@lalternative/auth 0.4.0 → 0.4.2

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hooks/use-session.ts","../src/components/login-form.tsx","../src/components/social-buttons.tsx","../src/components/register-form.tsx","../src/components/verify-email-form.tsx","../src/components/forgot-password-form.tsx","../src/components/reset-password-form.tsx","../src/components/auth-layout.tsx","../src/components/invitation-notice.tsx"],"sourcesContent":["import type { PlatformAuthClient } from \"../client\"\n\n/**\n * Returns a useSession hook bound to the given auth client.\n * Usage: const { data: session, isPending } = useSession(authClient)\n */\nexport function useSession(authClient: PlatformAuthClient) {\n  return authClient.useSession()\n}\n\n/**\n * Returns a logout function bound to the given auth client.\n * Usage: const logout = useLogout(authClient)\n */\nexport function useLogout(authClient: PlatformAuthClient) {\n  const signOut = async () => {\n    await authClient.signOut()\n  }\n  return signOut\n}\n","import { useState, type FormEvent } from \"react\"\nimport type { LoginFormProps } from \"../types\"\nimport { SocialButtons } from \"./social-buttons\"\n\n// accountLinking is disabled in createPlatformAuth, so a social sign-in on an\n// address already registered with a password is refused with this code. Without\n// a message the button reads as broken rather than as a rejected account.\nfunction oauthErrorMessage(code: string): string {\n  switch (code) {\n    case \"account_not_linked\":\n      return \"This email is already registered with a password. Sign in with your password instead.\"\n    case \"access_denied\":\n      return \"Sign-in was cancelled.\"\n    default:\n      return \"Sign-in failed. Please try again.\"\n  }\n}\n\nexport function LoginForm({\n  onSuccess,\n  registerUrl = \"/register\",\n  forgotPasswordUrl = \"/forgot-password\",\n  socialCallbackUrl = \"/\",\n  socialProviders = [],\n  coreTokenUrl = \"/api/auth/core-token\",\n  authClient,\n}: LoginFormProps) {\n  const [email, setEmail] = useState(\"\")\n  const [password, setPassword] = useState(\"\")\n  const [error, setError] = useState<string | undefined>()\n  const [isPending, setIsPending] = useState(false)\n\n  const handleSubmit = async (e: FormEvent) => {\n    e.preventDefault()\n    if (!email.trim()) {\n      setError(\"Please enter your email address\")\n      return\n    }\n    if (!password) {\n      setError(\"Please enter your password\")\n      return\n    }\n    setError(undefined)\n    setIsPending(true)\n    try {\n      const res = await authClient.signIn.email({\n        email: email.trim(),\n        password,\n      })\n      if (res?.error) {\n        setError(res.error.message ?? \"Invalid email or password\")\n        return\n      }\n      // The better-auth session cookie alone does not authenticate the Go core:\n      // it verifies the EdDSA JWT minted here against the issuer's JWKS. Skipped\n      // when the app has no core to call.\n      if (coreTokenUrl) {\n        await fetch(coreTokenUrl, { credentials: \"include\" })\n      }\n      onSuccess?.()\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Invalid email or password\")\n    } finally {\n      setIsPending(false)\n    }\n  }\n\n  const handleSocial = async (provider: \"google\" | \"github\") => {\n    setError(undefined)\n    try {\n      await authClient.signIn.social({\n        provider,\n        callbackURL: socialCallbackUrl,\n      })\n    } catch (err) {\n      setError(\n        err instanceof Error ? oauthErrorMessage(err.message) : oauthErrorMessage(\"\"),\n      )\n    }\n  }\n\n  return (\n    <div className=\"space-y-8\">\n      <div>\n        <h1 className=\"text-2xl font-bold tracking-tight\">Sign in</h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          Welcome back. Enter your credentials to continue.\n        </p>\n      </div>\n\n      {error && (\n        <div className=\"rounded-lg border border-destructive/20 bg-destructive/10 px-3 py-2 text-xs text-destructive\">\n          {error}\n        </div>\n      )}\n\n      <form onSubmit={handleSubmit} className=\"space-y-4\" noValidate>\n        <input\n          type=\"email\"\n          value={email}\n          onChange={(e) => setEmail(e.target.value)}\n          placeholder=\"Email address\"\n          required\n          disabled={isPending}\n          autoComplete=\"email\"\n          className=\"flex h-11 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n        />\n\n        <div className=\"space-y-1\">\n          <input\n            type=\"password\"\n            value={password}\n            onChange={(e) => setPassword(e.target.value)}\n            placeholder=\"Password\"\n            required\n            disabled={isPending}\n            autoComplete=\"current-password\"\n            className=\"flex h-11 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n          />\n          <div className=\"text-right\">\n            <a\n              href={forgotPasswordUrl}\n              className=\"text-xs text-muted-foreground underline underline-offset-4 hover:text-foreground\"\n            >\n              Forgot your password?\n            </a>\n          </div>\n        </div>\n\n        <button\n          type=\"submit\"\n          disabled={isPending || !email.trim() || !password}\n          className=\"inline-flex h-11 w-full items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground transition-colors hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-50\"\n        >\n          {isPending ? \"Signing in...\" : \"Sign in\"}\n        </button>\n      </form>\n\n      <SocialButtons\n        providers={socialProviders}\n        onSelect={handleSocial}\n        disabled={isPending}\n      />\n\n      <p className=\"text-center text-sm text-muted-foreground\">\n        Don&apos;t have an account?{\" \"}\n        <a\n          href={registerUrl}\n          className=\"font-medium text-foreground underline underline-offset-4 hover:text-foreground/80\"\n        >\n          Sign up\n        </a>\n      </p>\n    </div>\n  )\n}\n","const LABELS: Record<string, string> = {\n  google: \"Continue with Google\",\n  github: \"Continue with GitHub\",\n}\n\ninterface SocialButtonsProps {\n  providers: Array<\"google\" | \"github\">\n  onSelect: (provider: \"google\" | \"github\") => void | Promise<void>\n  disabled?: boolean\n}\n\nexport function SocialButtons({\n  providers,\n  onSelect,\n  disabled = false,\n}: SocialButtonsProps) {\n  if (providers.length === 0) return null\n\n  return (\n    <div className=\"space-y-4\">\n      <div className=\"relative\">\n        <div className=\"absolute inset-0 flex items-center\">\n          <div className=\"w-full border-t border-input\" />\n        </div>\n        <div className=\"relative flex justify-center\">\n          <span className=\"bg-background px-2 text-xs uppercase tracking-wider text-muted-foreground\">\n            or\n          </span>\n        </div>\n      </div>\n\n      <div className=\"space-y-2\">\n        {providers.map((provider) => (\n          <button\n            key={provider}\n            type=\"button\"\n            onClick={() => onSelect(provider)}\n            disabled={disabled}\n            className=\"inline-flex h-11 w-full items-center justify-center rounded-md border border-input bg-background px-4 text-sm font-medium transition-colors hover:bg-accent hover:text-accent-foreground disabled:pointer-events-none disabled:opacity-50\"\n          >\n            {LABELS[provider] ?? provider}\n          </button>\n        ))}\n      </div>\n    </div>\n  )\n}\n","import { useState, type FormEvent } from \"react\"\nimport type { RegisterFormProps } from \"../types\"\nimport { SocialButtons } from \"./social-buttons\"\n\nconst MIN_PASSWORD_LENGTH = 8\n\nexport function RegisterForm({\n  onSuccess,\n  loginUrl = \"/login\",\n  legal,\n  socialCallbackUrl = \"/\",\n  socialProviders = [],\n  authClient,\n}: RegisterFormProps) {\n  const [name, setName] = useState(\"\")\n  const [email, setEmail] = useState(\"\")\n  const [password, setPassword] = useState(\"\")\n  const [error, setError] = useState<string | undefined>()\n  const [isPending, setIsPending] = useState(false)\n\n  const handleSubmit = async (e: FormEvent) => {\n    e.preventDefault()\n    if (!name.trim()) {\n      setError(\"Please enter your name\")\n      return\n    }\n    if (!email.trim()) {\n      setError(\"Please enter your email address\")\n      return\n    }\n    if (password.length < MIN_PASSWORD_LENGTH) {\n      setError(`Password must be at least ${MIN_PASSWORD_LENGTH} characters`)\n      return\n    }\n    setError(undefined)\n    setIsPending(true)\n    try {\n      const res = await authClient.signUp.email({\n        name: name.trim(),\n        email: email.trim(),\n        password,\n      })\n      if (res?.error) {\n        setError(res.error.message ?? \"Could not create your account\")\n        return\n      }\n      // createPlatformAuth sets requireEmailVerification, so sign-up leaves the\n      // account unverified and without a session: the caller routes to the OTP\n      // step rather than into the app.