@bitbaum/accountkit 0.0.0-stage → 0.8.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 bitbaum
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,215 @@
-# Temporary Holding Version
+# @bitbaum/accountkit
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+One account for every bitbaum product: the account menu (who is signed in, where to go, how to sign out), and **Sign in with OrangeCat** (`@bitbaum/accountkit/orangecat`).
+
+Each product had written its own — Loki's `AccountMenu`, OrangeCat's `UserProfileDropdown` — and each had learned half of what the other had. Loki took initials only from the name; OrangeCat never rebuilt a name from the email address; OrangeCat had arrow keys and a 44px target, Loki had neither; Loki's public pages had no menu at all, so a signed-in person could not find sign-out. This is the one menu, with both halves.
+
+It knows nothing about how you sign in. NextAuth, Supabase, better-auth: you pass the person, the places, and a sign-out function.
+
+## Install
+
+Use the current verified installation command on the
+[AccountKit package page](https://bitbaum.orangecat.ch/packages/accountkit/).
+Fleet's [package registry](https://github.com/bitbaum/fleet/blob/main/registers/packages.json)
+is the source for the verified artifact and install transport; npm may lag a
+verified Git release. [Release history](CHANGELOG.md) distinguishes the
+registration designs shipped in different versions.
+
+`dist/` is committed, so the `github:` install needs no build step and no `allowBuilds` entry.
+
+## Password recovery
+
+`SignInForm` includes password recovery when `signInMethods(env, mail.configured)`
+reports `passwordReset`. It uses the product's Better Auth client and sends the
+reset link back to its existing `signInPath`, preserving the local `next` path.
+That page must remain reachable when signed out and must render `SignInForm`
+when the reset callback carries `token` or `error=INVALID_TOKEN`. The form removes
+the token from browser history after reading it. Products with a separate reset
+route can render `PasswordRecoveryForm` from `@bitbaum/accountkit/auth/react`.
+
+The standard mail adapter is `createAuthMailer` from `@bitbaum/accountkit/auth/mail`:
+
+```ts
+import { createAuthMailer } from "@bitbaum/accountkit/auth/mail";
+const mail = createAuthMailer({ site: { title: "Example", url: "https://example.ch" } });
+```
+
+Install its optional peer `@bitbaum/mail-kit`. The adapter reads deployment
+configuration lazily, uses the fleet sender and the product's reply address,
+and supports subject overrides. It rejects malformed or foreign-origin links
+and never logs a token, address or credential. Configuration still needs a real
+Resend key and working sender; this adapter does not claim delivery readiness.
+
+The sender must actually deliver account mail: `createAuthRuntime({ mail })`
+calls `mail.send("reset", to, url)`. A deployment with `mail.configured=false`
+does not offer recovery and disables its server request handler. A no-op sender
+does not implement recovery. `authLabelsFor(locale)` includes recovery words;
+older product label overrides remain compatible through the English fallback.
+
+The package checks the complete token/callback/reset journey against Postgres,
+including account-existence parity, expiry, one-time use, session revocation and
+external-redirect rejection. Its browser suite checks the forms at 320px, 390px
+and desktop width. Consumers must also verify their own page wiring and delivery.
+
+```ts
+import "@bitbaum/accountkit/styles.css";
+import { AccountMenu } from "@bitbaum/accountkit";
+```
+
+## Use
+
+```tsx
+<AccountMenu
+  user={{ name: session.user.name, email: session.user.email, image: session.user.image }}
+  groups={[{ id: "nav", items: [{ id: "settings", label: "Settings", href: "/settings" }] }]}
+  extra={<ThemeToggle />}
+  onSignOut={() => signOut({ callbackUrl: "/sign-in" })}
+  renderLink={(props) => <Link {...props} />}
+/>
+```
+
+- **`onSignOut`** may return a promise. While it runs the row says so; if it rejects, the menu stays open and says sign-out did not complete. A sign-out that fails silently is the one thing this menu must never do.
+- **`renderLink`** keeps your router (Next `<Link>`); the default is a plain `<a>`.
+- **`extra`** is for rows that are not places, such as a theme switch.
+- **`labels`** translates every string: `labels={{ trigger: "Konto: {name}", signOut: "Abmelden" }}`.
+
+## What is shared, and not configurable
+
+- **The name is never built from the email.** No name: `@handle`. No handle: "Account".
+- **Initials come from the name only.** No name and no photo: a person glyph.
+- **A photo that fails to load** falls back to initials, then the glyph.
+- **44px** trigger and rows. The panel never runs off a 320–390px screen.
+- **Escape** closes and returns focus to the trigger, wherever focus was. **Arrows**, **Home** and **End** move between items. A click outside closes.
+
+## Theming
+
+Every colour, radius and font is an `--acct-*` variable. The defaults read `@bitbaum/design-tokens` at zero specificity, so apps on those tokens match with no work and an app's own `:root` always wins. An app whose tokens are full colours rather than HSL triplets (Loki's are OKLCH) maps them once:
+
+```css
+:root {
+  --acct-panel: var(--surface-overlay);
+  --acct-fg: var(--text-primary);
+  /* … */
+}
+```
+
+## Accounts (`@bitbaum/accountkit/auth`)
+
+Every product owns its accounts, and they are the same account system everywhere: email and password, a magic link, passkeys, two-factor codes, the shared bitbaum sign-in and Sign in with OrangeCat (each shown only when configured). Built on [better-auth](https://www.better-auth.com) 1.x, so a product writes none of it.
+
+```ts
+// lib/db/schema.ts — one identical migration in every product
+export * from "@bitbaum/accountkit/auth/schema";
+
+// lib/auth.ts
+import { createAuthRuntime } from "@bitbaum/accountkit/auth/next";
+export const { GET, POST, getSession, requireUser, authStatus, getAuth } = createAuthRuntime({
+  site: { url: "https://app.example.ch", title: "Example", slug: "example" },
+  mail: { configured, send },            // your mail-kit sender; never log the link
+  isDatabaseConfigured: (env) => Boolean(env.DATABASE_URL),
+  getDatabase: () => db,                 // Drizzle, built on first use
+});
+
+// app/api/auth/[...all]/route.ts
+export { GET, POST } from "@/lib/auth";
+
+// lib/auth-client.ts
+import { createAuthClient } from "better-auth/react";
+import { authClientPlugins } from "@bitbaum/accountkit/auth/client";
+export const authClient = createAuthClient({ plugins: authClientPlugins() });
+```
+
+The screens are shared too (`@bitbaum/accountkit/auth/react`): `SignInForm`, `SignUpForm` and `AccountPanel`. They hold the logic and take the product's words (`labels`: `authLabelsFor(locale)` from `@bitbaum/accountkit/auth` has English, German, French, Italian, Romansh and Russian, so a product keeps no copy of its own; override `account.roles` if its roles have other names) and look (`classes`; without them the `acct-auth-*` classes in `styles.css` apply, on `--acct-*` variables):
+
+```tsx
