Bccorb · Nov 7, 2026 · Nov 6, 2026
diff --git a/.changeset/client-permissions.md b/.changeset/client-permissions.md
diff --git a/.changeset/react-contrast-wcag-aa.md b/.changeset/react-contrast-wcag-aa.md
diff --git a/.changeset/types-0-36-0.md b/.changeset/types-0-36-0.md
diff --git a/.changeset/types-0-38-0.md b/.changeset/types-0-38-0.md
diff --git a/packages/angular/CHANGELOG.md b/packages/angular/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @seamless-auth/angular
 
+## 0.5.0
+
+### Minor Changes
+
+- de0a386: Add `hasPermission`, `hasAllPermissions`, `hasRole` and `hasOrganizationRole`, which read the permissions and roles the `/users/me` user carries, and a `usePermissions` hook in `@seamless-auth/react`. A permission is held if the instance or the active organization grants it, and `{ organization: true }` counts only the active organization, matching the server's `requirePermission`. Permission and organization role matching is exact, instance roles keep their scoped matching, and an organization role never satisfies an instance role check. Fields an older API leaves out answer false. These are for showing and hiding UI only: the server must still enforce. They reflect the last `/users/me` read, so a change reaches the client when the user is next refreshed.
+
+### Patch Changes
+
+- Updated dependencies [de0a386]
+- Updated dependencies [1a9270e]
+- Updated dependencies [de0a386]
+  - @seamless-auth/client@0.9.0
+
 ## 0.4.1
 
 ### Patch Changes

diff --git a/packages/angular/package.json b/packages/angular/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/angular",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Angular bindings for Seamless Auth: a signal-based auth service, route guards, and optional sign-in screens.",
   "type": "module",
   "engines": {
@@ -43,7 +43,7 @@
     "rxjs": "^7.4.0"
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.8.1",
+    "@seamless-auth/client": "^0.9.0",
     "tslib": "^2.7.0"
   },
   "sideEffects": [

diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @seamless-auth/client
 
+## 0.9.0
+
+### Minor Changes
+
+- de0a386: Add `hasPermission`, `hasAllPermissions`, `hasRole` and `hasOrganizationRole`, which read the permissions and roles the `/users/me` user carries, and a `usePermissions` hook in `@seamless-auth/react`. A permission is held if the instance or the active organization grants it, and `{ organization: true }` counts only the active organization, matching the server's `requirePermission`. Permission and organization role matching is exact, instance roles keep their scoped matching, and an organization role never satisfies an instance role check. Fields an older API leaves out answer false. These are for showing and hiding UI only: the server must still enforce. They reflect the last `/users/me` read, so a change reaches the client when the user is next refreshed.
+
+### Patch Changes
+
+- 1a9270e: Depend on `@seamless-auth/types` `^0.36.0`, which adds the session exchange contract.
+- de0a386: Depend on `@seamless-auth/types` `^0.38.0`, which adds permissions and organization roles to the `/users/me` user.
+
 ## 0.8.3
 
 ### Patch Changes

diff --git a/packages/client/package.json b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/client",
-  "version": "0.8.3",
+  "version": "0.9.0",
   "description": "Framework-agnostic client core for Seamless Auth: the HTTP client, session store, and result types the framework bindings share.",
   "type": "module",
   "exports": {

diff --git a/packages/react-native/CHANGELOG.md b/packages/react-native/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @seamless-auth/react-native
 
+## 0.5.0
+
+### Minor Changes
+
+- de0a386: Add `hasPermission`, `hasAllPermissions`, `hasRole` and `hasOrganizationRole`, which read the permissions and roles the `/users/me` user carries, and a `usePermissions` hook in `@seamless-auth/react`. A permission is held if the instance or the active organization grants it, and `{ organization: true }` counts only the active organization, matching the server's `requirePermission`. Permission and organization role matching is exact, instance roles keep their scoped matching, and an organization role never satisfies an instance role check. Fields an older API leaves out answer false. These are for showing and hiding UI only: the server must still enforce. They reflect the last `/users/me` read, so a change reaches the client when the user is next refreshed.
+
+### Patch Changes
+
+- 1a9270e: Depend on `@seamless-auth/types` `^0.36.0`, which adds the session exchange contract.
+- de0a386: Depend on `@seamless-auth/types` `^0.38.0`, which adds permissions and organization roles to the `/users/me` user.
+- Updated dependencies [de0a386]
+- Updated dependencies [1a9270e]
+- Updated dependencies [de0a386]
+  - @seamless-auth/client@0.9.0
+
 ## 0.4.3
 