\n      onSuccess?.(email.trim())\n    } catch (err) {\n      setError(\n        err instanceof Error ? err.message : \"Could not create your account\",\n      )\n    } finally {\n      setIsPending(false)\n    }\n  }\n\n  const handleSocial = async (provider: \"google\" | \"github\") => {\n    setError(undefined)\n    try {\n      await authClient.signIn.social({\n        provider,\n        callbackURL: socialCallbackUrl,\n      })\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Sign-up failed\")\n    }\n  }\n\n  return (\n    <div className=\"space-y-8\">\n      <div>\n        <h1 className=\"text-2xl font-bold tracking-tight\">Create an account</h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          We&apos;ll send you a code to confirm your email address.\n        </p>\n      </div>\n\n      {error && (\n        <div className=\"rounded-lg border border-destructive/20 bg-destructive/10 px-3 py-2 text-xs text-destructive\">\n          {error}\n        </div>\n      )}\n\n      <form onSubmit={handleSubmit} className=\"space-y-4\" noValidate>\n        <input\n          type=\"text\"\n          value={name}\n          onChange={(e) => setName(e.target.value)}\n          placeholder=\"Full name\"\n          required\n          disabled={isPending}\n          autoComplete=\"name\"\n          className=\"flex h-11 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n        />\n\n        <input\n          type=\"email\"\n          value={email}\n          onChange={(e) => setEmail(e.target.value)}\n          placeholder=\"Email address\"\n          required\n          disabled={isPending}\n          autoComplete=\"email\"\n          className=\"flex h-11 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n        />\n\n        <div className=\"space-y-1\">\n          <input\n            type=\"password\"\n            value={password}\n            onChange={(e) => setPassword(e.target.value)}\n            placeholder=\"Password\"\n            required\n            disabled={isPending}\n            autoComplete=\"new-password\"\n            aria-describedby=\"register-password-hint\"\n            className=\"flex h-11 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n          />\n          <p id=\"register-password-hint\" className=\"text-xs text-muted-foreground\">\n            At least {MIN_PASSWORD_LENGTH} characters.\n          </p>\n        </div>\n\n        <button\n          type=\"submit\"\n          disabled={isPending}\n          className=\"inline-flex h-11 w-full items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground transition-colors hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-50\"\n        >\n          {isPending ? \"Creating account...\" : \"Create account\"}\n        </button>\n\n        {legal && (\n          <div className=\"text-center text-xs text-muted-foreground\">{legal}</div>\n        )}\n      </form>\n\n      <SocialButtons\n        providers={socialProviders}\n        onSelect={handleSocial}\n        disabled={isPending}\n      />\n\n      <p className=\"text-center text-sm text-muted-foreground\">\n        Already have an account?{\" \"}\n        <a\n          href={loginUrl}\n          className=\"font-medium text-foreground underline underline-offset-4 hover:text-foreground/80\"\n        >\n          Sign in\n        </a>\n      </p>\n    </div>\n  )\n}\n","import { useState, type FormEvent } from \"react\"\nimport type { VerifyEmailFormProps } from \"../types\"\n\nexport function VerifyEmailForm({\n  email,\n  onSuccess,\n  authClient,\n}: VerifyEmailFormProps) {\n  const [otp, setOtp] = useState(\"\")\n  const [isVerifying, setIsVerifying] = useState(false)\n  const [isResending, setIsResending] = useState(false)\n  const [resendMessage, setResendMessage] = useState<string | undefined>()\n  const [error, setError] = useState<string | undefined>()\n\n  const handleVerify = async (e: FormEvent) => {\n    e.preventDefault()\n    if (!otp.trim() || otp.length < 6) {\n      setError(\"Please enter the 6-digit code\")\n      return\n    }\n    setError(undefined)\n    setIsVerifying(true)\n    try {\n      const res = await authClient.emailOtp.verifyEmail({ email, otp })\n      console.log(\"[verify-email] response:\", JSON.stringify(res?.data), \"error:\", JSON.stringify(res?.error))\n      if (res?.error) {\n        setError(res.error.message ?? \"Invalid code. Please try again.\")\n        return\n      }\n      onSuccess?.()\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Invalid code. Please try again.\")\n    } finally {\n      setIsVerifying(false)\n    }\n  }\n\n  const handleResend = async () => {\n    if (!email) {\n      setError(\"Email address is not available. Please register again.\")\n      return\n    }\n    setError(undefined)\n    setResendMessage(undefined)\n    setIsResending(true)\n    try {\n      await authClient.emailOtp.sendVerificationOtp({\n        email,\n        type: \"email-verification\",\n      })\n      setResendMessage(\"A new code has been sent to your inbox.\")\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Failed to resend code.\")\n    } finally {\n      setIsResending(false)\n    }\n  }\n\n  return (\n    <div className=\"space-y-8\">\n      <div>\n        <h1 className=\"text-2xl font-bold tracking-tight\">\n          Verify your email\n        </h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          {email ? (\n            <>\n              Enter the 6-digit code sent to{\" \"}\n              <span className=\"font-medium text-foreground\">{email}</span>\n            </>\n          ) : (\n            \"Enter the 6-digit code sent to your email\"\n          )}\n        </p>\n      </div>\n\n      {error && (\n        <div className=\"rounded-lg border border-destructive/20 bg-destructive/10 px-3 py-2 text-xs text-destructive\">\n          {error}\n        </div>\n      )}\n\n      {resendMessage && (\n        <div className=\"rounded-lg border border-green-200 bg-green-50 px-3 py-2 text-xs text-green-700\">\n          {resendMessage}\n        </div>\n      )}\n\n      <form onSubmit={handleVerify} className=\"space-y-4\" noValidate>\n        <input\n          type=\"text\"\n          inputMode=\"numeric\"\n          pattern=\"[0-9]*\"\n          maxLength={6}\n          value={otp}\n          onChange={(e) => setOtp(e.target.value.replace(/\\D/g, \"\"))}\n          placeholder=\"000000\"\n          required\n          disabled={isVerifying}\n          autoComplete=\"one-time-code\"\n          className=\"flex h-12 w-full rounded-md border border-input bg-background px-3 py-2 text-center text-lg tracking-[0.4em] font-mono ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n        />\n\n        <button\n          type=\"submit\"\n          disabled={isVerifying || otp.length < 6}\n          className=\"inline-flex h-11 w-full items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground transition-colors hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-50\"\n        >\n          {isVerifying ? \"Verifying...