+<SignInForm client={authClient} methods={signInMethods(process.env, mailConfigured)}
+  labels={myLabels} classes={{ button: "btn-primary", input: "field" }}
+  next="/de/matters" signInPath="/de/sign-in" signUpLink={<Link href="/sign-up">…</Link>} />
+```
+
+A product whose rows were keyed on an OrangeCat actor id before it had accounts passes `legacyIdentityProvider: "orangecat"`: a person whose first way in was OrangeCat keeps that id as `user.actorId`, so nothing has to be migrated; everyone else's `actorId` is their user id.
+
+What is the same everywhere, and not configurable per product: passwords of at least 8 characters and no other rule; a sign-up asks for an email and a password, nothing else; sessions of 14 days; no IP addresses stored; an address is never an identity (a new method joins an account only when the signed-in person links it); provider tokens are never kept; a sign-up cannot choose its role; one rate limiter keyed on the proxy's hop (limitkit), with a stricter bucket for anything that sends mail. `signInMethods(env, mailConfigured)` says which buttons to show, as booleans.
+
+Needs `BETTER_AUTH_SECRET` (32+ characters; a product moving off next-auth may keep its `AUTH_SECRET`) and a database; without them every auth route answers 503 `accounts_unavailable` instead of crashing. Peer dependencies: `better-auth`, `@better-auth/passkey`, `drizzle-orm`, and `next` for `/auth/next`.
+
+## Verify
+
+```sh
+pnpm run verify   # format, lint, types, build, unit + render tests, real-browser checks
+```
+
+The browser checks run the demo at 390px in light and dark: 44px targets, no sideways scroll with the menu open, Escape after a mouse open, arrow keys, outside click, a broken photo, an anonymous account, and a failing sign-out.
+
+## Sign in with OrangeCat — `@bitbaum/accountkit/orangecat`
+
+Nine apps wrote this themselves and each learned something the others had not. This is all of it, once. Server-only, no next-auth import (the types are structural), so it serves Auth.js v5 and next-auth v4.
+
+```ts
+import { orangecatClient, orangecatProvider, syncOcSession } from "@bitbaum/accountkit/orangecat";
+
+const orangecat = orangecatClient(); // ORANGECAT_OAUTH_CLIENT_ID / _SECRET / _ISSUER, or null
+
+export const { handlers, auth, signIn, signOut } = NextAuth({
+  session: { strategy: "jwt" },
+  pages: { error: "/auth/error" },
+  providers: orangecat ? [orangecatProvider(orangecat)] : [],
+  callbacks: {
+    jwt: ({ token, account, profile }) => syncOcSession({ token, account, profile }, orangecat),
+    session: ({ session, token }) => ({ ...session, actorId: token.actorId }),
+  },
+});
+```
+
+What is not configurable, and why:
+
+- **`client_secret_post` and PKCE.** OrangeCat's token endpoint accepts only `client_secret_post`; the Auth.js default is answered with a 400 that reads "client_id is required". PKCE is required even with a secret.
+- **`profile()` has no `email`.** OrangeCat auto-confirms addresses, so `email_verified` proves nothing. With an `email`, Auth.js looks a new account up by it and either links (takeover) or refuses. The address rides along as `contactEmail`, contact data only. The identity is `sub` (`token.actorId`), never the email.
+- **A revoked grant ends the session.** `syncOcSession` refreshes once the access token expires; `invalid_grant` drops `actorId` (read that, never `token.sub`, as "signed in"); any other failure keeps the session and retries in 60 s. Safe inside `jwt()` since orangecat#1212 (confidential clients keep their refresh token).
+
+Entry: `signIn("orangecat", { redirectTo: returnPath(from) }, authorizationParams({ mode, email, provider }))` → `prompt=create`, `login_hint`, `idp_hint` (google, github — the providers OrangeCat has switched on). `returnPath` accepts only same-origin paths.
+
+Apps with their own user table:
+
+- `withOrangecatIdentity(adapter, store, { keepTokens })` — an OrangeCat sign-in resolves by `sub` alone; a new sub always creates a new user, stored with its OrangeCat address when free and `orangecat-<sub>@users.invalid` when taken. Linking an existing account is Auth.js's own path (sign in, then sign in with OrangeCat). `keepTokens: true` also writes the accounts row (for an app that calls OrangeCat on the person's behalf).
+- `resolveOrangecatUser(store, identity)` — the same, for a callback (next-auth v4, no adapter). Survives the insert race.
+- `decideOrangecatSignIn(input, policy)` — the pure rule, with `whenEmailTaken` / `whenNoEmail: "refuse"` for an app that prefers to send the person to connect from their profile.
+- `mintLinkToken` / `readLinkToken` — evig's "Connect OrangeCat": a 10-minute signed cookie set from inside the session, so the identity that comes back attaches to that account and no other.
+- `emailEarnsPromotion(provider)` — never ADMIN_EMAILS promotion for an OrangeCat login.
+- `mayReceivePasswordReset({ email, hasPassword, orangecatLinked })` — no reset link for an account OrangeCat created, or for a placeholder.
+
+### The error screen
+
+```tsx
+import { SignInError } from "@bitbaum/accountkit";
+
+// app/auth/error/page.tsx — Auth.js `pages.error`
+<SignInError error={searchParams.error} retry={restartSignIn} retryFields={{ from }} home="/" />
+```
+
+**Import `@bitbaum/accountkit/styles.css`** (once, in the root layout or globals) and map the `--acct-*` variables onto the app's tokens, or the screen renders as bare text — solon shipped exactly that once, and no lint or typecheck can see it. Look at it at 390px before merging.
+
+**Try again restarts sign-in** (a server action calling `signIn("orangecat", …)`, or a GET route that does). It never goes home, and it never prints the provider's error code. No hooks: renders in a server component.
+
+MIT.
+
+### Request-dependent sessions
+
+`getSession()` is a server-component request API. It reads Next headers before
+checking deployment readiness and lets framework rendering signals propagate.
+A build without account secrets must not cache a signed-out page or redirect for
+all future sessions. Calls outside a request are errors, not signed-out users.
+
+### Second-factor policy
+
+An enabled second factor applies to password, email-link, passkey and OIDC sign-in. The server reuses BetterAuth's native signed challenge, trusted-device validation, attempt limits and expiry. A primary credential alone does not leave an authenticated session while the challenge is pending.
+
+Shared forms complete both JSON `twoFactorRedirect` responses and app-local `?twoFactor=1` redirects. Custom clients must handle those states and supply their local sign-in screen as `errorCallbackURL` for email/OIDC callbacks. `SignUpForm` accepts an optional `signInPath` for nonstandard route names; standard `/sign-up` routes infer the sibling `/sign-in`. Challenge URLs contain no bearer credential.
+
+## Password entry
+
+The shared registration form asks for password confirmation, preserves paste
+and password-manager autofill, and offers a localized show/hide control for
+both fields. A mismatch stays on the form and never calls registration. It
+still asks for no real name. Passwordless methods keep their existing flow.
+Products consume this behavior through the package rather than duplicating it.

