@lalternative/auth 0.9.5 → 0.10.0

package/README.md

@@ -2,9 +2,9 @@
 
 Shared [Better Auth](https://better-auth.com) wrapper for L'Alternative apps.
 
-Provides platform auth defaults (email-OTP + admin plugins), a React client,
-and the auth UI forms (login, register, verify-email, forgot/reset password,
-auth layout).
+Provides platform auth defaults (email-OTP + admin plugins, opt-in magic link),
+a React client, and the auth UI forms (login, register, verify-email,
+forgot/reset password, magic link, auth layout).
 
 ## Install
 
@@ -36,6 +36,62 @@ export const authClient = createPlatformAuthClient({ baseURL })
 import { LoginForm, RegisterForm, SocialButtons, VerifyEmailForm, ForgotPasswordForm, ResetPasswordForm, AuthLayout, useSession, useLogout } from "@lalternative/auth"
 ```
 
+### Magic link
+
+Passwordless sign-in by emailed link. Off unless `magicLink` is passed — the
+`/sign-in/magic-link` route is only mounted when it is, so an app that does not
+render the form does not expose the endpoint either.
+
+```ts
+export const auth = createPlatformAuth({
+  // …
+  magicLink: {
+    expiresIn: 300,      // default
+    allowSignUp: false,  // default
+  },
+})
+```
+
+`allowSignUp` is off on purpose. `createPlatformAuth` requires a verified email
+and can be put behind an invite-only beta, and both of those gates gate
+`/sign-up/email` — a magic link that creates the account walks past them. Turn
+it on only where sign-up is open anyway.
+
+The mailer receives the ready-made URL rather than an OTP:
+
+```ts
+const mailer: PlatformAuthMailer = async ({ to, subject, html, type, url }) => {
+  // type === "magic-link", url is signed and points at the app's callback
+}
+```
+
+```tsx
+import { MagicLinkForm } from "@lalternative/auth"
+
+<MagicLinkForm authClient={authClient} callbackUrl="/dashboard" />
+```
+
+The form confirms that a link was sent, never that the account exists: Better
+Auth answers the send identically either way, and only refuses at
+`/magic-link/verify`. Distinguishing the two in the form would tell an
+anonymous caller which addresses are registered.
+
+That means **every** failure past the send comes back on the callback as
+`?error=`, with no component mounted to have caught it — the same shape as an
+OAuth round-trip, and read the same way:
+
+```ts
+import { initialMagicLinkError, isMagicLinkError } from "@lalternative/auth"
+
+const error = initialMagicLinkError() // undefined unless the code is a magic-link one
+```
+
+`initialMagicLinkError` ignores OAuth's codes, and `initialOAuthError` is
+unchanged, so a screen offering both flows reads the one `?error=` against each
+vocabulary without either claiming the other's failures. `INVALID_TOKEN` covers
+expiry and reuse alike: the token is consumed atomically on first use, so a link
+followed twice is indistinguishable from one that timed out.
+
 ### Invitations
 
 An invitation link lands on the app's own sign-up page

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { createAuthClient } from 'better-auth/react';
-import { d as AuthClientSurface, P as PlatformAuthClientConfig } from './types-B7Ranu_a.js';
+import { d as AuthClientSurface, j as MagicLinkClientSurface, P as PlatformAuthClientConfig } from './types-BbTfkT5F.js';
 import 'better-auth';
 
 /**
@@ -9,11 +9,17 @@ import 'better-auth';
  * reaches into zod's internals), so the surface the auth screens call is
  * declared by hand in AuthClientSurface and intersected with the rest of the
  * client. Keep it in sync with the plugins enabled below.
+ *
+ * signIn carries both halves: the client always mounts magicLinkClient, since
+ * which methods exist client-side costs nothing — whether the route answers is
+ * decided server-side by passing `magicLink` to createPlatformAuth.
  */
-type PlatformAuthClient = AuthClientSurface & Omit<ReturnType<typeof createAuthClient>, keyof AuthClientSurface>;
+type PlatformAuthClient = Omit<AuthClientSurface, "signIn"> & {
+    signIn: AuthClientSurface["signIn"] & MagicLinkClientSurface["signIn"];
+} & Omit<ReturnType<typeof createAuthClient>, keyof AuthClientSurface | keyof MagicLinkClientSurface>;
 /**
  * Creates a Better Auth client for React usage.
- * Provides useSession() and the email-OTP / admin plugin methods.
+ * Provides useSession() and the email-OTP / magic-link / admin plugin methods.