\" : \"Verify email\"}\n        </button>\n\n        <button\n          type=\"button\"\n          onClick={handleResend}\n          disabled={isResending}\n          className=\"inline-flex h-11 w-full items-center justify-center rounded-md border border-input bg-background px-4 text-sm font-medium transition-colors hover:bg-accent hover:text-accent-foreground disabled:pointer-events-none disabled:opacity-50\"\n        >\n          {isResending ? \"Sending...\" : \"Resend code\"}\n        </button>\n      </form>\n\n      <p className=\"text-center text-sm text-muted-foreground\">\n        Already verified?{\" \"}\n        <a\n          href=\"/login\"\n          className=\"font-medium text-foreground underline underline-offset-4 hover:text-foreground/80\"\n        >\n          Sign in\n        </a>\n      </p>\n    </div>\n  )\n}\n","import { useState, type FormEvent } from \"react\"\nimport type { ForgotPasswordFormProps } from \"../types\"\n\nexport function ForgotPasswordForm({\n  onSuccess,\n  loginUrl = \"/login\",\n  authClient,\n}: ForgotPasswordFormProps) {\n  const [email, setEmail] = useState(\"\")\n  const [error, setError] = useState<string | undefined>()\n  const [isPending, setIsPending] = useState(false)\n\n  const handleSubmit = async (e: FormEvent) => {\n    e.preventDefault()\n    if (!email.trim()) {\n      setError(\"Please enter your email address\")\n      return\n    }\n    setError(undefined)\n    setIsPending(true)\n    try {\n      const res = await authClient.emailOtp.sendVerificationOtp({\n        email,\n        type: \"forget-password\",\n      })\n      if (res?.error) {\n        setError(res.error.message ?? \"Failed to send reset code\")\n        return\n      }\n      onSuccess?.(email)\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Failed to send reset code\")\n    } finally {\n      setIsPending(false)\n    }\n  }\n\n  return (\n    <div className=\"space-y-8\">\n      <div>\n        <h1 className=\"text-2xl font-bold tracking-tight\">\n          Forgot your password?\n        </h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          Enter your email address and we'll send you a code to reset your\n          password.\n        </p>\n      </div>\n\n      {error && (\n        <div className=\"rounded-lg border border-destructive/20 bg-destructive/10 px-3 py-2 text-xs text-destructive\">\n          {error}\n        </div>\n      )}\n\n      <form onSubmit={handleSubmit} className=\"space-y-4\" noValidate>\n        <input\n          type=\"email\"\n          value={email}\n          onChange={(e) => setEmail(e.target.value)}\n          placeholder=\"Email address\"\n          required\n          disabled={isPending}\n          autoComplete=\"email\"\n          className=\"flex h-11 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n        />\n\n        <button\n          type=\"submit\"\n          disabled={isPending || !email.trim()}\n          className=\"inline-flex h-11 w-full items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground transition-colors hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-50\"\n        >\n          {isPending ? \"Sending...\" : \"Send reset code\"}\n        </button>\n      </form>\n\n      <p className=\"text-center text-sm text-muted-foreground\">\n        Remember your password?{\" \"}\n        <a\n          href={loginUrl}\n          className=\"font-medium text-foreground underline underline-offset-4 hover:text-foreground/80\"\n        >\n          Sign in\n        </a>\n      </p>\n    </div>\n  )\n}\n","import { useState, type FormEvent } from \"react\"\nimport type { ResetPasswordFormProps } from \"../types\"\n\nexport function ResetPasswordForm({\n  email,\n  onSuccess,\n  loginUrl = \"/login\",\n  authClient,\n}: ResetPasswordFormProps) {\n  const [otp, setOtp] = useState(\"\")\n  const [password, setPassword] = useState(\"\")\n  const [confirmPassword, setConfirmPassword] = useState(\"\")\n  const [error, setError] = useState<string | undefined>()\n  const [isResetting, setIsResetting] = useState(false)\n  const [isResending, setIsResending] = useState(false)\n  const [resendMessage, setResendMessage] = useState<string | undefined>()\n\n  const handleSubmit = async (e: FormEvent) => {\n    e.preventDefault()\n    if (!otp.trim() || otp.length < 6) {\n      setError(\"Please enter the 6-digit code\")\n      return\n    }\n    if (password.length < 8) {\n      setError(\"Password must be at least 8 characters\")\n      return\n    }\n    if (password !== confirmPassword) {\n      setError(\"Passwords do not match\")\n      return\n    }\n    setError(undefined)\n    setIsResetting(true)\n    try {\n      const res = await fetch(\"/api/auth/email-otp/reset-password\", {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ email, otp, password }),\n      })\n      if (!res.ok) {\n        const body = await res.json().catch(() => null)\n        setError(body?.message ?? \"Failed to reset password\")\n        return\n      }\n      onSuccess?.()\n    } catch (err) {\n      setError(\n        err instanceof Error ? err.message : \"Failed to reset password\",\n      )\n    } finally {\n      setIsResetting(false)\n    }\n  }\n\n  const handleResend = async () => {\n    setError(undefined)\n    setResendMessage(undefined)\n    setIsResending(true)\n    try {\n      await authClient.emailOtp.sendVerificationOtp({\n        email,\n        type: \"forget-password\",\n      })\n      setResendMessage(\"A new code has been sent to your inbox.\")\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Failed to resend code.\")\n    } finally {\n      setIsResending(false)\n    }\n  }\n\n  return (\n    <div className=\"space-y-8\">\n      <div>\n        <h1 className=\"text-2xl font-bold tracking-tight\">\n          Reset your password\n        </h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          Enter the 6-digit code sent to{\" \"}\n          <span className=\"font-medium text-foreground\">{email}</span> and your\n          new password.\n        </p>\n      </div>\n\n      {error && (\n        <div className=\"rounded-lg border border-destructive/20 bg-destructive/10 px-3 py-2 text-xs text-destructive\">\n          {error}\n        </div>\n      )}\n\n      {resendMessage && (\n        <div className=\"rounded-lg border border-green-200 bg-green-50 px-3 py-2 text-xs text-green-700\">\n          {resendMessage}\n        </div>\n      )}\n\n      <form onSubmit={handleSubmit} className=\"space-y-4\" noValidate>\n        <input\n          type=\"text\"\n          inputMode=\"numeric\"\n          pattern=\"[0-9]*\"\n          maxLength={6}\n          value={otp}\n          onChange={(e) => setOtp(e.target.value.replace(/\\D/g, \"\"))}\n          placeholder=\"000000\"\n          required\n          disabled={isResetting}\n          autoComplete=\"one-time-code\"\n          className=\"flex h-12 w-full rounded-md border border-input bg-background px-3 py-2 text-center text-lg tracking-[0.4em] font-mono ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n        />\n\n        <input\n          type=\"password\"\n          value={password}\n          onChange={(e) => setPassword(e.target.value)}\n          placeholder=\"New password\"\n          required\n          disabled={isResetting}\n          autoComplete=\"new-password\"\n          className=\"flex h-11 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n        />\n\n        <input\n          type=\"password\"\n          value={confirmPassword}\n          onChange={(e) => setConfirmPassword(e.target.value)}\n          placeholder=\"Confirm new password\"\n          required\n          disabled={isResetting}\n          autoComplete=\"new-password\"\n          className=\"flex h-11 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-50 disabled:cursor-not-allowed\"\n        />\n\n        <button\n          type=\"submit\"\n          disabled={isResetting || otp.length < 6 || !password}\n          className=\"inline-flex h-11 w-full items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground transition-colors hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-50\"\n        >\n          {isResetting ? \"Resetting...