package/dist/AccountMenu.d.ts

@@ -0,0 +1,76 @@
+import { type ReactNode } from "react";
+import { type AccountUser } from "./identity.js";
+/** A place to go. Rendered through `renderLink` so a Next app keeps <Link>. */
+export type AccountLinkItem = {
+    id: string;
+    label: string;
+    href: string;
+    icon?: ReactNode;
+};
+/** Something to do. Closes the menu, then runs. */
+export type AccountActionItem = {
+    id: string;
+    label: string;
+    onSelect: () => void | Promise<unknown>;
+    icon?: ReactNode;
+};
+export type AccountItem = AccountLinkItem | AccountActionItem;
+/** Items are grouped; a divider separates groups. */
+export type AccountGroup = {
+    id: string;
+    items: AccountItem[];
+};
+export type AccountMenuLabels = {
+    /** Accessible name of the trigger; "{name}" is replaced. */
+    trigger: string;
+    menu: string;
+    signOut: string;
+    signingOut: string;
+    signOutFailed: string;
+};
+export type RenderLinkProps = {
+    href: string;
+    className: string;
+    role: "menuitem";
+    tabIndex: -1;
+    onClick: () => void;
+    children: ReactNode;
+};
+export type AccountMenuProps = {
+    user: AccountUser;
+    /**
+     * Called when the person signs out. May return a promise; while it is
+     * pending the row says so, and if it rejects the menu stays open and says
+     * the sign-out did not complete — a dead sign-out is the one failure this
+     * menu must never hide.
+     */
+    onSignOut: () => void | Promise<unknown>;
+    groups?: AccountGroup[];
+    /**
+     * Rows that are not menu items — a theme switch, a status line. Rendered
+     * between the groups and Sign out, not navigable by arrow keys.
+     */
+    extra?: ReactNode;
+    /** Defaults to a plain <a>. Pass `(p) => <Link {...p} />` in a Next app. */
+    renderLink?: (props: RenderLinkProps) => ReactNode;
+    labels?: Partial<AccountMenuLabels>;
+    /** Which edge of the trigger the panel aligns to. */
+    align?: "end" | "start";
+    className?: string;
+};
+/**
+ * The account menu: who is signed in, where to go, how to sign out.
+ *
+ * Identity, not navigation: the app's sidebar is for places in the product;
+ * this is for the person. Nothing should appear in both.
+ *
+ * Behaviour that is shared and NOT configurable, because each item shipped
+ * broken in at least one app:
+ *  - a 44px trigger (Loki's was 36px, under the touch-target floor);
+ *  - a photo that fails to load falls back to initials, then a glyph;
+ *  - Escape closes and returns focus to the trigger; arrows, Home and End
+ *    move between items; a click outside closes;
+ *  - sign-out shows that it is happening, and says so when it fails.
+ */
+export declare function AccountMenu({ user, onSignOut, groups, extra, renderLink, labels: labelOverrides, align, className, }: AccountMenuProps): import("react").JSX.Element;
+//# sourceMappingURL=AccountMenu.d.ts.map

