    isAuth: false,\n    token: null,\n  }\n}\n\n/**\n * JSON error response helper\n */\nfunction jsonError(message: string, status: number): Response {\n  return new Response(JSON.stringify({ error: message }), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Middleware\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * Optional auth middleware - populates request.auth if authenticated\n *\n * Does NOT reject unauthenticated requests. Use requireAuth() for that.\n *\n * @example\n * ```ts\n * import { Router } from 'itty-router'\n * import { optionalAuth } from 'oauth.do/itty'\n *\n * const router = Router()\n * router.all('*', optionalAuth())\n *\n * router.get('/api/me', (request) => {\n *   if (!request.auth.user) {\n *     return new Response(JSON.stringify({ error: 'Not authenticated' }), { status: 401 })\n *   }\n *   return new Response(JSON.stringify(request.auth.user))\n * })\n * ```\n */\nexport function optionalAuth(options: AuthOptions = {}) {\n  const {\n    cookieName = 'auth',\n    headerName = 'Authorization',\n    clientId = OAUTH_DO_CONFIG.clientId,\n    jwksUri = OAUTH_DO_CONFIG.jwksUri,\n    skip,\n    jwksCacheTtl = 3600,\n  } = options\n\n  return async (request: Request): Promise<void> => {\n    // Initialize auth context on request\n    const authRequest = request as AuthRequest\n    authRequest.auth = createDefaultAuthContext()\n\n    // Skip if configured\n    if (skip?.(request)) {\n      return\n    }\n\n    const token = extractToken(request, cookieName, headerName)\n    if (!token) {\n      return\n    }\n\n    authRequest.auth.token = token\n\n    // Check cache first\n    const cached = await getCachedUser(token)\n    if (cached) {\n      authRequest.auth.user = cached\n      authRequest.auth.userId = cached.id\n      authRequest.auth.isAuth = true\n      return\n    }\n\n    // Verify JWT\n    try {\n      const jwks = await getJwks(jwksUri, jwksCacheTtl)\n      const { payload } = await jose.jwtVerify(token, jwks, {\n        audience: clientId,\n      })\n\n      const user = payloadToUser(payload)\n      authRequest.auth.user = user\n      authRequest.auth.userId = user.id\n      authRequest.auth.isAuth = true\n\n      // Cache the result\n      await cacheUser(token, user)\n    } catch {\n      // Invalid token - leave user as null\n    }\n  }\n}\n\n/**\n * Require auth middleware - rejects unauthenticated requests\n *\n * @example\n * ```ts\n * import { Router } from 'itty-router'\n * import { requireAuth } from 'oauth.do/itty'\n *\n * const router = Router()\n * router.get('/api/secret', requireAuth(), (request) => {\n *   return new Response(JSON.stringify({ secret: 'data', user: request.auth.user }))\n * })\n * ```\n */\nexport function requireAuth(options: RequireAuthOptions = {}) {\n  const { redirectTo, roles, permissions, ...authOptions } = options\n\n  return async (request: Request): Promise<Response | void> => {\n    const authRequest = request as AuthRequest\n\n    // Run optional auth first if not already done\n    if (!authRequest.auth) {\n      await optionalAuth(authOptions)(request)\n    }\n\n    if (!authRequest.auth.isAuth || !authRequest.auth.user) {\n      if (redirectTo) {\n        return Response.redirect(redirectTo, 302)\n      }\n      return jsonError('Authentication required', 401)\n    }\n\n    // Check roles (any of)\n    if (roles?.length) {\n      const userRoles = authRequest.auth.user.roles || []\n      const hasRole = roles.some((r) => userRoles.includes(r))\n      if (!hasRole) {\n        return jsonError('Insufficient permissions', 403)\n      }\n    }\n\n    // Check permissions (all of)\n    if (permissions?.length) {\n      const userPerms = authRequest.auth.user.permissions || []\n      const hasAllPerms = permissions.every((p) => userPerms.includes(p))\n      if (!hasAllPerms) {\n        return jsonError('Insufficient permissions', 403)\n      }\n    }\n\n    // Continue to next handler (return undefined)\n  }\n}\n\n/**\n * API key middleware - authenticates via API key header\n *\n * @example\n * ```ts\n * import { Router } from 'itty-router'\n * import { apiKey } from 'oauth.do/itty'\n *\n * const router = Router()\n * router.use('/api/*', apiKey({\n *   verify: async (key, request) => {\n *     // Verify key against your database/service\n *     const user = await verifyApiKey(key)\n *     return user\n *   }\n * }))\n * ```\n */\nexport function apiKey(options: ApiKeyOptions) {\n  const { headerName = 'X-API-Key', verify } = options\n\n  return async (request: Request): Promise<Response | void> => {\n    const authRequest = request as AuthRequest\n    authRequest.auth = createDefaultAuthContext()\n\n    const key = request.headers.get(headerName)\n    if (!key) {\n      return jsonError('API key required', 401)\n    }\n\n    const user = await verify(key, request)\n    if (!user) {\n      return jsonError('Invalid API key', 401)\n    }\n\n    authRequest.auth.user = user\n    authRequest.auth.userId = user.id\n    authRequest.auth.isAuth = true\n    authRequest.auth.token = key\n  }\n}\n\n/**\n * Combined auth middleware - tries JWT first, then API key\n *\n * @example\n * ```ts\n * import { Router } from 'itty-router'\n * import { combined } from 'oauth.do/itty'\n *\n * const router = Router()\n * router.all('/api/*', combined({\n *   apiKey: {\n *     verify: async (key) => verifyApiKey(key)\n *   }\n * }))\n * ```\n */\nexport function combined(options: { auth?: AuthOptions; apiKey?: ApiKeyOptions }) {\n  return async (request: Request): Promise<Response | void> => {\n    const authRequest = request as AuthRequest\n\n    // Try JWT auth first\n    if (options.auth) {\n      await optionalAuth(options.auth)(request)\n      if (authRequest.auth?.isAuth) {\n        return\n      }\n    }\n\n    // Fall back to API key\n    if (options.apiKey) {\n      const key = request.headers.get(options.apiKey.headerName || 'X-API-Key')\n      if (key) {\n        const user = await options.apiKey.verify(key, request)\n        if (user) {\n          if (!authRequest.auth) {\n            authRequest.auth = createDefaultAuthContext()\n          }\n          authRequest.auth.user = user\n          authRequest.auth.userId = user.id\n          authRequest.auth.isAuth = true\n          authRequest.auth.token = key\n          return\n        }\n      }\n    }\n\n    return jsonError('Authentication required', 401)\n  }\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Utility exports\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * Helper to get auth context from request\n */\nexport function getAuth(request: Request): AuthContext {\n  return (request as AuthRequest).auth || createDefaultAuthContext()\n}\n\n/**\n * Helper to check if request is authenticated\n */\nexport function isAuthenticated(request: Request): boolean {\n  return (request as AuthRequest).auth?.isAuth === true\n}\n\n/**\n * Helper to get user from request\n */\nexport function getUser(request: Request): AuthUser | null {\n  return (request as AuthRequest).auth?.user || null\n}\n"]}

package/dist/react.d.ts

@@ -1,58 +1,34 @@
-import { User, Impersonator, AuthenticationMethod } from '@workos-inc/authkit-react';
-export { AuthenticationMethod, Impersonator, User } from '@workos-inc/authkit-react';
 import { ReactNode } from 'react';
+import { AuthToken, AuthUser, Impersonator, OrganizationSwitcher as OrganizationSwitcher$1, TeamSwitcher as TeamSwitcher$1, UserMenu as UserMenu$1 } from '@mdxui/auth';
+export { AuthToken, AuthUser, IdentityProviderProps, Impersonator } from '@mdxui/auth';
 
 /**
  * oauth.do/react - React components for authentication
  *
- * Wraps WorkOS AuthKit widgets with oauth.do configuration.
- * Pre-configured with oauth.do WorkOS client ID.
+ * Wraps @mdxui/auth with oauth.do configuration.
+ * Pre-configured with oauth.do WorkOS client ID and domain.
  *
  * @packageDocumentation
  */
 
-/**
- * Auth token can be a string or a function that returns a Promise<string>
- */
-type AuthToken = string | (() => Promise<string>);
-
-/**
- * Options for switching organization
- */
-interface SwitchToOrganizationOptions {
-    organizationId: string;
-    signInOpts?: {
-        screenHint?: 'sign-in' | 'sign-up';
-        loginHint?: string;
-    };
-}
-/**
- * Auth state and methods returned by useAuth hook
- */
-interface AuthState {
-    isLoading: boolean;
-    user: User | null;
-    role: string | null;
-    roles: string[] | null;
-    organizationId: string | null;
-    permissions: string[];
-    featureFlags: string[];
-    impersonator: Impersonator | null;
-    authenticationMethod: AuthenticationMethod | null;
-    signIn: () => void;
-    signUp: () => void;
-    getUser: () => User | null;
-    getAccessToken: () => Promise<string>;
-    signOut: () => void;
-    switchToOrganization: (options: SwitchToOrganizationOptions) => Promise<void>;
-    getSignInUrl: () => Promise<string>;
-    getSignUpUrl: () => Promise<string>;
-}
 interface OAuthDoContextValue {
     clientId: string;
     apiUrl: string;
     authKitDomain: string;
 }
+/**
+ * Hook to access oauth.do-specific configuration
+ *
+ * @example
+ * ```tsx
+ * import { useOAuthDoConfig } from 'oauth.do/react'
+ *
+ * function MyComponent() {
+ *   const { clientId, apiUrl, authKitDomain } = useOAuthDoConfig()
+ *   // Use config values...
+ * }
+ * ```
+ */
 declare function useOAuthDoConfig(): OAuthDoContextValue;
 interface OAuthDoProviderProps {
     children: ReactNode;
@@ -66,6 +42,11 @@ interface OAuthDoProviderProps {
 /**
  * OAuth.do Provider - wraps your app with authentication context
  *
+ * Pre-configured with oauth.do defaults:
+ * - clientId: client_01JQYTRXK9ZPD8JPJTKDCRB656
+ * - authKitDomain: login.oauth.do
+ * - apiUrl: https://apis.do
+ *
  * @example
  * ```tsx
  * import { OAuthDoProvider } from 'oauth.do/react'
@@ -78,11 +59,56 @@ interface OAuthDoProviderProps {
  *   )
  * }
  * ```
+ *
+ * @example
+ * ```tsx
+ * // With custom overrides
+ * <OAuthDoProvider
+ *   clientId="custom-client-id"
+ *   apiUrl="https://custom.api.do"
+ * >
+ *   {children}
+ * </OAuthDoProvider>
+ * ```
  */
 declare function OAuthDoProvider({ children, clientId, apiUrl, authKitDomain, }: OAuthDoProviderProps): JSX.Element;
+/**
+ * Options for switching organization
+ */
+interface SwitchToOrganizationOptions {
+    organizationId: string;
+    signInOpts?: {
+        screenHint?: 'sign-in' | 'sign-up';
+        loginHint?: string;
+    };
+}
+/**
+ * Auth state and methods returned by useAuth hook
+ */
+interface AuthState {
+    isLoading: boolean;
+    user: AuthUser | null;
+    role: string | null;
+    roles: string[] | null;
+    organizationId: string | null;
+    permissions: string[];
+    featureFlags: string[];
+    impersonator: Impersonator | null;
+    authenticationMethod: string | null;
+    signIn: () => void;
+    signUp: () => void;
+    getUser: () => AuthUser | null;
+    getAccessToken: () => Promise<string>;
+    signOut: () => void;
+    switchToOrganization: (options: SwitchToOrganizationOptions) => Promise<void>;
+    getSignInUrl: () => Promise<string>;
+    getSignUpUrl: () => Promise<string>;
+}
 /**
  * useAuth hook - access current user and auth state
  *
+ * Re-exported from @mdxui/auth with AuthState typing.