\" : \"Reset password\"}\n        </button>\n\n        <button\n          type=\"button\"\n          onClick={handleResend}\n          disabled={isResending}\n          className=\"inline-flex h-11 w-full items-center justify-center rounded-md border border-input bg-background px-4 text-sm font-medium transition-colors hover:bg-accent hover:text-accent-foreground disabled:pointer-events-none disabled:opacity-50\"\n        >\n          {isResending ? \"Sending...\" : \"Resend code\"}\n        </button>\n      </form>\n\n      <p className=\"text-center text-sm text-muted-foreground\">\n        Remember your password?{\" \"}\n        <a\n          href={loginUrl}\n          className=\"font-medium text-foreground underline underline-offset-4 hover:text-foreground/80\"\n        >\n          Sign in\n        </a>\n      </p>\n    </div>\n  )\n}\n","import type { AuthLayoutProps } from \"../types\"\n\nexport function AuthLayout({\n  logo,\n  title,\n  subtitle,\n  children,\n  footer,\n}: AuthLayoutProps) {\n  return (\n    <div className=\"flex min-h-screen items-center justify-center bg-background\">\n      <div className=\"w-full max-w-md\">\n        <div className=\"mb-10 text-center\">\n          {logo && <div className=\"mb-6 flex justify-center\">{logo}</div>}\n          <h1 className=\"text-[32px] font-light tracking-tight\">{title}</h1>\n          {subtitle && (\n            <p className=\"mt-2 text-sm text-muted-foreground\">{subtitle}</p>\n          )}\n        </div>\n\n        <div className=\"rounded-xl border bg-card p-8 shadow-sm\">\n          {children}\n        </div>\n\n        {footer && (\n          <div className=\"mt-6 text-center text-xs text-muted-foreground\">\n            {footer}\n          </div>\n        )}\n      </div>\n    </div>\n  )\n}\n","import type { InvitationNoticeProps } from \"../types\"\n\n/**\n * Every app is reachable at contact@ its own apex domain, so the address is\n * derived rather than configured. Sub-domains are stripped because the app is\n * routinely served from app./admin. while the mailbox lives on the apex;\n * multi-part public suffixes (.co.uk) would need a real suffix list and no app\n * using this is on one.\n */\nfunction defaultSupportEmail(): string | undefined {\n  if (typeof window === \"undefined\") return undefined\n  const host = window.location.hostname\n  if (!host || host === \"localhost\" || /^[\\d.]+$/.test(host)) return undefined\n  const apex = host.split(\".\").slice(-2).join(\".\")\n  return `contact@${apex}`\n}\n\nconst REASON_MESSAGE: Record<string, string> = {\n  expired: \"Cette invitation a expiré.\",\n  claimed: \"Cette invitation a déjà été utilisée.\",\n  unknown: \"Ce lien d'invitation n'est pas valide.\",\n}\n\n/**\n * What an invitee sees when their link does not work.\n *\n * It names the reason instead of merging the cases into one message: \"expired\"\n * tells someone their link was real and that asking for another one is worth\n * it, which \"invalid\" does not. Short TTLs make that distinction routine.\n *\n * The only way forward offered is a mailto, deliberately. A self-service\n * \"request a new invitation\" form would mean a public endpoint accepting dead\n * tokens, a queue to moderate, and a way to probe which tokens once existed —\n * for a flow where the operator already knows the person by name.\n */\nexport function InvitationNotice({\n  reason = \"unknown\",\n  supportEmail,\n  title = \"Invitation indisponible\",\n  action,\n}: InvitationNoticeProps) {\n  const contact = supportEmail ?? defaultSupportEmail()\n\n  return (\n    <div className=\"space-y-8\">\n      <div>\n        <h1 className=\"text-2xl font-bold tracking-tight\">{title}</h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          {REASON_MESSAGE[reason] ?? REASON_MESSAGE.unknown}\n        </p>\n      </div>\n\n      {contact ? (\n        <p className=\"text-sm text-muted-foreground\">\n          Écrivez-nous à{\" \"}\n          <a\n            href={`mailto:${contact}`}\n            className=\"font-medium text-foreground underline underline-offset-4 hover:text-foreground/80\"\n          >\n            {contact}\n          </a>{\" \"}\n          pour en recevoir une nouvelle.\n        </p>\n      ) : null}\n\n      {action}\n    </div>\n  )\n}\n"],"mappings":";;;;;AAMO,SAAS,WAAW,YAAgC;AACzD,SAAO,WAAW,WAAW;AAC/B;AAMO,SAAS,UAAU,YAAgC;AACxD,QAAM,UAAU,YAAY;AAC1B,UAAM,WAAW,QAAQ;AAAA,EAC3B;AACA,SAAO;AACT;;;ACnBA,SAAS,gBAAgC;;;ACoBnC,SAEI,KAFJ;AApBN,IAAM,SAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,QAAQ;AACV;AAQO,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA,WAAW;AACb,GAAuB;AACrB,MAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,SACE,qBAAC,SAAI,WAAU,aACb;AAAA,yBAAC,SAAI,WAAU,YACb;AAAA,0BAAC,SAAI,WAAU,sCACb,8BAAC,SAAI,WAAU,gCAA+B,GAChD;AAAA,MACA,oBAAC,SAAI,WAAU,gCACb,8BAAC,UAAK,WAAU,6EAA4E,gBAE5F,GACF;AAAA,OACF;AAAA,IAEA,oBAAC,SAAI,WAAU,aACZ,oBAAU,IAAI,CAAC,aACd;AAAA,MAAC;AAAA;AAAA,QAEC,MAAK;AAAA,QACL,SAAS,MAAM,SAAS,QAAQ;AAAA,QAChC;AAAA,QACA,WAAU;AAAA,QAET,iBAAO,QAAQ,KAAK;AAAA;AAAA,MANhB;AAAA,IAOP,CACD,GACH;AAAA,KACF;AAEJ;;;ADqCM,SACE,OAAAA,MADF,QAAAC,aAAA;AA5EN,SAAS,kBAAkB,MAAsB;AAC/C,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEO,SAAS,UAAU;AAAA,EACxB;AAAA,EACA,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,kBAAkB,CAAC;AAAA,EACnB,eAAe;AAAA,EACf;AACF,GAAmB;AACjB,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,EAAE;AAC3C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAA6B;AACvD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAEhD,QAAM,eAAe,OAAO,MAAiB;AAC3C,MAAE,eAAe;AACjB,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB,eAAS,iCAAiC;AAC1C;AAAA,IACF;AACA,QAAI,CAAC,UAAU;AACb,eAAS,4BAA4B;AACrC;AAAA,IACF;AACA,aAAS,MAAS;AAClB,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,QACxC,OAAO,MAAM,KAAK;AAAA,QAClB;AAAA,MACF,CAAC;AACD,UAAI,KAAK,OAAO;AACd,iBAAS,IAAI,MAAM,WAAW,2BAA2B;AACzD;AAAA,MACF;AAIA,UAAI,cAAc;AAChB,cAAM,MAAM,cAAc,EAAE,aAAa,UAAU,CAAC;AAAA,MACtD;AACA,kBAAY;AAAA,IACd,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,IAAI,UAAU,2BAA2B;AAAA,IAC3E,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,eAAe,OAAO,aAAkC;AAC5D,aAAS,MAAS;AAClB,QAAI;AACF,YAAM,WAAW,OAAO,OAAO;AAAA,QAC7B;AAAA,QACA,aAAa;AAAA,MACf,CAAC;AAAA,IACH,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QAAQ,kBAAkB,IAAI,OAAO,IAAI,kBAAkB,EAAE;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AAEA,SACE,gBAAAA,MAAC,SAAI,WAAU,aACb;AAAA,oBAAAA,MAAC,SACC;AAAA,sBAAAD,KAAC,QAAG,WAAU,qCAAoC,qBAAO;AAAA,MACzD,gBAAAA,KAAC,OAAE,WAAU,sCAAqC,+DAElD;AAAA,OACF;AAAA,IAEC,SACC,gBAAAA,KAAC,SAAI,WAAU,gGACZ,iBACH;AAAA,IAGF,gBAAAC,MAAC,UAAK,UAAU,cAAc,WAAU,aAAY,YAAU,MAC5D;AAAA,sBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,UACxC,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,UAAU;AAAA,UACV,cAAa;AAAA,UACb,WAAU;AAAA;AAAA,MACZ;AAAA,MAEA,gBAAAC,MAAC,SAAI,WAAU,aACb;AAAA,wBAAAD;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,OAAO;AAAA,YACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAC3C,aAAY;AAAA,YACZ,UAAQ;AAAA,YACR,UAAU;AAAA,YACV,cAAa;AAAA,YACb,WAAU;AAAA;AAAA,QACZ;AAAA,QACA,gBAAAA,KAAC,SAAI,WAAU,cACb,0BAAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,WAAU;AAAA,YACX;AAAA;AAAA,QAED,GACF;AAAA,SACF;AAAA,MAEA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,UAAU,aAAa,CAAC,MAAM,KAAK,KAAK,CAAC;AAAA,UACzC,WAAU;AAAA,UAET,sBAAY,kBAAkB;AAAA;AAAA,MACjC;AAAA,OACF;AAAA,IAEA,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAW;AAAA,QACX,UAAU;AAAA,QACV,UAAU;AAAA;AAAA,IACZ;AAAA,IAEA,gBAAAC,MAAC,OAAE,WAAU,6CAA4C;AAAA;AAAA,MAC3B;AAAA,MAC5B,gBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAM;AAAA,UACN,WAAU;AAAA,UACX;AAAA;AAAA,MAED;AAAA,OACF;AAAA,KACF;AAEJ;;;AE3JA,SAAS,YAAAE,iBAAgC;AAyEnC,SACE,OAAAC,MADF,QAAAC,aAAA;AArEN,IAAM,sBAAsB;AAErB,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA,oBAAoB;AAAA,EACpB,kBAAkB,CAAC;AAAA,EACnB;AACF,GAAsB;AACpB,QAAM,CAAC,MAAM,OAAO,IAAIC,UAAS,EAAE;AACnC,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAIA,UAAS,EAAE;AAC3C,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAA6B;AACvD,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAS,KAAK;AAEhD,QAAM,eAAe,OAAO,MAAiB;AAC3C,MAAE,eAAe;AACjB,QAAI,CAAC,KAAK,KAAK,GAAG;AAChB,eAAS,wBAAwB;AACjC;AAAA,IACF;AACA,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB,eAAS,iCAAiC;AAC1C;AAAA,IACF;AACA,QAAI,SAAS,SAAS,qBAAqB;AACzC,eAAS,6BAA6B,mBAAmB,aAAa;AACtE;AAAA,IACF;AACA,aAAS,MAAS;AAClB,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,QACxC,MAAM,KAAK,KAAK;AAAA,QAChB,OAAO,MAAM,KAAK;AAAA,QAClB;AAAA,MACF,CAAC;AACD,UAAI,KAAK,OAAO;AACd,iBAAS,IAAI,MAAM,WAAW,+BAA+B;AAC7D;AAAA,MACF;AAIA,kBAAY,MAAM,KAAK,CAAC;AAAA,IAC1B,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QAAQ,IAAI,UAAU;AAAA,MACvC;AAAA,IACF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,eAAe,OAAO,aAAkC;AAC5D,aAAS,MAAS;AAClB,QAAI;AACF,YAAM,WAAW,OAAO,OAAO;AAAA,QAC7B;AAAA,QACA,aAAa;AAAA,MACf,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,IAAI,UAAU,gBAAgB;AAAA,IAChE;AAAA,EACF;AAEA,SACE,gBAAAD,MAAC,SAAI,WAAU,aACb;AAAA,oBAAAA,MAAC,SACC;AAAA,sBAAAD,KAAC,QAAG,WAAU,qCAAoC,+BAAiB;AAAA,MACnE,gBAAAA,KAAC,OAAE,WAAU,sCAAqC,kEAElD;AAAA,OACF;AAAA,IAEC,SACC,gBAAAA,KAAC,SAAI,WAAU,gGACZ,iBACH;AAAA,IAGF,gBAAAC,MAAC,UAAK,UAAU,cAAc,WAAU,aAAY,YAAU,MAC5D;AAAA,sBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK;AAAA,UACvC,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,UAAU;AAAA,UACV,cAAa;AAAA,UACb,WAAU;AAAA;AAAA,MACZ;AAAA,MAEA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,UACxC,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,UAAU;AAAA,UACV,cAAa;AAAA,UACb,WAAU;AAAA;AAAA,MACZ;AAAA,MAEA,gBAAAC,MAAC,SAAI,WAAU,aACb;AAAA,wBAAAD;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,OAAO;AAAA,YACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAC3C,aAAY;AAAA,YACZ,UAAQ;AAAA,YACR,UAAU;AAAA,YACV,cAAa;AAAA,YACb,oBAAiB;AAAA,YACjB,WAAU;AAAA;AAAA,QACZ;AAAA,QACA,gBAAAC,MAAC,OAAE,IAAG,0BAAyB,WAAU,iCAAgC;AAAA;AAAA,UAC7D;AAAA,UAAoB;AAAA,WAChC;AAAA,SACF;AAAA,MAEA,gBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,UAAU;AAAA,UACV,WAAU;AAAA,UAET,sBAAY,wBAAwB;AAAA;AAAA,MACvC;AAAA,MAEC,SACC,gBAAAA,KAAC,SAAI,WAAU,6CAA6C,iBAAM;AAAA,OAEtE;AAAA,IAEA,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAW;AAAA,QACX,UAAU;AAAA,QACV,UAAU;AAAA;AAAA,IACZ;AAAA,IAEA,gBAAAC,MAAC,OAAE,WAAU,6CAA4C;AAAA;AAAA,MAC9B;AAAA,MACzB,gBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAM;AAAA,UACN,WAAU;AAAA,UACX;AAAA;AAAA,MAED;AAAA,OACF;AAAA,KACF;AAEJ;;;AC5JA,SAAS,YAAAG,iBAAgC;AA6DjC,SAKI,UALJ,OAAAC,MAKI,QAAAC,aALJ;AA1DD,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AACF,GAAyB;AACvB,QAAM,CAAC,KAAK,MAAM,IAAIF,UAAS,EAAE;AACjC,QAAM,CAAC,aAAa,cAAc,IAAIA,UAAS,KAAK;AACpD,QAAM,CAAC,aAAa,cAAc,IAAIA,UAAS,KAAK;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAA6B;AACvE,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAA6B;AAEvD,QAAM,eAAe,OAAO,MAAiB;AAC3C,MAAE,eAAe;AACjB,QAAI,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,GAAG;AACjC,eAAS,+BAA+B;AACxC;AAAA,IACF;AACA,aAAS,MAAS;AAClB,mBAAe,IAAI;AACnB,QAAI;AACF,YAAM,MAAM,MAAM,WAAW,SAAS,YAAY,EAAE,OAAO,IAAI,CAAC;AAChE,cAAQ,IAAI,4BAA4B,KAAK,UAAU,KAAK,IAAI,GAAG,UAAU,KAAK,UAAU,KAAK,KAAK,CAAC;AACvG,UAAI,KAAK,OAAO;AACd,iBAAS,IAAI,MAAM,WAAW,iCAAiC;AAC/D;AAAA,MACF;AACA,kBAAY;AAAA,IACd,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,IAAI,UAAU,iCAAiC;AAAA,IACjF,UAAE;AACA,qBAAe,KAAK;AAAA,IACtB;AAAA,EACF;AAEA,QAAM,eAAe,YAAY;AAC/B,QAAI,CAAC,OAAO;AACV,eAAS,wDAAwD;AACjE;AAAA,IACF;AACA,aAAS,MAAS;AAClB,qBAAiB,MAAS;AAC1B,mBAAe,IAAI;AACnB,QAAI;AACF,YAAM,WAAW,SAAS,oBAAoB;AAAA,QAC5C;AAAA,QACA,MAAM;AAAA,MACR,CAAC;AACD,uBAAiB,yCAAyC;AAAA,IAC5D,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,IAAI,UAAU,wBAAwB;AAAA,IACxE,UAAE;AACA,qBAAe,KAAK;AAAA,IACtB;AAAA,EACF;AAEA,SACE,gBAAAE,MAAC,SAAI,WAAU,aACb;AAAA,oBAAAA,MAAC,SACC;AAAA,sBAAAD,KAAC,QAAG,WAAU,qCAAoC,+BAElD;AAAA,MACA,gBAAAA,KAAC,OAAE,WAAU,sCACV,kBACC,gBAAAC,MAAA,YAAE;AAAA;AAAA,QAC+B;AAAA,QAC/B,gBAAAD,KAAC,UAAK,WAAU,+BAA+B,iBAAM;AAAA,SACvD,IAEA,6CAEJ;AAAA,OACF;AAAA,IAEC,SACC,gBAAAA,KAAC,SAAI,WAAU,gGACZ,iBACH;AAAA,IAGD,iBACC,gBAAAA,KAAC,SAAI,WAAU,mFACZ,yBACH;AAAA,IAGF,gBAAAC,MAAC,UAAK,UAAU,cAAc,WAAU,aAAY,YAAU,MAC5D;AAAA,sBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAQ;AAAA,UACR,WAAW;AAAA,UACX,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,OAAO,EAAE,OAAO,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,UACzD,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,UAAU;AAAA,UACV,cAAa;AAAA,UACb,WAAU;AAAA;AAAA,MACZ;AAAA,MAEA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,UAAU,eAAe,IAAI,SAAS;AAAA,UACtC,WAAU;AAAA,UAET,wBAAc,iBAAiB;AAAA;AAAA,MAClC;AAAA,MAEA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAS;AAAA,UACT,UAAU;AAAA,UACV,WAAU;AAAA,UAET,wBAAc,eAAe;AAAA;AAAA,MAChC;AAAA,OACF;AAAA,IAEA,gBAAAC,MAAC,OAAE,WAAU,6CAA4C;AAAA;AAAA,MACrC;AAAA,MAClB,gBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,WAAU;AAAA,UACX;AAAA;AAAA,MAED;AAAA,OACF;AAAA,KACF;AAEJ;;;ACpIA,SAAS,YAAAE,iBAAgC;AAuCnC,SACE,OAAAC,MADF,QAAAC,aAAA;AApCC,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,WAAW;AAAA,EACX;AACF,GAA4B;AAC1B,QAAM,CAAC,OAAO,QAAQ,IAAIF,UAAS,EAAE;AACrC,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAA6B;AACvD,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAS,KAAK;AAEhD,QAAM,eAAe,OAAO,MAAiB;AAC3C,MAAE,eAAe;AACjB,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB,eAAS,iCAAiC;AAC1C;AAAA,IACF;AACA,aAAS,MAAS;AAClB,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,MAAM,MAAM,WAAW,SAAS,oBAAoB;AAAA,QACxD;AAAA,QACA,MAAM;AAAA,MACR,CAAC;AACD,UAAI,KAAK,OAAO;AACd,iBAAS,IAAI,MAAM,WAAW,2BAA2B;AACzD;AAAA,MACF;AACA,kBAAY,KAAK;AAAA,IACnB,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,IAAI,UAAU,2BAA2B;AAAA,IAC3E,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SACE,gBAAAE,MAAC,SAAI,WAAU,aACb;AAAA,oBAAAA,MAAC,SACC;AAAA,sBAAAD,KAAC,QAAG,WAAU,qCAAoC,mCAElD;AAAA,MACA,gBAAAA,KAAC,OAAE,WAAU,sCAAqC,wFAGlD;AAAA,OACF;AAAA,IAEC,SACC,gBAAAA,KAAC,SAAI,WAAU,gGACZ,iBACH;AAAA,IAGF,gBAAAC,MAAC,UAAK,UAAU,cAAc,WAAU,aAAY,YAAU,MAC5D;AAAA,sBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,UACxC,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,UAAU;AAAA,UACV,cAAa;AAAA,UACb,WAAU;AAAA;AAAA,MACZ;AAAA,MAEA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,UAAU,aAAa,CAAC,MAAM,KAAK;AAAA,UACnC,WAAU;AAAA,UAET,sBAAY,eAAe;AAAA;AAAA,MAC9B;AAAA,OACF;AAAA,IAEA,gBAAAC,MAAC,OAAE,WAAU,6CAA4C;AAAA;AAAA,MAC/B;AAAA,MACxB,gBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAM;AAAA,UACN,WAAU;AAAA,UACX;AAAA;AAAA,MAED;AAAA,OACF;AAAA,KACF;AAEJ;;;ACvFA,SAAS,YAAAE,iBAAgC;AA0EjC,gBAAAC,MAGA,QAAAC,aAHA;AAvED,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AACF,GAA2B;AACzB,QAAM,CAAC,KAAK,MAAM,IAAIF,UAAS,EAAE;AACjC,QAAM,CAAC,UAAU,WAAW,IAAIA,UAAS,EAAE;AAC3C,QAAM,CAAC,iBAAiB,kBAAkB,IAAIA,UAAS,EAAE;AACzD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAA6B;AACvD,QAAM,CAAC,aAAa,cAAc,IAAIA,UAAS,KAAK;AACpD,QAAM,CAAC,aAAa,cAAc,IAAIA,UAAS,KAAK;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAA6B;AAEvE,QAAM,eAAe,OAAO,MAAiB;AAC3C,MAAE,eAAe;AACjB,QAAI,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,GAAG;AACjC,eAAS,+BAA+B;AACxC;AAAA,IACF;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,eAAS,wCAAwC;AACjD;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,wBAAwB;AACjC;AAAA,IACF;AACA,aAAS,MAAS;AAClB,mBAAe,IAAI;AACnB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,sCAAsC;AAAA,QAC5D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,SAAS,CAAC;AAAA,MAC/C,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,iBAAS,MAAM,WAAW,0BAA0B;AACpD;AAAA,MACF;AACA,kBAAY;AAAA,IACd,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QAAQ,IAAI,UAAU;AAAA,MACvC;AAAA,IACF,UAAE;AACA,qBAAe,KAAK;AAAA,IACtB;AAAA,EACF;AAEA,QAAM,eAAe,YAAY;AAC/B,aAAS,MAAS;AAClB,qBAAiB,MAAS;AAC1B,mBAAe,IAAI;AACnB,QAAI;AACF,YAAM,WAAW,SAAS,oBAAoB;AAAA,QAC5C;AAAA,QACA,MAAM;AAAA,MACR,CAAC;AACD,uBAAiB,yCAAyC;AAAA,IAC5D,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,IAAI,UAAU,wBAAwB;AAAA,IACxE,UAAE;AACA,qBAAe,KAAK;AAAA,IACtB;AAAA,EACF;AAEA,SACE,gBAAAE,MAAC,SAAI,WAAU,aACb;AAAA,oBAAAA,MAAC,SACC;AAAA,sBAAAD,KAAC,QAAG,WAAU,qCAAoC,iCAElD;AAAA,MACA,gBAAAC,MAAC,OAAE,WAAU,sCAAqC;AAAA;AAAA,QACjB;AAAA,QAC/B,gBAAAD,KAAC,UAAK,WAAU,+BAA+B,iBAAM;AAAA,QAAO;AAAA,SAE9D;AAAA,OACF;AAAA,IAEC,SACC,gBAAAA,KAAC,SAAI,WAAU,gGACZ,iBACH;AAAA,IAGD,iBACC,gBAAAA,KAAC,SAAI,WAAU,mFACZ,yBACH;AAAA,IAGF,gBAAAC,MAAC,UAAK,UAAU,cAAc,WAAU,aAAY,YAAU,MAC5D;AAAA,sBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAQ;AAAA,UACR,WAAW;AAAA,UACX,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,OAAO,EAAE,OAAO,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,UACzD,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,UAAU;AAAA,UACV,cAAa;AAAA,UACb,WAAU;AAAA;AAAA,MACZ;AAAA,MAEA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,UAC3C,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,UAAU;AAAA,UACV,cAAa;AAAA,UACb,WAAU;AAAA;AAAA,MACZ;AAAA,MAEA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,KAAK;AAAA,UAClD,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,UAAU;AAAA,UACV,cAAa;AAAA,UACb,WAAU;AAAA;AAAA,MACZ;AAAA,MAEA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,UAAU,eAAe,IAAI,SAAS,KAAK,CAAC;AAAA,UAC5C,WAAU;AAAA,UAET,wBAAc,iBAAiB;AAAA;AAAA,MAClC;AAAA,MAEA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAS;AAAA,UACT,UAAU;AAAA,UACV,WAAU;AAAA,UAET,wBAAc,eAAe;AAAA;AAAA,MAChC;AAAA,OACF;AAAA,IAEA,gBAAAC,MAAC,OAAE,WAAU,6CAA4C;AAAA;AAAA,MAC/B;AAAA,MACxB,gBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAM;AAAA,UACN,WAAU;AAAA,UACX;AAAA;AAAA,MAED;AAAA,OACF;AAAA,KACF;AAEJ;;;ACtJQ,SACW,OAAAE,MADX,QAAAC,aAAA;AAVD,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAoB;AAClB,SACE,gBAAAD,KAAC,SAAI,WAAU,+DACb,0BAAAC,MAAC,SAAI,WAAU,mBACb;AAAA,oBAAAA,MAAC,SAAI,WAAU,qBACZ;AAAA,cAAQ,gBAAAD,KAAC,SAAI,WAAU,4BAA4B,gBAAK;AAAA,MACzD,gBAAAA,KAAC,QAAG,WAAU,yCAAyC,iBAAM;AAAA,MAC5D,YACC,gBAAAA,KAAC,OAAE,WAAU,sCAAsC,oBAAS;AAAA,OAEhE;AAAA,IAEA,gBAAAA,KAAC,SAAI,WAAU,2CACZ,UACH;AAAA,IAEC,UACC,gBAAAA,KAAC,SAAI,WAAU,kDACZ,kBACH;AAAA,KAEJ,GACF;AAEJ;;;ACaM,SACE,OAAAE,MADF,QAAAC,aAAA;AApCN,SAAS,sBAA0C;AACjD,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,OAAO,OAAO,SAAS;AAC7B,MAAI,CAAC,QAAQ,SAAS,eAAe,WAAW,KAAK,IAAI,EAAG,QAAO;AACnE,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,GAAG;AAC/C,SAAO,WAAW,IAAI;AACxB;AAEA,IAAM,iBAAyC;AAAA,EAC7C,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AACX;AAcO,SAAS,iBAAiB;AAAA,EAC/B,SAAS;AAAA,EACT;AAAA,EACA,QAAQ;AAAA,EACR;AACF,GAA0B;AACxB,QAAM,UAAU,gBAAgB,oBAAoB;AAEpD,SACE,gBAAAA,MAAC,SAAI,WAAU,aACb;AAAA,oBAAAA,MAAC,SACC;AAAA,sBAAAD,KAAC,QAAG,WAAU,qCAAqC,iBAAM;AAAA,MACzD,gBAAAA,KAAC,OAAE,WAAU,sCACV,yBAAe,MAAM,KAAK,eAAe,SAC5C;AAAA,OACF;AAAA,IAEC,UACC,gBAAAC,MAAC,OAAE,WAAU,iCAAgC;AAAA;AAAA,MAC5B;AAAA,MACf,gBAAAD;AAAA,QAAC;AAAA;AAAA,UACC,MAAM,UAAU,OAAO;AAAA,UACvB,WAAU;AAAA,UAET;AAAA;AAAA,MACH;AAAA,MAAK;AAAA,MAAI;AAAA,OAEX,IACE;AAAA,IAEH;AAAA,KACH;AAEJ;","names":["jsx","jsxs","useState","jsx","jsxs","useState","useState","jsx","jsxs","useState","jsx","jsxs","useState","jsx","jsxs","jsx","jsxs","jsx","jsxs"]}

package/dist/invitation-CzfLna7q.d.ts

@@ -0,0 +1,82 @@
+import { b as InvitationFailure } from './types-DxllDyOa.js';
+
+/**
+ * What became of a claim, in terms the invitee can be told.
+ *
+ * 'expired' and 'claimed' are kept apart from 'unknown' because only they say
+ * the offer was real, which is what tells someone that asking for a new link is
+ * worth it rather than doubting the address they were invited at. The three
+ * failures match InvitationFailure, so an outcome feeds InvitationNotice
+ * directly.
+ */
+type ClaimOutcome = "granted" | InvitationFailure | "failed";
+interface ClaimInvitationOptions {
+    /** Absolute URL of the endpoint that redeems a token. */
+    endpoint: string;
+    token: string;
+    /** The account the app just created, which the grant is attached to. */
+    externalUserId: string;
+    /** Sent as the Authorization bearer — typically the app's API key. */
+    apiKey?: string;
+    /** Merged into the request body, for backends wanting more than the token. */
+    extra?: Record<string, unknown>;
+    /** Headers merged last, so a caller can pass a cookie-based credential. */
+    headers?: Record<string, string>;
+    /** Bounds the call so a slow API never stalls the sign-in response. */
+    timeoutMs?: number;
+}
+/**
+ * Redeems an invitation token for a user who has just signed in, turning the
+ * offer into a grant on their account.
+ *
+ * Why this belongs on the SERVER, on the auth callback rather than in the page:
+ * the invitation link lands on /register?invite=<token>, but the sign-up that
+ * follows can complete through any of three flows (password + OTP, OAuth
+ * redirect, email verification), and only two of them return to the page that
+ * held the token. Claiming where the session is established covers every flow
+ * with one code path.
+ *
+ * Best-effort by design: a sign-in must never fail because an invitation could
+ * not be redeemed. A failed claim leaves the invitation unclaimed and the user
+ * on their default tier — recoverable by following the link again, since a
+ * refused claim consumes nothing.
+ */
+declare function claimInvitation({ endpoint, token, externalUserId, apiKey, extra, headers, timeoutMs, }: ClaimInvitationOptions): Promise<ClaimOutcome>;
+/**
+ * Extracts the invitation token from an auth request.
+ *
+ * The token lives on the page the invitee landed on (/register?invite=…), never
+ * on the auth endpoints themselves, so it has to be recovered from the request
+ * that completes the sign-up. Two sources, because no single one covers every
+ * flow: the URL, for the OAuth callback reached through a redirect whose query
+ * string the app controls; and the Referer, for the password and OTP flows,
+ * which are XHR calls issued BY that page and therefore carry it.
+ *
+ * Reading it per-request keeps the claim stateless: nothing associates a
+ * browser with a pending invitation, and a request with no token claims
+ * nothing. A malformed Referer is ignored rather than thrown on — it is
+ * attacker-controlled input on a best-effort path.
+ */
+declare function inviteTokenFrom(request: Request, param?: string): string | null;
+/**
+ * Whether this request is the one that just created a usable account — the
+ * moment to provision, claim an invitation, or greet someone. Matching on the
+ * path rather than on a response body keeps it flow-agnostic: the three
+ * sign-up flows return three different shapes.
+ */
+declare function completesSignup(pathname: string): boolean;
+/**
+ * Carries a failed claim to the next page. The claim happens inside an auth
+ * response nobody renders, so its result would otherwise reach only the server
+ * log — leaving an invitee on the default tier with no idea their link had
+ * lapsed. Short-lived and readable by the page, which reports it and clears it.
+ */
+declare function invitationOutcomeCookie(outcome: ClaimOutcome, name?: string): string;
+/**
+ * Whether an outcome is one the invitee should be shown a reason for.
+ * 'failed' is excluded: it means the call did not complete, so the offer may
+ * still be good and telling someone their invitation is invalid would be wrong.
+ */
+declare function isInvitationFailure(outcome: ClaimOutcome): outcome is InvitationFailure;
+
+export { type ClaimOutcome as C, type ClaimInvitationOptions as a, completesSignup as b, claimInvitation as c, invitationOutcomeCookie as d, inviteTokenFrom as e, isInvitationFailure as i };

package/dist/server.d.ts

@@ -0,0 +1,13 @@
+import { Auth, BetterAuthOptions } from 'better-auth';
+import { c as PlatformAuthConfig } from './types-DxllDyOa.js';
+export { g as PlatformSession, h as PlatformSessionData, i as PlatformUser } from './types-DxllDyOa.js';
+export { a as ClaimInvitationOptions, C as ClaimOutcome, c as claimInvitation, b as completesSignup, d as invitationOutcomeCookie, e as inviteTokenFrom, i as isInvitationFailure } from './invitation-CzfLna7q.js';
+
+/**
+ * Creates a Better Auth instance with platform defaults.
+ * Each app calls this with its own config (DB, secret, providers, plugins).