package/dist/AccountMenu.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountMenu.d.ts","sourceRoot":"","sources":["../src/AccountMenu.tsx"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAEvB,+EAA+E;AAC/E,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB,CAAC;AAEF,mDAAmD;AACnD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAE9D,qDAAqD;AACrD,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAUF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,CAAC,CAAC,CAAC;IACb,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,SAAS,CAAC;IACnD,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpC,qDAAqD;IACrD,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA+BF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,EAC1B,IAAI,EACJ,SAAS,EACT,MAAW,EACX,KAAK,EACL,UAAwB,EACxB,MAAM,EAAE,cAAc,EACtB,KAAa,EACb,SAAS,GACV,EAAE,gBAAgB,+BA8OlB"}

package/dist/AccountMenu.js

@@ -0,0 +1,156 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Fragment, useCallback, useEffect, useId, useRef, useState, } from "react";
+import { displayNameFor, initialsFor, nextMenuIndex, secondaryLineFor, } from "./identity.js";
+const DEFAULT_LABELS = {
+    trigger: "Account: {name}",
+    menu: "Account",
+    signOut: "Sign out",
+    signingOut: "Signing out…",
+    signOutFailed: "Sign-out did not complete. Try again.",
+};
+function defaultLink(props) {
+    return _jsx("a", { ...props });
+}
+function isLink(item) {
+    return "href" in item;
+}
+/** A person outline — drawn when there is neither a photo nor a name. */
+function PersonGlyph() {
+    return (_jsxs("svg", { className: "acct-glyph", viewBox: "0 0 24 24", width: "18", height: "18", "aria-hidden": "true", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [_jsx("circle", { cx: "12", cy: "8", r: "4" }), _jsx("path", { d: "M4 21a8 8 0 0 1 16 0" })] }));
+}
+/**
+ * The account menu: who is signed in, where to go, how to sign out.
+ *
+ * Identity, not navigation: the app's sidebar is for places in the product;
+ * this is for the person. Nothing should appear in both.
+ *
+ * Behaviour that is shared and NOT configurable, because each item shipped
+ * broken in at least one app:
+ *  - a 44px trigger (Loki's was 36px, under the touch-target floor);
+ *  - a photo that fails to load falls back to initials, then a glyph;
+ *  - Escape closes and returns focus to the trigger; arrows, Home and End
+ *    move between items; a click outside closes;
+ *  - sign-out shows that it is happening, and says so when it fails.
+ */
+export function AccountMenu({ user, onSignOut, groups = [], extra, renderLink = defaultLink, labels: labelOverrides, align = "end", className, }) {
+    const labels = { ...DEFAULT_LABELS, ...labelOverrides };
+    const [open, setOpen] = useState(false);
+    const [imageFailed, setImageFailed] = useState(false);
+    const [signingOut, setSigningOut] = useState(false);
+    const [signOutError, setSignOutError] = useState(false);
+    const rootRef = useRef(null);
+    const triggerRef = useRef(null);
+    const panelRef = useRef(null);
+    const panelId = useId();
+    const name = displayNameFor(user);
+    const initials = initialsFor(user);
+    const secondary = secondaryLineFor(user);
+    const showImage = Boolean(user.image) && !imageFailed;
+    // A new image URL deserves a fresh attempt.
+    useEffect(() => setImageFailed(false), [user.image]);
+    const items = useCallback(() => Array.from(panelRef.current?.querySelectorAll('[role="menuitem"]:not([disabled])') ?? []), []);
+    const close = useCallback((restoreFocus) => {
+        setOpen(false);
+        if (restoreFocus)
+            triggerRef.current?.focus();
+    }, []);
+    // A click anywhere outside closes — a listener, not a full-page scrim, so
+    // the click still reaches whatever it was aimed at.
+    //
+    // Escape is listened for on the DOCUMENT, not the panel. Opened with the
+    // mouse, focus stays on the trigger, so a panel-only handler never sees the
+    // key: the browser check caught Escape doing nothing after a click.
+    useEffect(() => {
+        if (!open)
+            return;
+        const onPointerDown = (event) => {
+            if (!rootRef.current?.contains(event.target))
+                close(false);
+        };
+        const onKeyDown = (event) => {
+            if (event.key === "Escape") {
+                event.preventDefault();
+                close(true);
+            }
+        };
+        document.addEventListener("pointerdown", onPointerDown);
+        document.addEventListener("keydown", onKeyDown);
+        return () => {
+            document.removeEventListener("pointerdown", onPointerDown);