+ *
  * @example
  * ```tsx
  * import { useAuth } from 'oauth.do/react'
@@ -168,6 +194,8 @@ interface SignInButtonProps {
 /**
  * Sign In Button - redirects to oauth.do login
  *
+ * Uses oauth.do-specific URL-based redirect for authentication.
+ *
  * @example
  * ```tsx
  * import { SignInButton } from 'oauth.do/react'
@@ -196,5 +224,71 @@ interface SignOutButtonProps {
  * ```
  */
 declare function SignOutButton({ children, className, redirectTo, }: SignOutButtonProps): JSX.Element;
+/**
+ * UserMenu - A customizable user menu component
+ *
+ * Re-exported from @mdxui/auth. Displays user info and provides sign-out functionality.
+ *
+ * @example
+ * ```tsx
+ * import { UserMenu } from 'oauth.do/react'
+ *
+ * function Header() {
+ *   return (
+ *     <UserMenu
+ *       renderTrigger={({ user, initials }) => (
+ *         <button>{user.firstName}</button>
+ *       )}
+ *       renderMenu={({ signOut }) => (
+ *         <button onClick={signOut}>Sign Out</button>
+ *       )}
+ *     />
+ *   )
+ * }
+ * ```
+ */
+declare const UserMenu: typeof UserMenu$1;
+/**
+ * TeamSwitcher - Organization switching component
+ *
+ * Re-exported from @mdxui/auth. Shows WorkOS OrganizationSwitcher widget.
+ *
+ * @example
+ * ```tsx
+ * import { TeamSwitcher } from 'oauth.do/react'
+ *
+ * function Sidebar() {
+ *   return <TeamSwitcher className="my-team-switcher" />
+ * }
+ * ```
+ */
+declare const TeamSwitcher: typeof TeamSwitcher$1;
+/**
+ * OrganizationSwitcher - Lower-level organization switcher widget
+ *
+ * Re-exported from @mdxui/auth. Use with useAuth() for full control.
+ *
+ * @example
+ * ```tsx
+ * import { OrganizationSwitcher, useAuth } from 'oauth.do/react'
+ *
+ * function OrgSwitcher() {
+ *   const { getAccessToken, switchToOrganization } = useAuth()
+ *
+ *   return (
+ *     <OrganizationSwitcher
+ *       authToken={getAccessToken}
+ *       switchToOrganization={({ organizationId }) =>
+ *         switchToOrganization({ organizationId })
+ *       }
+ *     />
+ *   )
+ * }
+ * ```
+ */
+declare const OrganizationSwitcher: typeof OrganizationSwitcher$1;
+
+type User = AuthUser;
+type AuthenticationMethod = string | null;
 
-export { ApiKeys, type ApiKeysProps, type AuthState, type AuthToken, OAuthDoProvider, type OAuthDoProviderProps, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, type SwitchToOrganizationOptions, UserProfile, type UserProfileProps, UsersManagement, type UsersManagementProps, useAuth, useOAuthDoConfig };
+export { ApiKeys, type ApiKeysProps, type AuthState, type AuthenticationMethod, OAuthDoProvider, type OAuthDoProviderProps, OrganizationSwitcher, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, type SwitchToOrganizationOptions, TeamSwitcher, type User, UserMenu, UserProfile, type UserProfileProps, UsersManagement, type UsersManagementProps, useAuth, useOAuthDoConfig };

package/dist/react.js

@@ -1,6 +1,5 @@
-import { WorkOsWidgets, ApiKeys as ApiKeys$1, UsersManagement as UsersManagement$1, UserProfile as UserProfile$1 } from '@workos-inc/widgets';
-import { AuthKitProvider, useAuth as useAuth$1 } from '@workos-inc/authkit-react';
 import React, { createContext, useContext } from 'react';
+import { OrganizationSwitcher as OrganizationSwitcher$1, TeamSwitcher as TeamSwitcher$1, UserMenu as UserMenu$1, IdentityProvider, useAuth as useAuth$1, ApiKeys as ApiKeys$1, UsersManagement as UsersManagement$1, UserProfile as UserProfile$1 } from '@mdxui/auth';
 
 var OAUTH_DO_CONFIG = {
   clientId: "client_01JQYTRXK9ZPD8JPJTKDCRB656",
@@ -18,7 +17,7 @@ function OAuthDoProvider({
   authKitDomain = OAUTH_DO_CONFIG.authKitDomain
 }) {
   const config = { clientId, apiUrl, authKitDomain };
-  return /* @__PURE__ */ React.createElement(OAuthDoContext.Provider, { value: config }, /* @__PURE__ */ React.createElement(AuthKitProvider, { clientId }, /* @__PURE__ */ React.createElement(WorkOsWidgets, null, children)));
+  return /* @__PURE__ */ React.createElement(OAuthDoContext.Provider, { value: config }, /* @__PURE__ */ React.createElement(IdentityProvider, { clientId, apiHostname: authKitDomain }, children));
 }
 function useAuth() {
   return useAuth$1();
@@ -61,7 +60,10 @@ function SignOutButton({
   };
   return /* @__PURE__ */ React.createElement("button", { onClick: handleClick, className }, children);
 }
+var UserMenu = UserMenu$1;
+var TeamSwitcher = TeamSwitcher$1;
+var OrganizationSwitcher = OrganizationSwitcher$1;
 
-export { ApiKeys, OAuthDoProvider, SignInButton, SignOutButton, UserProfile, UsersManagement, useAuth, useOAuthDoConfig };
+export { ApiKeys, OAuthDoProvider, OrganizationSwitcher, SignInButton, SignOutButton, TeamSwitcher, UserMenu, UserProfile, UsersManagement, useAuth, useOAuthDoConfig };
 //# sourceMappingURL=react.js.map