+ */
+declare function createPlatformAuth(config: PlatformAuthConfig): Auth<BetterAuthOptions>;
+type PlatformAuth = ReturnType<typeof createPlatformAuth>;
+
+export { type PlatformAuth, createPlatformAuth };

package/dist/server.js

@@ -0,0 +1,132 @@
+import {
+  claimInvitation,
+  completesSignup,
+  invitationOutcomeCookie,
+  inviteTokenFrom,
+  isInvitationFailure
+} from "./chunk-73BHM4PZ.js";
+
+// src/server.ts
+import { betterAuth, APIError } from "better-auth";
+import { emailOTP, admin } from "better-auth/plugins";
+var DEFAULT_EMAIL_SUBJECTS = {
+  "email-verification": "Verify your account",
+  "forget-password": "Reset your password",
+  "sign-in": "Your sign-in code"
+};
+function defaultRenderOtpEmail(otp) {
+  return `
+              <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px">
+                <h2 style="font-size:20px;font-weight:600;margin-bottom:16px">Your verification code</h2>
+                <p style="color:#555;margin-bottom:24px">Use the code below to continue. It expires in 5 minutes.</p>
+                <div style="background:#f5f5f5;border-radius:8px;padding:24px;text-align:center;letter-spacing:8px;font-size:32px;font-weight:700">
+                  ${otp}
+                </div>
+                <p style="color:#999;font-size:12px;margin-top:24px">If you didn't request this, you can safely ignore this email.</p>
+              </div>
+            `;
+}
+function createPlatformAuth(config) {
+  const {
+    database,
+    baseURL,
+    secret,
+    appName,
+    mailer,
+    google,
+    github,
+    plugins = [],
+    betaMode = false,
+    isInvited,
+    emailSubjects,
+    renderOtpEmail
+  } = config;
+  const subjects = { ...DEFAULT_EMAIL_SUBJECTS, ...emailSubjects };
+  const renderEmail = renderOtpEmail ?? defaultRenderOtpEmail;
+  return betterAuth({
+    database,
+    baseURL,
+    secret,
+    emailAndPassword: {
+      enabled: true,
+      requireEmailVerification: true
+    },
+    // Never auto-merge a social identity into an existing account by matching
+    // email. Better Auth links by default (email-verified providers are trusted),
+    // so signing in with Google/GitHub on an email already registered would fold
+    // that identity into the existing account. We keep each sign-in method its
+    // own account: a social login on a taken email is refused, not linked.
+    account: {
+      accountLinking: {
+        enabled: false
+      }
+    },
+    hooks: {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      before: async (ctx) => {
+        if (!betaMode) return;
+        if (ctx.path !== "/sign-up/email") return;
+        const body = ctx.body;
+        const email = body?.email;
+        const inviteToken = body?.inviteToken;
+        if (email && inviteToken && isInvited) {
+          const ok = await isInvited(email, inviteToken);
+          if (ok) return;
+        }
+        throw new APIError("FORBIDDEN", {
+          message: "Registration is invite-only during the private beta."
+        });
+      }
+    },
+    plugins: [
+      emailOTP({
+        async sendVerificationOTP({ email, otp, type }) {
+          const subject = subjects[type] ? `${subjects[type]} - ${appName}` : `Your ${appName} code`;
+          const html = renderEmail(otp, type);
+          if (mailer) {
+            await mailer({
+              to: email,
+              subject,
+              html,
+              type,
+              otp
+            });
+            return;
+          }
+          console.warn(
+            `[EMAIL] No mailer configured \u2014 logging OTP to stdout for ${email} (${type}): ${otp}`
+          );
+        },
+        otpLength: 6,
+        expiresIn: 300,
+        overrideDefaultEmailVerification: true
+      }),
+      admin(),
+      ...plugins
+      // app-specific plugins (e.g. tanstackStartCookies)
+    ],
+    socialProviders: {
+      ...google ? {
+        google: {
+          clientId: google.clientId,
+          clientSecret: google.clientSecret
+        }
+      } : {},
+      ...github ? {
+        github: {
+          clientId: github.clientId,
+          clientSecret: github.clientSecret
+        }
+      } : {}
+    }
+  });
+}
+export {
+  claimInvitation,
+  completesSignup,
+  createPlatformAuth,
+  invitationOutcomeCookie,
+  inviteTokenFrom,
+  isInvitationFailure
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { betterAuth, APIError, type Auth, type BetterAuthOptions } from \"better-auth\"\nimport { emailOTP, admin } from \"better-auth/plugins\"\nimport type { PlatformAuthConfig, PlatformAuthMailerType } from \"./types\"\n\nconst DEFAULT_EMAIL_SUBJECTS: Record<string, string> = {\n  \"email-verification\": \"Verify your account\",\n  \"forget-password\": \"Reset your password\",\n  \"sign-in\": \"Your sign-in code\",\n}\n\nfunction defaultRenderOtpEmail(otp: string): string {\n  return `\n              <div style=\"font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px\">\n                <h2 style=\"font-size:20px;font-weight:600;margin-bottom:16px\">Your verification code</h2>\n                <p style=\"color:#555;margin-bottom:24px\">Use the code below to continue. It expires in 5 minutes.</p>\n                <div style=\"background:#f5f5f5;border-radius:8px;padding:24px;text-align:center;letter-spacing:8px;font-size:32px;font-weight:700\">\n                  ${otp}\n                </div>\n                <p style=\"color:#999;font-size:12px;margin-top:24px\">If you didn't request this, you can safely ignore this email.</p>\n              </div>\n            `\n}\n\n/**\n * Creates a Better Auth instance with platform defaults.\n * Each app calls this with its own config (DB, secret, providers, plugins).\n */\nexport function createPlatformAuth(\n  config: PlatformAuthConfig,\n): Auth<BetterAuthOptions> {\n  const {\n    database,\n    baseURL,\n    secret,\n    appName,\n    mailer,\n    google,\n    github,\n    plugins = [],\n    betaMode = false,\n    isInvited,\n    emailSubjects,\n    renderOtpEmail,\n  } = config\n\n  const subjects = { ...DEFAULT_EMAIL_SUBJECTS, ...emailSubjects }\n  const renderEmail = renderOtpEmail ?? defaultRenderOtpEmail\n\n  // The concrete instance type (with email-otp/admin plugins) is widened to\n  // the base Auth type so the published .d.ts stays portable (inferring the\n  // full plugin type triggers TS2742 — it can't be named without a zod ref).\n  // The admin() plugin's user.role field is re-exposed via module augmentation\n  // below, so consumers (e.g. transcript-web me.ts) still see session.user.role.\n  return betterAuth({\n    database,\n    baseURL,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      requireEmailVerification: true,\n    },\n    // Never auto-merge a social identity into an existing account by matching\n    // email. Better Auth links by default (email-verified providers are trusted),\n    // so signing in with Google/GitHub on an email already registered would fold\n    // that identity into the existing account. We keep each sign-in method its\n    // own account: a social login on a taken email is refused, not linked.\n    account: {\n      accountLinking: {\n        enabled: false,\n      },\n    },\n    hooks: {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      before: async (ctx: any) => {\n        if (!betaMode) return\n        if (ctx.path !== \"/sign-up/email\") return\n        const body = ctx.body as { email?: string; inviteToken?: string } | undefined\n        const email = body?.email\n        const inviteToken = body?.inviteToken\n        if (email && inviteToken && isInvited) {\n          const ok = await isInvited(email, inviteToken)\n          if (ok) return\n        }\n        throw new APIError(\"FORBIDDEN\", {\n          message: \"Registration is invite-only during the private beta.\",\n        })\n      },\n    },\n    plugins: [\n      emailOTP({\n        async sendVerificationOTP({ email, otp, type }) {\n          const subject = subjects[type]\n            ? `${subjects[type]} - ${appName}`\n            : `Your ${appName} code`\n          const html = renderEmail(otp, type as PlatformAuthMailerType)\n\n          if (mailer) {\n            await mailer({\n              to: email,\n              subject,\n              html,\n              type: type as PlatformAuthMailerType,\n              otp,\n            })\n            return\n          }\n\n          console.warn(\n            `[EMAIL] No mailer configured — logging OTP to stdout for ${email} (${type}): ${otp}`,\n          )\n        },\n        otpLength: 6,\n        expiresIn: 300,\n        overrideDefaultEmailVerification: true,\n      }),\n      admin(),\n      ...plugins, // app-specific plugins (e.g. tanstackStartCookies)\n    ],\n    socialProviders: {\n      ...(google\n        ? {\n            google: {\n              clientId: google.clientId,\n              clientSecret: google.clientSecret,\n            },\n          }\n        : {}),\n      ...(github\n        ? {\n            github: {\n              clientId: github.clientId,\n              clientSecret: github.clientSecret,\n            },\n          }\n        : {}),\n    },\n  }) as unknown as Auth<BetterAuthOptions>\n}\n\nexport type PlatformAuth = ReturnType<typeof createPlatformAuth>\n\n// Re-export the session contract from /server so consumers that import the\n// auth factory can type api.getSession() without a second import path.\nexport type {\n  PlatformUser,\n  PlatformSession,\n  PlatformSessionData,\n} from \"./types\"\n\n// Invitation claiming runs on the auth callback, where the session is\n// established — the one place every sign-up flow passes through.\nexport {\n  claimInvitation,\n  completesSignup,\n  invitationOutcomeCookie,\n  inviteTokenFrom,\n  isInvitationFailure,\n} from \"./invitation\"\nexport type { ClaimOutcome, ClaimInvitationOptions } from \"./invitation\"\n"],"mappings":";;;;;;;;;AAAA,SAAS,YAAY,gBAAmD;AACxE,SAAS,UAAU,aAAa;AAGhC,IAAM,yBAAiD;AAAA,EACrD,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EACnB,WAAW;AACb;AAEA,SAAS,sBAAsB,KAAqB;AAClD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,oBAKW,GAAG;AAAA;AAAA;AAAA;AAAA;AAKvB;AAMO,SAAS,mBACd,QACyB;AACzB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,CAAC;AAAA,IACX,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,WAAW,EAAE,GAAG,wBAAwB,GAAG,cAAc;AAC/D,QAAM,cAAc,kBAAkB;AAOtC,SAAO,WAAW;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,MAChB,SAAS;AAAA,MACT,0BAA0B;AAAA,IAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS;AAAA,MACP,gBAAgB;AAAA,QACd,SAAS;AAAA,MACX;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAAA,MAEL,QAAQ,OAAO,QAAa;AAC1B,YAAI,CAAC,SAAU;AACf,YAAI,IAAI,SAAS,iBAAkB;AACnC,cAAM,OAAO,IAAI;AACjB,cAAM,QAAQ,MAAM;AACpB,cAAM,cAAc,MAAM;AAC1B,YAAI,SAAS,eAAe,WAAW;AACrC,gBAAM,KAAK,MAAM,UAAU,OAAO,WAAW;AAC7C,cAAI,GAAI;AAAA,QACV;AACA,cAAM,IAAI,SAAS,aAAa;AAAA,UAC9B,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,SAAS;AAAA,QACP,MAAM,oBAAoB,EAAE,OAAO,KAAK,KAAK,GAAG;AAC9C,gBAAM,UAAU,SAAS,IAAI,IACzB,GAAG,SAAS,IAAI,CAAC,MAAM,OAAO,KAC9B,QAAQ,OAAO;AACnB,gBAAM,OAAO,YAAY,KAAK,IAA8B;AAE5D,cAAI,QAAQ;AACV,kBAAM,OAAO;AAAA,cACX,IAAI;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YACF,CAAC;AACD;AAAA,UACF;AAEA,kBAAQ;AAAA,YACN,iEAA4D,KAAK,KAAK,IAAI,MAAM,GAAG;AAAA,UACrF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,kCAAkC;AAAA,MACpC,CAAC;AAAA,MACD,MAAM;AAAA,MACN,GAAG;AAAA;AAAA,IACL;AAAA,IACA,iBAAiB;AAAA,MACf,GAAI,SACA;AAAA,QACE,QAAQ;AAAA,UACN,UAAU,OAAO;AAAA,UACjB,cAAc,OAAO;AAAA,QACvB;AAAA,MACF,IACA,CAAC;AAAA,MACL,GAAI,SACA;AAAA,QACE,QAAQ;AAAA,UACN,UAAU,OAAO;AAAA,UACjB,cAAc,OAAO;AAAA,QACvB;AAAA,MACF,IACA,CAAC;AAAA,IACP;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/types-DxllDyOa.d.ts

@@ -0,0 +1,196 @@
+import { BetterAuthOptions } from 'better-auth';
+
+/**
+ * Session user shape exposed by the platform auth instance.