+            document.removeEventListener("keydown", onKeyDown);
+        };
+    }, [open, close]);
+    function focusAt(index) {
+        const list = items();
+        list[index]?.focus();
+    }
+    function openWithFocus(index) {
+        setOpen(true);
+        setSignOutError(false);
+        // After render: the panel does not exist yet.
+        requestAnimationFrame(() => {
+            const list = items();
+            focusAt(index === "first" ? 0 : list.length - 1);
+        });
+    }
+    function onTriggerKeyDown(event) {
+        if (event.key === "ArrowDown") {
+            event.preventDefault();
+            openWithFocus("first");
+        }
+        else if (event.key === "ArrowUp") {
+            event.preventDefault();
+            openWithFocus("last");
+        }
+    }
+    function onPanelKeyDown(event) {
+        // Escape is handled by the document listener above, wherever focus is.
+        if (event.key === "Tab") {
+            close(false);
+            return;
+        }
+        if (event.key === "ArrowDown" ||
+            event.key === "ArrowUp" ||
+            event.key === "Home" ||
+            event.key === "End") {
+            event.preventDefault();
+            const list = items();
+            const current = list.indexOf(document.activeElement);
+            focusAt(nextMenuIndex(current, event.key, list.length));
+        }
+    }
+    async function signOut() {
+        setSigningOut(true);
+        setSignOutError(false);
+        try {
+            await onSignOut();
+            // On success the app usually navigates away; closing covers the case
+            // where it does not.
+            setOpen(false);
+        }
+        catch {
+            setSignOutError(true);
+        }
+        finally {
+            setSigningOut(false);
+        }
+    }
+    return (_jsxs("div", { ref: rootRef, className: ["acct", className].filter(Boolean).join(" "), "data-align": align, children: [_jsx("button", { ref: triggerRef, type: "button", className: "acct-trigger", "aria-haspopup": "menu", "aria-expanded": open, "aria-controls": open ? panelId : undefined, "aria-label": labels.trigger.replace("{name}", name), title: name, onClick: () => {
+                    setOpen((v) => !v);
+                    setSignOutError(false);
+                }, onKeyDown: onTriggerKeyDown, children: showImage ? (_jsx("img", { className: "acct-avatar", src: user.image ?? undefined, alt: "", onError: () => setImageFailed(true) })) : initials ? (_jsx("span", { className: "acct-initials", "aria-hidden": "true", children: initials })) : (_jsx(PersonGlyph, {})) }), open && (_jsxs("div", { ref: panelRef, id: panelId, className: "acct-panel", role: "menu", "aria-label": labels.menu, onKeyDown: onPanelKeyDown, children: [_jsxs("div", { className: "acct-identity", children: [_jsx("p", { className: "acct-name", children: name }), secondary && _jsx("p", { className: "acct-secondary", children: secondary })] }), groups
+                        .filter((g) => g.items.length > 0)
+                        .map((group) => (_jsx("div", { className: "acct-group", role: "group", children: group.items.map((item) => isLink(item) ? (_jsx(Fragment, { children: renderLink({
+                                href: item.href,
+                                className: "acct-row",
+                                role: "menuitem",
+                                tabIndex: -1,
+                                onClick: () => close(false),
+                                children: (_jsxs(_Fragment, { children: [item.icon && (_jsx("span", { className: "acct-icon", children: item.icon })), _jsx("span", { children: item.label })] })),
+                            }) }, item.id)) : (_jsxs("button", { type: "button", className: "acct-row", role: "menuitem", tabIndex: -1, onClick: () => {
+                                close(false);
+                                void item.onSelect();
+                            }, children: [item.icon && (_jsx("span", { className: "acct-icon", children: item.icon })), _jsx("span", { children: item.label })] }, item.id))) }, group.id))), extra && _jsx("div", { className: "acct-group acct-extra", children: extra }), _jsxs("div", { className: "acct-group", children: [_jsx("button", { type: "button", className: "acct-row acct-signout", role: "menuitem", tabIndex: -1, disabled: signingOut, "aria-busy": signingOut, onClick: () => void signOut(), children: _jsx("span", { children: signingOut ? labels.signingOut : labels.signOut }) }), signOutError && (_jsx("p", { className: "acct-error", role: "alert", children: labels.signOutFailed }))] })] }))] }));
+}
+//# sourceMappingURL=AccountMenu.js.map