 //# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/react.tsx"],"names":["WorkOSAuthKitProvider","useWorkOSAuth","WorkOSApiKeys","WorkOSUsersManagement","WorkOSUserProfile"],"mappings":";;;;AAsEA,IAAM,eAAA,GAAkB;AAAA,EACtB,QAAA,EAAU,mCAAA;AAAA,EACV,MAAA,EAAQ,iBAAA;AAAA,EACR,aAAA,EAAe;AACjB,CAAA;AAYA,IAAM,cAAA,GAAiB,cAAmC,eAAe,CAAA;AAElE,SAAS,gBAAA,GAAwC;AACtD,EAAA,OAAO,WAAW,cAAc,CAAA;AAClC;AAgCO,SAAS,eAAA,CAAgB;AAAA,EAC9B,QAAA;AAAA,EACA,WAAW,eAAA,CAAgB,QAAA;AAAA,EAC3B,SAAS,eAAA,CAAgB,MAAA;AAAA,EACzB,gBAAgB,eAAA,CAAgB;AAClC,CAAA,EAAsC;AACpC,EAAA,MAAM,MAAA,GAAS,EAAE,QAAA,EAAU,MAAA,EAAQ,aAAA,EAAc;AAEjD,EAAA,uBACE,KAAA,CAAA,aAAA,CAAC,cAAA,CAAe,QAAA,EAAf,EAAwB,KAAA,EAAO,MAAA,EAAA,kBAC9B,KAAA,CAAA,aAAA,CAACA,eAAA,EAAA,EAAsB,QAAA,EAAA,kBACrB,KAAA,CAAA,aAAA,CAAC,aAAA,EAAA,IAAA,EACE,QACH,CACF,CACF,CAAA;AAEJ;AAuBO,SAAS,OAAA,GAAqB;AACnC,EAAA,OAAOC,SAAA,EAAc;AACvB;AA4BO,SAAS,OAAA,CAAQ,EAAE,SAAA,EAAU,EAA8B;AAChE,EAAA,uBAAO,KAAA,CAAA,aAAA,CAACC,aAAc,SAAA,EAAsB,CAAA;AAC9C;AAsBO,SAAS,eAAA,CAAgB,EAAE,SAAA,EAAU,EAAsC;AAChF,EAAA,uBAAO,KAAA,CAAA,aAAA,CAACC,qBAAsB,SAAA,EAAsB,CAAA;AACtD;AAsBO,SAAS,WAAA,CAAY,EAAE,SAAA,EAAU,EAAkC;AACxE,EAAA,uBAAO,KAAA,CAAA,aAAA,CAACC,iBAAkB,SAAA,EAAsB,CAAA;AAClD;AAwBO,SAAS,YAAA,CAAa;AAAA,EAC3B,QAAA,GAAW,SAAA;AAAA,EACX,SAAA;AAAA,EACA,aAAa,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO;AACtE,CAAA,EAAmC;AACjC,EAAA,MAAM,EAAE,aAAA,EAAe,QAAA,EAAS,GAAI,gBAAA,EAAiB;AAErD,EAAA,MAAM,cAAc,MAAM;AACxB,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,QAAA,EAAW,aAAa,CAAA,CAAE,CAAA;AAC9C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,UAAU,CAAA;AAC/C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,QAAA,CAAS,IAAA,GAAO,GAAA,CAAI,QAAA,EAAS;AAAA,EACtC,CAAA;AAEA,EAAA,uBACE,KAAA,CAAA,aAAA,CAAC,QAAA,EAAA,EAAO,OAAA,EAAS,WAAA,EAAa,aAC3B,QACH,CAAA;AAEJ;AAoBO,SAAS,aAAA,CAAc;AAAA,EAC5B,QAAA,GAAW,UAAA;AAAA,EACX,SAAA;AAAA,EACA,UAAA,GAAa;AACf,CAAA,EAAoC;AAClC,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,OAAA,EAAQ;AAE5B,EAAA,MAAM,cAAc,MAAM;AACxB,IAAA,OAAA,EAAQ;AAER,IAAA,IAAI,UAAA,KAAe,GAAA,IAAO,OAAO,MAAA,KAAW,WAAA,EAAa;AACvD,MAAA,MAAA,CAAO,SAAS,IAAA,GAAO,UAAA;AAAA,IACzB;AAAA,EACF,CAAA;AAEA,EAAA,uBACE,KAAA,CAAA,aAAA,CAAC,QAAA,EAAA,EAAO,OAAA,EAAS,WAAA,EAAa,aAC3B,QACH,CAAA;AAEJ","file":"react.js","sourcesContent":["/**\n * oauth.do/react - React components for authentication\n *\n * Wraps WorkOS AuthKit widgets with oauth.do configuration.\n * Pre-configured with oauth.do WorkOS client ID.\n *\n * @packageDocumentation\n */\n\n'use client'\n\nimport {\n  WorkOsWidgets,\n  ApiKeys as WorkOSApiKeys,\n  UsersManagement as WorkOSUsersManagement,\n  UserProfile as WorkOSUserProfile\n} from '@workos-inc/widgets'\nimport {\n  AuthKitProvider as WorkOSAuthKitProvider,\n  useAuth as useWorkOSAuth,\n  type Impersonator,\n  type User,\n  type AuthenticationMethod\n} from '@workos-inc/authkit-react'\n\n/**\n * Auth token can be a string or a function that returns a Promise<string>\n */\nexport type AuthToken = string | (() => Promise<string>)\nimport React, { createContext, useContext, type ReactNode } from 'react'\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Auth Types (re-exported from authkit-react context)\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * Options for switching organization\n */\nexport interface SwitchToOrganizationOptions {\n  organizationId: string\n  signInOpts?: {\n    screenHint?: 'sign-in' | 'sign-up'\n    loginHint?: string\n  }\n}\n\n/**\n * Auth state and methods returned by useAuth hook\n */\nexport interface AuthState {\n  isLoading: boolean\n  user: User | null\n  role: string | null\n  roles: string[] | null\n  organizationId: string | null\n  permissions: string[]\n  featureFlags: string[]\n  impersonator: Impersonator | null\n  authenticationMethod: AuthenticationMethod | null\n  signIn: () => void\n  signUp: () => void\n  getUser: () => User | null\n  getAccessToken: () => Promise<string>\n  signOut: () => void\n  switchToOrganization: (options: SwitchToOrganizationOptions) => Promise<void>\n  getSignInUrl: () => Promise<string>\n  getSignUpUrl: () => Promise<string>\n}\n\n// oauth.do default configuration\nconst OAUTH_DO_CONFIG = {\n  clientId: 'client_01JQYTRXK9ZPD8JPJTKDCRB656',\n  apiUrl: 'https://apis.do',\n  authKitDomain: 'login.oauth.do',\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Context\n// ═══════════════════════════════════════════════════════════════════════════\n\ninterface OAuthDoContextValue {\n  clientId: string\n  apiUrl: string\n  authKitDomain: string\n}\n\nconst OAuthDoContext = createContext<OAuthDoContextValue>(OAUTH_DO_CONFIG)\n\nexport function useOAuthDoConfig(): OAuthDoContextValue {\n  return useContext(OAuthDoContext)\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Provider\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport interface OAuthDoProviderProps {\n  children: ReactNode\n  /** Override the default client ID */\n  clientId?: string\n  /** Override the API URL */\n  apiUrl?: string\n  /** Override the AuthKit domain */\n  authKitDomain?: string\n}\n\n/**\n * OAuth.do Provider - wraps your app with authentication