 ### Patch Changes

diff --git a/packages/react-native/package.json b/packages/react-native/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/react-native",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "Headless React Native binding for Seamless Auth: provider, hooks, and the native ports for passkeys, secure token storage, and in-app browser OAuth.",
   "type": "module",
   "exports": {
@@ -45,7 +45,7 @@
     "react": "^18.0.0 || ^19.0.0"
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.8.3",
+    "@seamless-auth/client": "^0.9.0",
     "@seamless-auth/types": "^0.38.0"
   },
   "sideEffects": false

diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @seamless-auth/react
 
+## 0.20.0
+
+### Minor Changes
+
+- de0a386: Add `hasPermission`, `hasAllPermissions`, `hasRole` and `hasOrganizationRole`, which read the permissions and roles the `/users/me` user carries, and a `usePermissions` hook in `@seamless-auth/react`. A permission is held if the instance or the active organization grants it, and `{ organization: true }` counts only the active organization, matching the server's `requirePermission`. Permission and organization role matching is exact, instance roles keep their scoped matching, and an organization role never satisfies an instance role check. Fields an older API leaves out answer false. These are for showing and hiding UI only: the server must still enforce. They reflect the last `/users/me` read, so a change reaches the client when the user is next refreshed.
+
+### Patch Changes
+
+- 8062f12: The built-in screens' default colours now meet WCAG 2.2 AA contrast. On the passkey enrollment screen the primary button is `#047857` (hover `#065f46`), the outlined button `#047857`, the skip link `#1d4ed8`, and the success and error messages `#047857` and `#b91c1c` against the light panel. On the recovery code, authenticator app, and account security screens the primary button is `#2563eb` (hover `#1d4ed8`) and outlined buttons such as Copy and Download are `#60a5fa`. The resend link's hover colour on the email and phone code screens is `#93c5fd`, and the code entry boxes have a `#9ca3af` border so they stand out from the card. These are fallbacks of the existing `--seamless-*` custom properties, so an app that sets those tokens sees no change. The theming section of the README now lists `--seamless-accent-muted` and the new defaults.
+- 1a9270e: Depend on `@seamless-auth/types` `^0.36.0`, which adds the session exchange contract.
+- de0a386: Depend on `@seamless-auth/types` `^0.38.0`, which adds permissions and organization roles to the `/users/me` user.
+- Updated dependencies [de0a386]
+- Updated dependencies [1a9270e]
+- Updated dependencies [de0a386]
+  - @seamless-auth/client@0.9.0
+
 ## 0.19.3
 
 ### Patch Changes

diff --git a/packages/react/package.json b/packages/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/react",
-  "version": "0.19.3",
+  "version": "0.20.0",
   "description": "A drop-in authentication solution for modern React applications.",
   "type": "module",
   "exports": {
@@ -56,7 +56,7 @@
     }
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.8.3",
+    "@seamless-auth/client": "^0.9.0",
     "@seamless-auth/types": "^0.38.0",
     "@simplewebauthn/browser": "^13.1.0",
     "libphonenumber-js": "^1.12.7"

diff --git a/packages/svelte/CHANGELOG.md b/packages/svelte/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @seamless-auth/svelte
 
+## 0.4.0
+
+### Minor Changes
+
+- de0a386: Add `hasPermission`, `hasAllPermissions`, `hasRole` and `hasOrganizationRole`, which read the permissions and roles the `/users/me` user carries, and a `usePermissions` hook in `@seamless-auth/react`. A permission is held if the instance or the active organization grants it, and `{ organization: true }` counts only the active organization, matching the server's `requirePermission`. Permission and organization role matching is exact, instance roles keep their scoped matching, and an organization role never satisfies an instance role check. Fields an older API leaves out answer false. These are for showing and hiding UI only: the server must still enforce. They reflect the last `/users/me` read, so a change reaches the client when the user is next refreshed.
+
+### Patch Changes
+
+- Updated dependencies [de0a386]
+- Updated dependencies [1a9270e]
+- Updated dependencies [de0a386]
+  - @seamless-auth/client@0.9.0
+
 ## 0.3.1
 
 ### Patch Changes

diff --git a/packages/svelte/package.json b/packages/svelte/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/svelte",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Svelte bindings for Seamless Auth: a rune-based session, SvelteKit guards, and optional sign-in screens.",
   "type": "module",
   "svelte": "./dist/index.js",
@@ -70,7 +70,7 @@
     }
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.8.1"
+    "@seamless-auth/client": "^0.9.0"
   },
   "sideEffects": [
     "*.css"

diff --git a/packages/vue/CHANGELOG.md b/packages/vue/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @seamless-auth/vue
 
+## 0.4.0
+
+### Minor Changes
+
+- de0a386: Add `hasPermission`, `hasAllPermissions`, `hasRole` and `hasOrganizationRole`, which read the permissions and roles the `/users/me` user carries, and a `usePermissions` hook in `@seamless-auth/react`. A permission is held if the instance or the active organization grants it, and `{ organization: true }` counts only the active organization, matching the server's `requirePermission`. Permission and organization role matching is exact, instance roles keep their scoped matching, and an organization role never satisfies an instance role check. Fields an older API leaves out answer false. These are for showing and hiding UI only: the server must still enforce. They reflect the last `/users/me` read, so a change reaches the client when the user is next refreshed.
+
+### Patch Changes
+
+- Updated dependencies [de0a386]
+- Updated dependencies [1a9270e]
+- Updated dependencies [de0a386]
+  - @seamless-auth/client@0.9.0
+
 ## 0.3.1
 
 ### Patch Changes

diff --git a/packages/vue/package.json b/packages/vue/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/vue",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Vue bindings for Seamless Auth: a plugin and composable for session state, route guards, and optional sign-in screens.",
   "type": "module",
   "exports": {
@@ -63,7 +63,7 @@
     }
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.8.1"
+    "@seamless-auth/client": "^0.9.0"
   },
   "sideEffects": [
     "*.css"