package/dist/AccountMenu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountMenu.js","sourceRoot":"","sources":["../src/AccountMenu.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EACL,QAAQ,EACR,WAAW,EACX,SAAS,EACT,KAAK,EACL,MAAM,EACN,QAAQ,GAGT,MAAM,OAAO,CAAC;AACf,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,gBAAgB,GAEjB,MAAM,eAAe,CAAC;AAgCvB,MAAM,cAAc,GAAsB;IACxC,OAAO,EAAE,iBAAiB;IAC1B,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,cAAc;IAC1B,aAAa,EAAE,uCAAuC;CACvD,CAAC;AAkCF,SAAS,WAAW,CAAC,KAAsB;IACzC,OAAO,eAAO,KAAK,GAAI,CAAC;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,IAAiB;IAC/B,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW;IAClB,OAAO,CACL,eACE,SAAS,EAAC,YAAY,EACtB,OAAO,EAAC,WAAW,EACnB,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,iBACC,MAAM,EAClB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,GAAG,EACf,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,aAEtB,iBAAQ,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,GAAG,EAAC,CAAC,EAAC,GAAG,GAAG,EAC/B,eAAM,CAAC,EAAC,sBAAsB,GAAG,IAC7B,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,IAAI,EACJ,SAAS,EACT,MAAM,GAAG,EAAE,EACX,KAAK,EACL,UAAU,GAAG,WAAW,EACxB,MAAM,EAAE,cAAc,EACtB,KAAK,GAAG,KAAK,EACb,SAAS,GACQ;IACjB,MAAM,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,cAAc,EAAE,CAAC;IACxD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAoB,IAAI,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;IAExB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;IAEtD,4CAA4C;IAC5C,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,MAAM,KAAK,GAAG,WAAW,CACvB,GAAG,EAAE,CACH,KAAK,CAAC,IAAI,CACR,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAChC,mCAAmC,CACpC,IAAI,EAAE,CACR,EACH,EAAE,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,YAAqB,EAAE,EAAE;QAClD,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,IAAI,YAAY;YAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,0EAA0E;IAC1E,oDAAoD;IACpD,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,oEAAoE;IACpE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,aAAa,GAAG,CAAC,KAAmB,EAAE,EAAE;YAC5C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAc,CAAC;gBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,KAA+B,EAAE,EAAE;YACpD,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC3B,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,QAAQ,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QACxD,QAAQ,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChD,OAAO,GAAG,EAAE;YACV,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAC3D,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAElB,SAAS,OAAO,CAAC,KAAa;QAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,SAAS,aAAa,CAAC,KAAuB;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,8CAA8C;QAC9C,qBAAqB,CAAC,GAAG,EAAE;YACzB,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,gBAAgB,CAAC,KAAuC;QAC/D,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YAC9B,KAAK,CAAC,cAAc,EAAE,CAAC;YACvB,aAAa,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACnC,KAAK,CAAC,cAAc,EAAE,CAAC;YACvB,aAAa,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,SAAS,cAAc,CAAC,KAAoC;QAC1D,uEAAuE;QACvE,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YACxB,KAAK,CAAC,KAAK,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QACD,IACE,KAAK,CAAC,GAAG,KAAK,WAAW;YACzB,KAAK,CAAC,GAAG,KAAK,SAAS;YACvB,KAAK,CAAC,GAAG,KAAK,MAAM;YACpB,KAAK,CAAC,GAAG,KAAK,KAAK,EACnB,CAAC;YACD,KAAK,CAAC,cAAc,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAA4B,CAAC,CAAC;YACpE,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO;QACpB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;YAClB,qEAAqE;YACrE,qBAAqB;YACrB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,CACL,eACE,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAC5C,KAAK,aAEjB,iBACE,GAAG,EAAE,UAAU,EACf,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,cAAc,mBACV,MAAM,mBACL,IAAI,mBACJ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,gBAC7B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAClD,KAAK,EAAE,IAAI,EACX,OAAO,EAAE,GAAG,EAAE;oBACZ,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnB,eAAe,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC,EACD,SAAS,EAAE,gBAAgB,YAE1B,SAAS,CAAC,CAAC,CAAC,CACX,cACE,SAAS,EAAC,aAAa,EACvB,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAC5B,GAAG,EAAC,EAAE,EACN,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GACnC,CACH,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACb,eAAM,SAAS,EAAC,eAAe,iBAAa,MAAM,YAC/C,QAAQ,GACJ,CACR,CAAC,CAAC,CAAC,CACF,KAAC,WAAW,KAAG,CAChB,GACM,EAER,IAAI,IAAI,CACP,eACE,GAAG,EAAE,QAAQ,EACb,EAAE,EAAE,OAAO,EACX,SAAS,EAAC,YAAY,EACtB,IAAI,EAAC,MAAM,gBACC,MAAM,CAAC,IAAI,EACvB,SAAS,EAAE,cAAc,aAEzB,eAAK,SAAS,EAAC,eAAe,aAC5B,YAAG,SAAS,EAAC,WAAW,YAAE,IAAI,GAAK,EAClC,SAAS,IAAI,YAAG,SAAS,EAAC,gBAAgB,YAAE,SAAS,GAAK,IACvD,EAEL,MAAM;yBACJ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;yBACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACd,cAAoB,SAAS,EAAC,YAAY,EAAC,IAAI,EAAC,OAAO,YACpD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACb,KAAC,QAAQ,cACN,UAAU,CAAC;gCACV,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,SAAS,EAAE,UAAU;gCACrB,IAAI,EAAE,UAAU;gCAChB,QAAQ,EAAE,CAAC,CAAC;gCACZ,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;gCAC3B,QAAQ,EAAE,CACR,8BACG,IAAI,CAAC,IAAI,IAAI,CACZ,eAAM,SAAS,EAAC,WAAW,YAAE,IAAI,CAAC,IAAI,GAAQ,CAC/C,EACD,yBAAO,IAAI,CAAC,KAAK,GAAQ,IACxB,CACJ;6BACF,CAAC,IAfW,IAAI,CAAC,EAAE,CAgBX,CACZ,CAAC,CAAC,CAAC,CACF,kBAEE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,UAAU,EACpB,IAAI,EAAC,UAAU,EACf,QAAQ,EAAE,CAAC,CAAC,EACZ,OAAO,EAAE,GAAG,EAAE;gCACZ,KAAK,CAAC,KAAK,CAAC,CAAC;gCACb,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACvB,CAAC,aAEA,IAAI,CAAC,IAAI,IAAI,CACZ,eAAM,SAAS,EAAC,WAAW,YAAE,IAAI,CAAC,IAAI,GAAQ,CAC/C,EACD,yBAAO,IAAI,CAAC,KAAK,GAAQ,KAbpB,IAAI,CAAC,EAAE,CAcL,CACV,CACF,IAtCO,KAAK,CAAC,EAAE,CAuCZ,CACP,CAAC,EAEH,KAAK,IAAI,cAAK,SAAS,EAAC,uBAAuB,YAAE,KAAK,GAAO,EAE9D,eAAK,SAAS,EAAC,YAAY,aACzB,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,uBAAuB,EACjC,IAAI,EAAC,UAAU,EACf,QAAQ,EAAE,CAAC,CAAC,EACZ,QAAQ,EAAE,UAAU,eACT,UAAU,EACrB,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,YAE7B,yBAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,GAAQ,GACvD,EACR,YAAY,IAAI,CACf,YAAG,SAAS,EAAC,YAAY,EAAC,IAAI,EAAC,OAAO,YACnC,MAAM,CAAC,aAAa,GACnB,CACL,IACG,IACF,CACP,IACG,CACP,CAAC;AACJ,CAAC"}