  */
 declare function createPlatformAuthClient(config?: PlatformAuthClientConfig): PlatformAuthClient;
 

package/dist/client.js

@@ -1,10 +1,19 @@
 // src/client.ts
 import { createAuthClient } from "better-auth/react";
-import { emailOTPClient, adminClient } from "better-auth/client/plugins";
+import {
+  emailOTPClient,
+  adminClient,
+  magicLinkClient
+} from "better-auth/client/plugins";
 function createPlatformAuthClient(config) {
   return createAuthClient({
     baseURL: config?.baseURL ?? (typeof window !== "undefined" ? window.location.origin : "http://localhost:3000"),
-    plugins: [emailOTPClient(), adminClient(), ...config?.plugins ?? []]
+    plugins: [
+      emailOTPClient(),
+      magicLinkClient(),
+      adminClient(),
+      ...config?.plugins ?? []
+    ]
   });
 }
 export {

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import { createAuthClient } from \"better-auth/react\"\nimport { emailOTPClient, adminClient } from \"better-auth/client/plugins\"\nimport type { AuthClientSurface, PlatformAuthClientConfig } from \"./types\"\n\n/**\n * A Better Auth React client carrying the platform plugins.\n *\n * The concrete inferred type cannot be named in a published .d.ts (TS2742 — it\n * reaches into zod's internals), so the surface the auth screens call is\n * declared by hand in AuthClientSurface and intersected with the rest of the\n * client. Keep it in sync with the plugins enabled below.\n */\nexport type PlatformAuthClient = AuthClientSurface &\n  Omit<ReturnType<typeof createAuthClient>, keyof AuthClientSurface>\n\n/**\n * Creates a Better Auth client for React usage.\n * Provides useSession() and the email-OTP / admin plugin methods.\n */\nexport function createPlatformAuthClient(\n  config?: PlatformAuthClientConfig,\n): PlatformAuthClient {\n  return createAuthClient({\n    baseURL:\n      config?.baseURL ??\n      (typeof window !== \"undefined\"\n        ? window.location.origin\n        : \"http://localhost:3000\"),\n    plugins: [emailOTPClient(), adminClient(), ...(config?.plugins ?? [])],\n  }) as unknown as PlatformAuthClient\n}\n"],"mappings":";AAAA,SAAS,wBAAwB;AACjC,SAAS,gBAAgB,mBAAmB;AAkBrC,SAAS,yBACd,QACoB;AACpB,SAAO,iBAAiB;AAAA,IACtB,SACE,QAAQ,YACP,OAAO,WAAW,cACf,OAAO,SAAS,SAChB;AAAA,IACN,SAAS,CAAC,eAAe,GAAG,YAAY,GAAG,GAAI,QAAQ,WAAW,CAAC,CAAE;AAAA,EACvE,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import { createAuthClient } from \"better-auth/react\"\nimport {\n  emailOTPClient,\n  adminClient,\n  magicLinkClient,\n} from \"better-auth/client/plugins\"\nimport type {\n  AuthClientSurface,\n  MagicLinkClientSurface,\n  PlatformAuthClientConfig,\n} from \"./types\"\n\n/**\n * A Better Auth React client carrying the platform plugins.\n *\n * The concrete inferred type cannot be named in a published .d.ts (TS2742 — it\n * reaches into zod's internals), so the surface the auth screens call is\n * declared by hand in AuthClientSurface and intersected with the rest of the\n * client. Keep it in sync with the plugins enabled below.\n *\n * signIn carries both halves: the client always mounts magicLinkClient, since\n * which methods exist client-side costs nothing — whether the route answers is\n * decided server-side by passing `magicLink` to createPlatformAuth.\n */\nexport type PlatformAuthClient = Omit<AuthClientSurface, \"signIn\"> & {\n  signIn: AuthClientSurface[\"signIn\"] & MagicLinkClientSurface[\"signIn\"]\n} & Omit<\n    ReturnType<typeof createAuthClient>,\n    keyof AuthClientSurface | keyof MagicLinkClientSurface\n  >\n\n/**\n * Creates a Better Auth client for React usage.\n * Provides useSession() and the email-OTP / magic-link / admin plugin methods.\n */\nexport function createPlatformAuthClient(\n  config?: PlatformAuthClientConfig,\n): PlatformAuthClient {\n  return createAuthClient({\n    baseURL:\n      config?.baseURL ??\n      (typeof window !== \"undefined\"\n        ? window.location.origin\n        : \"http://localhost:3000\"),\n    plugins: [\n      emailOTPClient(),\n      magicLinkClient(),\n      adminClient(),\n      ...(config?.plugins ?? []),\n    ],\n  }) as unknown as PlatformAuthClient\n}\n"],"mappings":";AAAA,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA8BA,SAAS,yBACd,QACoB;AACpB,SAAO,iBAAiB;AAAA,IACtB,SACE,QAAQ,YACP,OAAO,WAAW,cACf,OAAO,SAAS,SAChB;AAAA,IACN,SAAS;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,GAAI,QAAQ,WAAW,CAAC;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { L as LoginFormProps, R as RegisterFormProps, V as VerifyEmailFormProps, F as ForgotPasswordFormProps, a as ResetPasswordFormProps, A as AuthLayoutProps, I as InvitationNoticeProps, b as AuthClientResult, c as LinkComponent } from './types-B7Ranu_a.js';