context\n *\n * @example\n * ```tsx\n * import { OAuthDoProvider } from 'oauth.do/react'\n *\n * export default function App({ children }) {\n *   return (\n *     <OAuthDoProvider>\n *       {children}\n *     </OAuthDoProvider>\n *   )\n * }\n * ```\n */\nexport function OAuthDoProvider({\n  children,\n  clientId = OAUTH_DO_CONFIG.clientId,\n  apiUrl = OAUTH_DO_CONFIG.apiUrl,\n  authKitDomain = OAUTH_DO_CONFIG.authKitDomain,\n}: OAuthDoProviderProps): JSX.Element {\n  const config = { clientId, apiUrl, authKitDomain }\n\n  return (\n    <OAuthDoContext.Provider value={config}>\n      <WorkOSAuthKitProvider clientId={clientId}>\n        <WorkOsWidgets>\n          {children}\n        </WorkOsWidgets>\n      </WorkOSAuthKitProvider>\n    </OAuthDoContext.Provider>\n  )\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Hooks\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * useAuth hook - access current user and auth state\n *\n * @example\n * ```tsx\n * import { useAuth } from 'oauth.do/react'\n *\n * function UserGreeting() {\n *   const { user, isLoading } = useAuth()\n *\n *   if (isLoading) return <span>Loading...</span>\n *   if (!user) return <span>Please sign in</span>\n *\n *   return <span>Hello, {user.firstName}!</span>\n * }\n * ```\n */\nexport function useAuth(): AuthState {\n  return useWorkOSAuth() as AuthState\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Widgets\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport interface ApiKeysProps {\n  /** Auth token for the widget (from useAuth().getAccessToken or server-generated) */\n  authToken: AuthToken\n}\n\n/**\n * API Keys Widget - manage API keys for your organization\n *\n * Requires the `widgets:api-keys:manage` permission.\n *\n * @example\n * ```tsx\n * import { ApiKeys, useAuth } from 'oauth.do/react'\n *\n * function ApiKeysPage() {\n *   const { user, getAccessToken } = useAuth()\n *   if (!user) return <p>Please sign in</p>\n *\n *   return <ApiKeys authToken={getAccessToken} />\n * }\n * ```\n */\nexport function ApiKeys({ authToken }: ApiKeysProps): JSX.Element {\n  return <WorkOSApiKeys authToken={authToken} />\n}\n\nexport interface UsersManagementProps {\n  /** Auth token for the widget */\n  authToken: AuthToken\n}\n\n/**\n * Users Management Widget - invite, remove, and manage users\n *\n * @example\n * ```tsx\n * import { UsersManagement, useAuth } from 'oauth.do/react'\n *\n * function UsersPage() {\n *   const { user, getAccessToken } = useAuth()\n *   if (!user) return <p>Please sign in</p>\n *\n *   return <UsersManagement authToken={getAccessToken} />\n * }\n * ```\n */\nexport function UsersManagement({ authToken }: UsersManagementProps): JSX.Element {\n  return <WorkOSUsersManagement authToken={authToken} />\n}\n\nexport interface UserProfileProps {\n  /** Auth token for the widget */\n  authToken: AuthToken\n}\n\n/**\n * User Profile Widget - view and edit user profile\n *\n * @example\n * ```tsx\n * import { UserProfile, useAuth } from 'oauth.do/react'\n *\n * function ProfilePage() {\n *   const { user, getAccessToken } = useAuth()\n *   if (!user) return <p>Please sign in</p>\n *\n *   return <UserProfile authToken={getAccessToken} />\n * }\n * ```\n */\nexport function UserProfile({ authToken }: UserProfileProps): JSX.Element {\n  return <WorkOSUserProfile authToken={authToken} />\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Login Components\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport interface SignInButtonProps {\n  children?: ReactNode\n  className?: string\n  redirectTo?: string\n}\n\n/**\n * Sign In Button - redirects to oauth.do login\n *\n * @example\n * ```tsx\n * import { SignInButton } from 'oauth.do/react'\n *\n * function Header() {\n *   return <SignInButton>Sign In</SignInButton>\n * }\n * ```\n */\nexport function SignInButton({\n  children = 'Sign In',\n  className,\n  redirectTo = typeof window !== 'undefined' ? window.location.href : '/',\n}: SignInButtonProps): JSX.Element {\n  const { authKitDomain, clientId } = useOAuthDoConfig()\n\n  const handleClick = () => {\n    const url = new URL(`https://${authKitDomain}`)\n    url.searchParams.set('client_id', clientId)\n    url.searchParams.set('redirect_uri', redirectTo)\n    url.searchParams.set('response_type', 'code')\n    window.location.href = url.toString()\n  }\n\n  return (\n    <button onClick={handleClick} className={className}>\n      {children}\n    </button>\n  )\n}\n\nexport interface SignOutButtonProps {\n  children?: ReactNode\n  className?: string\n  redirectTo?: string\n}\n\n/**\n * Sign Out Button - clears auth state and optionally redirects\n *\n * @example\n * ```tsx\n * import { SignOutButton } from 'oauth.do/react'\n *\n * function Header() {\n *   return <SignOutButton>Sign Out</SignOutButton>\n * }\n * ```\n */\nexport function SignOutButton({\n  children = 'Sign Out',\n  className,\n  redirectTo = '/',\n}: SignOutButtonProps): JSX.Element {\n  const { signOut } = useAuth()\n\n  const handleClick = () => {\n    signOut()\n    // Redirect after signOut if a custom redirectTo is provided\n    if (redirectTo !== '/' && typeof window !== 'undefined') {\n      window.location.href = redirectTo\n    }\n  }\n\n  return (\n    <button onClick={handleClick} className={className}>\n      {children}\n    </button>\n  )\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Re-exports\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport type { User, Impersonator, AuthenticationMethod }\n"]}