package/dist/SignInError.d.ts

@@ -0,0 +1,50 @@
+import type { ReactNode } from "react";
+/**
+ * Where Auth.js sends a sign-in that did not finish (`pages.error`).
+ *
+ * Every app had a different one: loki, skif and substrata showed Auth.js's
+ * bare "Error" page; heidi's "Try again" went to the home page, which is not
+ * trying again. Solon's was right, and this is it: "Try again" STARTS the
+ * sign-in again, directly, without another screen in between.
+ *
+ * It never prints the provider's error code. The codes mean nothing to a
+ * visitor and are a gift to anyone probing the endpoint; the operator's copy
+ * belongs in the server log.
+ *
+ * No hooks, no "use client": it renders in a server component, and `retry`
+ * may be a server action.
+ */
+export type SignInErrorKind = "failed" | "denied" | "configuration";
+/** Auth.js's `?error=` code → what the person is told. Anything unknown is "failed". */
+export declare function signInErrorKind(error: string | null | undefined): SignInErrorKind;
+export type SignInErrorLabels = {
+    kicker: string;
+    failedTitle: string;
+    failedBody: string;
+    deniedTitle: string;
+    deniedBody: string;
+    configurationTitle: string;
+    configurationBody: string;
+    tryAgain: string;
+    home: string;
+};
+export type SignInErrorProps = {
+    /** Auth.js's `?error=` search param, as received. Never shown. */
+    error?: string | null;
+    /**
+     * How "Try again" restarts sign-in: a server action that calls
+     * `signIn("orangecat", …)`, or the URL of a GET route that does.
+     * Never the home page.
+     */
+    retry: string | ((formData: FormData) => void | Promise<void>);
+    /** Hidden fields posted with a server-action retry (`from`, `locale`). */
+    retryFields?: Record<string, string>;
+    /** Where "Back to the start" goes. */
+    home?: string;
+    /** More ways on, shown first — e.g. "Add an email on OrangeCat" for a denial. */
+    children?: ReactNode;
+    labels?: Partial<SignInErrorLabels>;
+    className?: string;
+};
+export declare function SignInError({ error, retry, retryFields, home, children, labels: overrides, className, }: SignInErrorProps): import("react").JSX.Element;
+//# sourceMappingURL=SignInError.d.ts.map

package/dist/SignInError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInError.d.ts","sourceRoot":"","sources":["../src/SignInError.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEpE,wFAAwF;AACxF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,eAAe,CAIjB;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAiBF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,WAAW,CAAC,EAC1B,KAAK,EACL,KAAK,EACL,WAAW,EACX,IAAU,EACV,QAAQ,EACR,MAAM,EAAE,SAAS,EACjB,SAAS,GACV,EAAE,gBAAgB,+BA6ClB"}

package/dist/SignInError.js

@@ -0,0 +1,34 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/** Auth.js's `?error=` code → what the person is told. Anything unknown is "failed". */
+export function signInErrorKind(error) {
+    if (error === "AccessDenied")
+        return "denied";
+    if (error === "Configuration")
+        return "configuration";
+    return "failed";
+}
+const DEFAULT_LABELS = {
+    kicker: "Sign in",
+    failedTitle: "Sign-in did not finish",
+    failedBody: "Nothing was changed. Start again — it usually works the second time. If it keeps failing, OrangeCat may be briefly unavailable.",
+    deniedTitle: "This account cannot sign in here",
+    deniedBody: "OrangeCat signed you in, but this app could not accept the account.",
+    configurationTitle: "Sign-in is not available right now",
+    configurationBody: "Sign-in is not set up on this server yet. Nothing you did caused this.",
+    tryAgain: "Try again",
+    home: "Back to the start",
+};
+export function SignInError({ error, retry, retryFields, home = "/", children, labels: overrides, className, }) {
+    const labels = { ...DEFAULT_LABELS, ...overrides };
+    const kind = signInErrorKind(error);
+    const title = labels[`${kind}Title`];
+    const body = labels[`${kind}Body`];
+    // Retrying a server with no client configured fails the same way again.
+    const canRetry = kind !== "configuration";
+    // A denial is answered elsewhere first (the app's children), so the retry
+    // steps back to a secondary button there.
+    const retryClass = `acct-signin-button ${kind === "denied" && children ? "is-secondary" : ""}`;
+    return (_jsxs("section", { className: `acct-signin-error ${className ?? ""}`.trim(), "aria-labelledby": "acct-signin-error-title", "data-kind": kind, children: [_jsx("p", { className: "acct-signin-kicker", children: labels.kicker }), _jsx("h1", { id: "acct-signin-error-title", className: "acct-signin-title", children: title }), _jsx("p", { className: "acct-signin-body", children: body }), _jsxs("div", { className: "acct-signin-actions", children: [children, canRetry &&
+                        (typeof retry === "string" ? (_jsx("a", { className: retryClass, href: retry, children: labels.tryAgain })) : (_jsxs("form", { action: retry, children: [Object.entries(retryFields ?? {}).map(([name, value]) => (_jsx("input", { type: "hidden", name: name, value: value }, name))), _jsx("button", { type: "submit", className: retryClass, children: labels.tryAgain })] }))), _jsx("a", { className: "acct-signin-home", href: home, children: labels.home })] })] }));
+}
+//# sourceMappingURL=SignInError.js.map