-export { d as AuthClientSurface, e as AuthInviteProps, f as AuthNavProps, g as AuthThemeProps, h as InvitationFailure, i as LoginFormLabels, P as PlatformAuthClientConfig, j as PlatformAuthConfig, k as PlatformAuthMailer, l as PlatformAuthMailerArgs, m as PlatformAuthMailerType, n as PlatformSession, o as PlatformSessionData, p as PlatformUser, q as RegisterFormLabels } from './types-B7Ranu_a.js';
+import { L as LoginFormProps, R as RegisterFormProps, V as VerifyEmailFormProps, F as ForgotPasswordFormProps, M as MagicLinkFormProps, a as ResetPasswordFormProps, A as AuthLayoutProps, I as InvitationNoticeProps, b as AuthClientResult, c as LinkComponent } from './types-BbTfkT5F.js';
+export { d as AuthClientSurface, e as AuthInviteProps, f as AuthNavProps, g as AuthThemeProps, h as InvitationFailure, i as LoginFormLabels, j as MagicLinkClientSurface, k as MagicLinkConfig, l as MagicLinkFormLabels, P as PlatformAuthClientConfig, m as PlatformAuthConfig, n as PlatformAuthMailer, o as PlatformAuthMailerArgs, p as PlatformAuthMailerType, q as PlatformSession, r as PlatformSessionData, s as PlatformUser, t as RegisterFormLabels } from './types-BbTfkT5F.js';
 import * as better_auth_react from 'better-auth/react';
 import * as better_auth from 'better-auth';
 import { PlatformAuthClient } from './client.js';
 import * as react from 'react';
 import { InputHTMLAttributes, ReactNode } from 'react';
-export { C as ClaimOutcome, i as isInvitationFailure } from './invitation-DuoHHBNA.js';
+export { C as ClaimOutcome, i as isInvitationFailure } from './invitation-DcALM_sl.js';
 
 /**
  * Returns a useSession hook bound to the given auth client.
@@ -144,6 +144,14 @@ declare namespace ForgotPasswordForm {
     };
 }
 
+declare function MagicLinkForm({ onSuccess, loginUrl, callbackUrl, newUserCallbackUrl, labels, submitClassName, fieldClassName, error: externalError, linkComponent, invite, authClient, }: MagicLinkFormProps): react.JSX.Element;
+declare namespace MagicLinkForm {
+    var defaults: {
+        title: string;
+        subtitle: string;
+    };
+}
+
 declare function ResetPasswordForm({ email, onSuccess, loginUrl, labels, submitClassName, fieldClassName, linkComponent, authClient, }: ResetPasswordFormProps): react.JSX.Element;
 declare namespace ResetPasswordForm {
     var defaults: {
@@ -249,6 +257,40 @@ declare function initialOAuthError(labels: OAuthErrorLabels, param?: string): st
  */
 declare function clearOAuthError(param?: string): void;
 
+type MagicLinkErrorLabels = {
+    invalidToken: string;
+    signUpDisabled: string;
+    failed: string;
+};
+/**
+ * Turns the failure a followed magic link redirected back with into something
+ * the person can act on.
+ *
+ * Every way the flow can fail lands here rather than on the send: Better Auth
+ * consumes the token at /magic-link/verify, and any refusal there is thrown as
+ * a redirect to the errorCallbackURL. `INVALID_TOKEN` covers expiry and reuse
+ * alike — the token is consumed atomically on first use, so a link followed
+ * twice is indistinguishable from one that timed out, and the copy names both.
+ */
+declare function magicLinkErrorMessage(code: string | null | undefined, labels?: Partial<MagicLinkErrorLabels>): string;
+/**
+ * Whether a `?error=` came from a magic link rather than from OAuth.
+ *
+ * Both flows return to the same screens through the same parameter, so a page
+ * offering the two needs to know which vocabulary to read the code against —
+ * otherwise an expired link is reported as a failed social sign-in.
+ */
+declare function isMagicLinkError(code: string | null | undefined): boolean;
+/**
+ * Reads the failure a followed link redirected back with.
+ *
+ * Following a link leaves the app entirely, so no component state survives it;
+ * the address bar is the only carrier left. Mirrors initialOAuthError, down to
+ * reading `window.location` rather than a typed route search — the auth routes
+ * declare none on purpose.