+{"version":3,"sources":["../src/react.tsx"],"names":["useMdxuiAuth","MdxuiApiKeys","MdxuiUsersManagement","MdxuiUserProfile","MdxuiUserMenu","MdxuiTeamSwitcher","MdxuiOrganizationSwitcher"],"mappings":";;;AAmCA,IAAM,eAAA,GAAkB;AAAA,EACtB,QAAA,EAAU,mCAAA;AAAA,EACV,MAAA,EAAQ,iBAAA;AAAA,EACR,aAAA,EAAe;AACjB,CAAA;AAYA,IAAM,cAAA,GAAiB,cAAmC,eAAe,CAAA;AAelE,SAAS,gBAAA,GAAwC;AACtD,EAAA,OAAO,WAAW,cAAc,CAAA;AAClC;AAgDO,SAAS,eAAA,CAAgB;AAAA,EAC9B,QAAA;AAAA,EACA,WAAW,eAAA,CAAgB,QAAA;AAAA,EAC3B,SAAS,eAAA,CAAgB,MAAA;AAAA,EACzB,gBAAgB,eAAA,CAAgB;AAClC,CAAA,EAAsC;AACpC,EAAA,MAAM,MAAA,GAAS,EAAE,QAAA,EAAU,MAAA,EAAQ,aAAA,EAAc;AAEjD,EAAA,uBACE,KAAA,CAAA,aAAA,CAAC,cAAA,CAAe,QAAA,EAAf,EAAwB,KAAA,EAAO,MAAA,EAAA,kBAC9B,KAAA,CAAA,aAAA,CAAC,gBAAA,EAAA,EAAiB,QAAA,EAAoB,WAAA,EAAa,aAAA,EAAA,EAChD,QACH,CACF,CAAA;AAEJ;AA+DO,SAAS,OAAA,GAAqB;AACnC,EAAA,OAAOA,SAAA,EAAa;AACtB;AA4BO,SAAS,OAAA,CAAQ,EAAE,SAAA,EAAU,EAA8B;AAChE,EAAA,uBAAO,KAAA,CAAA,aAAA,CAACC,aAAa,SAAA,EAAsB,CAAA;AAC7C;AAsBO,SAAS,eAAA,CAAgB,EAAE,SAAA,EAAU,EAAsC;AAChF,EAAA,uBAAO,KAAA,CAAA,aAAA,CAACC,qBAAqB,SAAA,EAAsB,CAAA;AACrD;AAsBO,SAAS,WAAA,CAAY,EAAE,SAAA,EAAU,EAAkC;AACxE,EAAA,uBAAO,KAAA,CAAA,aAAA,CAACC,iBAAiB,SAAA,EAAsB,CAAA;AACjD;AA0BO,SAAS,YAAA,CAAa;AAAA,EAC3B,QAAA,GAAW,SAAA;AAAA,EACX,SAAA;AAAA,EACA,aAAa,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO;AACtE,CAAA,EAAmC;AACjC,EAAA,MAAM,EAAE,aAAA,EAAe,QAAA,EAAS,GAAI,gBAAA,EAAiB;AAErD,EAAA,MAAM,cAAc,MAAM;AACxB,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,QAAA,EAAW,aAAa,CAAA,CAAE,CAAA;AAC9C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,UAAU,CAAA;AAC/C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,QAAA,CAAS,IAAA,GAAO,GAAA,CAAI,QAAA,EAAS;AAAA,EACtC,CAAA;AAEA,EAAA,uBACE,KAAA,CAAA,aAAA,CAAC,QAAA,EAAA,EAAO,OAAA,EAAS,WAAA,EAAa,aAC3B,QACH,CAAA;AAEJ;AAoBO,SAAS,aAAA,CAAc;AAAA,EAC5B,QAAA,GAAW,UAAA;AAAA,EACX,SAAA;AAAA,EACA,UAAA,GAAa;AACf,CAAA,EAAoC;AAClC,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,OAAA,EAAQ;AAE5B,EAAA,MAAM,cAAc,MAAM;AACxB,IAAA,OAAA,EAAQ;AAER,IAAA,IAAI,UAAA,KAAe,GAAA,IAAO,OAAO,MAAA,KAAW,WAAA,EAAa;AACvD,MAAA,MAAA,CAAO,SAAS,IAAA,GAAO,UAAA;AAAA,IACzB;AAAA,EACF,CAAA;AAEA,EAAA,uBACE,KAAA,CAAA,aAAA,CAAC,QAAA,EAAA,EAAO,OAAA,EAAS,WAAA,EAAa,aAC3B,QACH,CAAA;AAEJ;AA6BO,IAAM,QAAA,GAAWC;AAgBjB,IAAM,YAAA,GAAeC;AAyBrB,IAAM,oBAAA,GAAuBC","file":"react.js","sourcesContent":["/**\n * oauth.do/react - React components for authentication\n *\n * Wraps @mdxui/auth with oauth.do configuration.\n * Pre-configured with oauth.do WorkOS client ID and domain.\n *\n * @packageDocumentation\n */\n\n'use client'\n\nimport React, { createContext, useContext, type ReactNode } from 'react'\n\n// Import from @mdxui/auth instead of direct WorkOS packages\nimport {\n  IdentityProvider,\n  useAuth as useMdxuiAuth,\n  SignInButton as MdxuiSignInButton,\n  SignOutButton as MdxuiSignOutButton,\n  ApiKeys as MdxuiApiKeys,\n  UsersManagement as MdxuiUsersManagement,\n  UserProfile as MdxuiUserProfile,\n  UserMenu as MdxuiUserMenu,\n  TeamSwitcher as MdxuiTeamSwitcher,\n  OrganizationSwitcher as MdxuiOrganizationSwitcher,\n  type AuthToken,\n  type AuthUser,\n  type Impersonator,\n  type IdentityProviderProps,\n} from '@mdxui/auth'\n\n// ===============================================================================\n// oauth.do default configuration\n// ===============================================================================\n\nconst OAUTH_DO_CONFIG = {\n  clientId: 'client_01JQYTRXK9ZPD8JPJTKDCRB656',\n  apiUrl: 'https://apis.do',\n  authKitDomain: 'login.oauth.do',\n}\n\n// ===============================================================================\n// Context for oauth.do-specific config\n// ===============================================================================\n\ninterface OAuthDoContextValue {\n  clientId: string\n  apiUrl: string\n  authKitDomain: string\n}\n\nconst OAuthDoContext = createContext<OAuthDoContextValue>(OAUTH_DO_CONFIG)\n\n/**\n * Hook to access oauth.do-specific configuration\n *\n * @example\n * ```tsx\n * import { useOAuthDoConfig } from 'oauth.do/react'\n *\n * function MyComponent() {\n *   const { clientId, apiUrl, authKitDomain } = useOAuthDoConfig()\n *   // Use config values...