+ *
+ * The instance returned by {@link createPlatformAuth} is widened to the base
+ * `Auth` type so the published `.d.ts` stays portable (inferring the full
+ * plugin-augmented type triggers TS2742). That widening hides the fields the
+ * email-otp/admin plugins add at runtime — notably `role` from `admin()`.
+ *
+ * This is the hand-maintained contract for what `api.getSession()` actually
+ * returns. Consumers cast the session to {@link PlatformSession} to read these
+ * fields with types. Keep it in sync with the enabled plugins.
+ */
+interface PlatformUser {
+    id: string;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    /** From the admin() plugin. Absent until a role is assigned. */
+    role?: string | null;
+    /** From the admin() plugin. */
+    banned?: boolean | null;
+}
+interface PlatformSessionData {
+    id: string;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    createdAt: Date;
+    updatedAt: Date;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+}
+/** Return shape of `auth.api.getSession()` for platform apps. */
+interface PlatformSession {
+    user: PlatformUser;
+    session: PlatformSessionData;
+}
+type PlatformAuthMailerType = "email-verification" | "forget-password" | "sign-in" | "change-email";
+interface PlatformAuthMailerArgs {
+    /** Recipient address */
+    to: string;
+    /** Pre-rendered subject line */
+    subject: string;
+    /** Pre-rendered HTML body */
+    html: string;
+    /** Better Auth verification kind */
+    type: PlatformAuthMailerType;
+    /** The OTP value, in case the consumer wants to render its own template */
+    otp: string;
+}
+type PlatformAuthMailer = (args: PlatformAuthMailerArgs) => Promise<void>;
+interface PlatformAuthConfig {
+    /** PostgreSQL connection pool or connection string */
+    database: BetterAuthOptions["database"];
+    /** Base URL for Better Auth callbacks (e.g. http://localhost:3001) */
+    baseURL: string;
+    /** Secret for signing sessions */
+    secret: string;
+    /** Application name (used in emails) */
+    appName: string;
+    /**
+     * Transactional mailer. Receives the fully-rendered subject and HTML body
+     * and is responsible for pushing the message onto the wire (e.g. via the
+     * @digstack/spore-sdk, SES, postfix, …). When omitted, OTPs are logged to
+     * stdout — useful in dev/test, useless in production.
+     */
+    mailer?: PlatformAuthMailer;
+    /** Google OAuth config (omit to disable) */
+    google?: {
+        clientId: string;
+        clientSecret: string;
+    };
+    /** GitHub OAuth config (omit to disable) */
+    github?: {
+        clientId: string;
+        clientSecret: string;
+    };
+    /**
+     * Override the OTP email subject line per verification type. Merged over
+     * the platform defaults — provide only the keys you want to change. The
+     * resulting subject is suffixed with ` - ${appName}` like the defaults.
+     */
+    emailSubjects?: Partial<Record<PlatformAuthMailerType, string>>;
+    /**
+     * Override the OTP email HTML renderer. Receives the OTP code and the
+     * verification type, returns the HTML body. When omitted, the platform's
+     * default branded template is used.
+     */
+    renderOtpEmail?: (otp: string, type: PlatformAuthMailerType) => string;
+    /** Additional Better Auth plugins to append */
+    plugins?: BetterAuthOptions["plugins"];
+    /** Enable private beta mode (blocks public registration) */
+    betaMode?: boolean;
+    /** Check if an email+token pair has been invited (required when betaMode is true) */
+    isInvited?: (email: string, inviteToken: string) => Promise<boolean>;
+}
+interface PlatformAuthClientConfig {
+    /** Base URL override (defaults to window.location.origin in browser) */
+    baseURL?: string;
+    /** Additional client plugins */
+    plugins?: any[];
+}
+interface VerifyEmailFormProps {
+    /** Email to verify */
+    email: string;
+    /** Callback on successful verification */
+    onSuccess?: () => void;
+    /** URL to navigate to on success */
+    successUrl?: string;
+    /** Auth client instance */
+    authClient: any;
+}
+/** Why an invitation link did not work, as far as the invitee needs to know. */
+type InvitationFailure = "expired" | "claimed" | "unknown";
+interface InvitationNoticeProps {
+    reason?: InvitationFailure;
+    /** Defaults to contact@ the apex domain the app is served from. */
+    supportEmail?: string;
+    title?: string;
+    /** Rendered under the contact line — typically a link back to the site. */
+    action?: React.ReactNode;
+}
+interface LoginFormProps {
+    /** Callback once the session cookie is set and the core token minted */
+    onSuccess?: () => void;
+    /** Link to the registration page */
+    registerUrl?: string;
+    /** Link to the password recovery page */
+    forgotPasswordUrl?: string;
+    /**
+     * Where Better Auth sends the browser back after a social sign-in. Social
+     * buttons are only rendered when at least one provider is passed.
+     */
+    socialCallbackUrl?: string;
+    /** Social providers to offer, in display order */
+    socialProviders?: Array<"google" | "github">;
+    /**
+     * Endpoint trading the fresh better-auth session for the short-lived EdDSA
+     * token the Go core verifies. Called after a successful password sign-in;
+     * pass null to skip when the app has no core.
+     */
+    coreTokenUrl?: string | null;
+    /** Auth client instance */
+    authClient: any;
+}
+interface RegisterFormProps {
+    /** Callback on successful sign-up, receives the email to verify */
+    onSuccess?: (email: string) => void;
+    /** Link to the login page */
+    loginUrl?: string;
+    /** Rendered under the submit button — typically terms and privacy links */
+    legal?: React.ReactNode;
+    /** Where Better Auth sends the browser back after a social sign-up */
+    socialCallbackUrl?: string;
+    /** Social providers to offer, in display order */
+    socialProviders?: Array<"google" | "github">;
+    /** Auth client instance */
+    authClient: any;
+}
+interface ForgotPasswordFormProps {
+    /** Callback on successful OTP send, receives the email */
+    onSuccess?: (email: string) => void;
+    /** Link to login page */
+    loginUrl?: string;
+    /** Auth client instance */
+    authClient: any;
+}
+interface ResetPasswordFormProps {
+    /** Email address to reset password for */
+    email: string;
+    /** Callback on successful password reset */
+    onSuccess?: () => void;
+    /** Link to login page */
+    loginUrl?: string;
+    /** Auth client instance */
+    authClient: any;
+}
+interface AuthLayoutProps {
+    /** Logo element to display at the top */
+    logo?: React.ReactNode;
+    /** Page title */
+    title: string;
+    /** Subtitle below the title */
+    subtitle?: string;
+    /** Content to render inside the card */
+    children: React.ReactNode;
+    /** Footer content below the card (e.g. legal links) */
+    footer?: React.ReactNode;
+}
+
+export type { AuthLayoutProps as A, ForgotPasswordFormProps as F, InvitationNoticeProps as I, LoginFormProps as L, PlatformAuthClientConfig as P, RegisterFormProps as R, VerifyEmailFormProps as V, ResetPasswordFormProps as a, InvitationFailure as b, PlatformAuthConfig as c, PlatformAuthMailer as d, PlatformAuthMailerArgs as e, PlatformAuthMailerType as f, PlatformSession as g, PlatformSessionData as h, PlatformUser as i };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lalternative/auth",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Shared Better Auth wrapper for L'Alternative apps (server + React client + auth UI)",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,7 +25,8 @@
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "pnpm build"
   },
   "peerDependencies": {
     "better-auth": ">=1.4.0",