package/dist/SignInError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInError.js","sourceRoot":"","sources":["../src/SignInError.tsx"],"names":[],"mappings":";AAoBA,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAC7B,KAAgC;IAEhC,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,eAAe,CAAC;IACtD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAcD,MAAM,cAAc,GAAsB;IACxC,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,wBAAwB;IACrC,UAAU,EACR,iIAAiI;IACnI,WAAW,EAAE,kCAAkC;IAC/C,UAAU,EACR,qEAAqE;IACvE,kBAAkB,EAAE,oCAAoC;IACxD,iBAAiB,EACf,wEAAwE;IAC1E,QAAQ,EAAE,WAAW;IACrB,IAAI,EAAE,mBAAmB;CAC1B,CAAC;AAqBF,MAAM,UAAU,WAAW,CAAC,EAC1B,KAAK,EACL,KAAK,EACL,WAAW,EACX,IAAI,GAAG,GAAG,EACV,QAAQ,EACR,MAAM,EAAE,SAAS,EACjB,SAAS,GACQ;IACjB,MAAM,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;IACnC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,IAAI,KAAK,eAAe,CAAC;IAC1C,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,UAAU,GAAG,sBAAsB,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAE/F,OAAO,CACL,mBACE,SAAS,EAAE,qBAAqB,SAAS,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,qBACxC,yBAAyB,eAC9B,IAAI,aAEf,YAAG,SAAS,EAAC,oBAAoB,YAAE,MAAM,CAAC,MAAM,GAAK,EACrD,aAAI,EAAE,EAAC,yBAAyB,EAAC,SAAS,EAAC,mBAAmB,YAC3D,KAAK,GACH,EACL,YAAG,SAAS,EAAC,kBAAkB,YAAE,IAAI,GAAK,EAC1C,eAAK,SAAS,EAAC,qBAAqB,aACjC,QAAQ,EACR,QAAQ;wBACP,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAC3B,YAAG,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,YAClC,MAAM,CAAC,QAAQ,GACd,CACL,CAAC,CAAC,CAAC,CACF,gBAAM,MAAM,EAAE,KAAK,aAChB,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CACxD,gBAAkB,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAA5C,IAAI,CAA4C,CAC7D,CAAC,EACF,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAE,UAAU,YACxC,MAAM,CAAC,QAAQ,GACT,IACJ,CACR,CAAC,EACJ,YAAG,SAAS,EAAC,kBAAkB,EAAC,IAAI,EAAE,IAAI,YACvC,MAAM,CAAC,IAAI,GACV,IACA,IACE,CACX,CAAC;AACJ,CAAC"}

package/dist/auth/client.d.ts

@@ -0,0 +1,19 @@
+import { passkeyClient } from "@better-auth/passkey/client";
+import { magicLinkClient, twoFactorClient } from "better-auth/client/plugins";
+/**
+ * The plugins the browser client needs, the same in every product:
+ *
+ *   import { createAuthClient } from "better-auth/react";
+ *   import { authClientPlugins } from "@bitbaum/accountkit/auth/client";
+ *   export const authClient = createAuthClient({ plugins: authClientPlugins() });
+ *
+ * The client itself is created by the product, because its fully inferred type
+ * cannot be written into a published declaration file. It talks only to this
+ * origin (/api/auth), which is all a strict CSP's `connect-src 'self'` allows.
+ */
+export declare function authClientPlugins(): [
+    ReturnType<typeof twoFactorClient>,
+    ReturnType<typeof passkeyClient>,
+    ReturnType<typeof magicLinkClient>
+];
+//# sourceMappingURL=client.d.ts.map

package/dist/auth/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI;IACnC,UAAU,CAAC,OAAO,eAAe,CAAC;IAClC,UAAU,CAAC,OAAO,aAAa,CAAC;IAChC,UAAU,CAAC,OAAO,eAAe,CAAC;CACnC,CAEA"}

package/dist/auth/client.js

@@ -0,0 +1,17 @@
+import { passkeyClient } from "@better-auth/passkey/client";
+import { magicLinkClient, twoFactorClient } from "better-auth/client/plugins";
+/**
+ * The plugins the browser client needs, the same in every product:
+ *
+ *   import { createAuthClient } from "better-auth/react";
+ *   import { authClientPlugins } from "@bitbaum/accountkit/auth/client";
+ *   export const authClient = createAuthClient({ plugins: authClientPlugins() });
+ *
+ * The client itself is created by the product, because its fully inferred type
+ * cannot be written into a published declaration file. It talks only to this
+ * origin (/api/auth), which is all a strict CSP's `connect-src 'self'` allows.
+ */
+export function authClientPlugins() {
+    return [twoFactorClient(), passkeyClient(), magicLinkClient()];
+}
+//# sourceMappingURL=client.js.map

package/dist/auth/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB;IAK/B,OAAO,CAAC,eAAe,EAAE,EAAE,aAAa,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;AACjE,CAAC"}