\n * }\n * ```\n */\nexport function useOAuthDoConfig(): OAuthDoContextValue {\n  return useContext(OAuthDoContext)\n}\n\n// ===============================================================================\n// Provider\n// ===============================================================================\n\nexport interface OAuthDoProviderProps {\n  children: ReactNode\n  /** Override the default client ID */\n  clientId?: string\n  /** Override the API URL */\n  apiUrl?: string\n  /** Override the AuthKit domain */\n  authKitDomain?: string\n}\n\n/**\n * OAuth.do Provider - wraps your app with authentication context\n *\n * Pre-configured with oauth.do defaults:\n * - clientId: client_01JQYTRXK9ZPD8JPJTKDCRB656\n * - authKitDomain: login.oauth.do\n * - apiUrl: https://apis.do\n *\n * @example\n * ```tsx\n * import { OAuthDoProvider } from 'oauth.do/react'\n *\n * export default function App({ children }) {\n *   return (\n *     <OAuthDoProvider>\n *       {children}\n *     </OAuthDoProvider>\n *   )\n * }\n * ```\n *\n * @example\n * ```tsx\n * // With custom overrides\n * <OAuthDoProvider\n *   clientId=\"custom-client-id\"\n *   apiUrl=\"https://custom.api.do\"\n * >\n *   {children}\n * </OAuthDoProvider>\n * ```\n */\nexport function OAuthDoProvider({\n  children,\n  clientId = OAUTH_DO_CONFIG.clientId,\n  apiUrl = OAUTH_DO_CONFIG.apiUrl,\n  authKitDomain = OAUTH_DO_CONFIG.authKitDomain,\n}: OAuthDoProviderProps): JSX.Element {\n  const config = { clientId, apiUrl, authKitDomain }\n\n  return (\n    <OAuthDoContext.Provider value={config}>\n      <IdentityProvider clientId={clientId} apiHostname={authKitDomain}>\n        {children}\n      </IdentityProvider>\n    </OAuthDoContext.Provider>\n  )\n}\n\n// ===============================================================================\n// Re-exported Auth Types\n// ===============================================================================\n\n/**\n * Options for switching organization\n */\nexport interface SwitchToOrganizationOptions {\n  organizationId: string\n  signInOpts?: {\n    screenHint?: 'sign-in' | 'sign-up'\n    loginHint?: string\n  }\n}\n\n/**\n * Auth state and methods returned by useAuth hook\n */\nexport interface AuthState {\n  isLoading: boolean\n  user: AuthUser | null\n  role: string | null\n  roles: string[] | null\n  organizationId: string | null\n  permissions: string[]\n  featureFlags: string[]\n  impersonator: Impersonator | null\n  authenticationMethod: string | null\n  signIn: () => void\n  signUp: () => void\n  getUser: () => AuthUser | null\n  getAccessToken: () => Promise<string>\n  signOut: () => void\n  switchToOrganization: (options: SwitchToOrganizationOptions) => Promise<void>\n  getSignInUrl: () => Promise<string>\n  getSignUpUrl: () => Promise<string>\n}\n\n// ===============================================================================\n// Hooks\n// ===============================================================================\n\n/**\n * useAuth hook - access current user and auth state\n *\n * Re-exported from @mdxui/auth with AuthState typing.\n *\n * @example\n * ```tsx\n * import { useAuth } from 'oauth.do/react'\n *\n * function UserGreeting() {\n *   const { user, isLoading } = useAuth()\n *\n *   if (isLoading) return <span>Loading...</span>\n *   if (!user) return <span>Please sign in</span>\n *\n *   return <span>Hello, {user.firstName}!</span>\n * }\n * ```\n */\nexport function useAuth(): AuthState {\n  return useMdxuiAuth() as AuthState\n}\n\n// ===============================================================================\n// Widgets - Re-exported from @mdxui/auth\n// ===============================================================================\n\nexport interface ApiKeysProps {\n  /** Auth token for the widget (from useAuth().getAccessToken or server-generated) */\n  authToken: AuthToken\n}\n\n/**\n * API Keys Widget - manage API keys for your organization\n *\n * Requires the `widgets:api-keys:manage` permission.\n *\n * @example\n * ```tsx\n * import { ApiKeys, useAuth } from 'oauth.do/react'\n *\n * function ApiKeysPage() {\n *   const { user, getAccessToken } = useAuth()\n *   if (!user) return <p>Please sign in</p>\n *\n *   return <ApiKeys authToken={getAccessToken} />\n * }\n * ```\n */\nexport function ApiKeys({ authToken }: ApiKeysProps): JSX.Element {\n  return <MdxuiApiKeys authToken={authToken} />\n}\n\nexport interface UsersManagementProps {\n  /** Auth token for the widget */\n  authToken: AuthToken\n}\n\n/**\n * Users Management Widget - invite, remove, and manage users\n *\n * @example\n * ```tsx\n * import { UsersManagement, useAuth } from 'oauth.do/react'\n *\n * function UsersPage() {\n *   const { user, getAccessToken } = useAuth()\n *   if (!user) return <p>Please sign in</p>\n *\n *   return <UsersManagement authToken={getAccessToken} />\n * }\n * ```\n */\nexport function UsersManagement({ authToken }: UsersManagementProps): JSX.Element {\n  return <MdxuiUsersManagement authToken={authToken} />\n}\n\nexport interface UserProfileProps {\n  /** Auth token for the widget */\n  authToken: AuthToken\n}\n\n/**\n * User Profile Widget - view and edit user profile\n *\n * @example\n * ```tsx\n * import { UserProfile, useAuth } from 'oauth.do/react'\n *\n * function ProfilePage() {\n *   const { user, getAccessToken } = useAuth()\n *   if (!user) return <p>Please sign in</p>\n *\n *   return <UserProfile authToken={getAccessToken} />\n * }\n * ```\n */\nexport function UserProfile({ authToken }: UserProfileProps): JSX.Element {\n  return <MdxuiUserProfile authToken={authToken} />\n}\n\n// ===============================================================================\n// Login Components - oauth.do specific with URL-based redirect\n// ===============================================================================\n\nexport interface SignInButtonProps {\n  children?: ReactNode\n  className?: string\n  redirectTo?: string\n}\n\n/**\n * Sign In Button - redirects to oauth.do login\n *\n * Uses oauth.do-specific URL-based redirect for authentication.\n *\n * @example\n * ```tsx\n * import { SignInButton } from 'oauth.do/react'\n *\n * function Header() {\n *   return <SignInButton>Sign In</SignInButton>\n * }\n * ```\n */\nexport function SignInButton({\n  children = 'Sign In',\n  className,\n  redirectTo = typeof window !== 'undefined' ? window.location.href : '/',\n}: SignInButtonProps): JSX.Element {\n  const { authKitDomain, clientId } = useOAuthDoConfig()\n\n  const handleClick = () => {\n    const url = new URL(`https://${authKitDomain}`)\n    url.searchParams.set('client_id', clientId)\n    url.searchParams.set('redirect_uri', redirectTo)\n    url.searchParams.set('response_type', 'code')\n    window.location.href = url.toString()\n  }\n\n  return (\n    <button onClick={handleClick} className={className}>\n      {children}\n    </button>\n  )\n}\n\nexport interface SignOutButtonProps {\n  children?: ReactNode\n  className?: string\n  redirectTo?: string\n}\n\n/**\n * Sign Out Button - clears auth state and optionally redirects\n *\n * @example\n * ```tsx\n * import { SignOutButton } from 'oauth.do/react'\n *\n * function Header() {\n *   return <SignOutButton>Sign Out</SignOutButton>\n * }\n * ```\n */\nexport function SignOutButton({\n  children = 'Sign Out',\n  className,\n  redirectTo = '/',\n}: SignOutButtonProps): JSX.Element {\n  const { signOut } = useAuth()\n\n  const handleClick = () => {\n    signOut()\n    // Redirect after signOut if a custom redirectTo is provided\n    if (redirectTo !== '/' && typeof window !== 'undefined') {\n      window.location.href = redirectTo\n    }\n  }\n\n  return (\n    <button onClick={handleClick} className={className}>\n      {children}\n    </button>\n  )\n}\n\n// ===============================================================================\n// New Components - Re-exported from @mdxui/auth\n// ===============================================================================\n\n/**\n * UserMenu - A customizable user menu component\n *\n * Re-exported from @mdxui/auth. Displays user info and provides sign-out functionality.\n *\n * @example\n * ```tsx\n * import { UserMenu } from 'oauth.do/react'\n *\n * function Header() {\n *   return (\n *     <UserMenu\n *       renderTrigger={({ user, initials }) => (\n *         <button>{user.firstName}</button>\n *       )}\n *       renderMenu={({ signOut }) => (\n *         <button onClick={signOut}>Sign Out</button>\n *       )}\n *     />\n *   )\n * }\n * ```\n */\nexport const UserMenu = MdxuiUserMenu\n\n/**\n * TeamSwitcher - Organization switching component\n *\n * Re-exported from @mdxui/auth. Shows WorkOS OrganizationSwitcher widget.\n *\n * @example\n * ```tsx\n * import { TeamSwitcher } from 'oauth.do/react'\n *\n * function Sidebar() {\n *   return <TeamSwitcher className=\"my-team-switcher\" />\n * }\n * ```\n */\nexport const TeamSwitcher = MdxuiTeamSwitcher\n\n/**\n * OrganizationSwitcher - Lower-level organization switcher widget\n *\n * Re-exported from @mdxui/auth. Use with useAuth() for full control.\n *\n * @example\n * ```tsx\n * import { OrganizationSwitcher, useAuth } from 'oauth.do/react'\n *\n * function OrgSwitcher() {\n *   const { getAccessToken, switchToOrganization } = useAuth()\n *\n *   return (\n *     <OrganizationSwitcher\n *       authToken={getAccessToken}\n *       switchToOrganization={({ organizationId }) =>\n *         switchToOrganization({ organizationId })\n *       }\n *     />\n *   )\n * }\n * ```\n */\nexport const OrganizationSwitcher = MdxuiOrganizationSwitcher\n\n// ===============================================================================\n// Type Re-exports\n// ===============================================================================\n\nexport type { AuthToken, AuthUser, Impersonator, IdentityProviderProps }\n\n// Re-export User as alias for AuthUser for backward compatibility\nexport type User = AuthUser\n\n// Re-export AuthenticationMethod type\nexport type AuthenticationMethod = string | null\n"]}