+ */
+declare function initialMagicLinkError(labels?: Partial<MagicLinkErrorLabels>, param?: string): string | undefined;
+
 interface AuthLinkProps {
     to: string;
     as?: LinkComponent;
@@ -264,4 +306,4 @@ interface AuthLinkProps {
  */
 declare function AuthLink({ to, as: Link, className, children }: AuthLinkProps): react.JSX.Element;
 
-export { AuthClientResult, AuthField, type AuthFieldProps, AuthLayout, AuthLayoutProps, AuthLink, AuthSubmit, ForgotPasswordForm, ForgotPasswordFormProps, InvitationNotice, InvitationNoticeProps, LinkComponent, LoginForm, LoginFormProps, type OAuthErrorLabels, RegisterForm, RegisterFormProps, ResetPasswordForm, ResetPasswordFormProps, SocialButtons, VerifyEmailForm, VerifyEmailFormProps, clearOAuthError, initialOAuthError, isEmailNotVerified, normalizeInviteToken, oauthErrorMessage, useLogout, useSession, withInviteToken };
+export { AuthClientResult, AuthField, type AuthFieldProps, AuthLayout, AuthLayoutProps, AuthLink, AuthSubmit, ForgotPasswordForm, ForgotPasswordFormProps, InvitationNotice, InvitationNoticeProps, LinkComponent, LoginForm, LoginFormProps, type MagicLinkErrorLabels, MagicLinkForm, MagicLinkFormProps, type OAuthErrorLabels, RegisterForm, RegisterFormProps, ResetPasswordForm, ResetPasswordFormProps, SocialButtons, VerifyEmailForm, VerifyEmailFormProps, clearOAuthError, initialMagicLinkError, initialOAuthError, isEmailNotVerified, isMagicLinkError, magicLinkErrorMessage, normalizeInviteToken, oauthErrorMessage, useLogout, useSession, withInviteToken };

package/dist/index.js

@@ -967,11 +967,131 @@ ForgotPasswordForm.defaults = {
   subtitle: DEFAULTS4.subtitle
 };
 
-// src/components/reset-password-form.tsx
+// src/components/magic-link-form.tsx
 import { useState as useState6 } from "react";
 import { jsx as jsx11, jsxs as jsxs9 } from "react/jsx-runtime";
-var MIN_PASSWORD_LENGTH2 = 8;
 var DEFAULTS5 = {
+  title: "Connexion par lien",
+  subtitle: "Entre ton adresse e-mail et nous t'enverrons un lien pour te connecter, sans mot de passe.",
+  emailPlaceholder: "Adresse e-mail",
+  submit: "Envoyer le lien",
+  submitPending: "Envoi\u2026",
+  sent: "Lien envoy\xE9. Ouvre ta bo\xEEte de r\xE9ception pour te connecter \u2014 il expire dans 5 minutes.",
+  resend: "Renvoyer le lien",
+  usePassword: "Tu pr\xE9f\xE8res ton mot de passe ?",
+  login: "Se connecter",
+  emailRequired: "Renseigne ton adresse e-mail",
+  sendFailed: "L'envoi du lien a \xE9chou\xE9"
+};
+function MagicLinkForm({
+  onSuccess,
+  loginUrl = "/login",
+  callbackUrl = "/",
+  newUserCallbackUrl,
+  labels,
+  submitClassName,
+  fieldClassName,
+  error: externalError,
+  linkComponent,
+  invite,
+  authClient
+}) {
+  const t = { ...DEFAULTS5, ...labels };
+  const [email, setEmail] = useState6("");
+  const [ownError, setOwnError] = useState6();
+  const [isPending, setIsPending] = useState6(false);
+  const [isSent, setIsSent] = useState6(false);
+  const error = ownError ?? externalError;
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    if (!email.trim()) {
+      setOwnError(t.emailRequired);
+      return;
+    }
+    setOwnError(void 0);
+    setIsPending(true);
+    try {
+      const res = await authClient.signIn.magicLink({
+        email: email.trim(),
+        // The invitation rides the callback: following the link leaves the
+        // browser on the mail client, so the auth handler redeems the token on
+        // the way back, as it does for OAuth.
+        callbackURL: withInviteToken(callbackUrl, invite),
+        ...newUserCallbackUrl ? { newUserCallbackURL: withInviteToken(newUserCallbackUrl, invite) } : {}
+      });
+      if (res?.error) {
+        setOwnError(res.error.message ?? t.sendFailed);
+        return;
+      }
+      setIsSent(true);
+      onSuccess?.(email.trim());
+    } catch (err) {
+      setOwnError(err instanceof Error ? err.message : t.sendFailed);
+    } finally {
+      setIsPending(false);
+    }
+  };
+  return /* @__PURE__ */ jsxs9("div", { className: "space-y-7", children: [
+    /* @__PURE__ */ jsx11(AuthAlert, { children: error }),
+    /* @__PURE__ */ jsx11(AuthAlert, { tone: "success", children: !error && isSent ? t.sent : void 0 }),
+    /* @__PURE__ */ jsxs9("form", { onSubmit: handleSubmit, className: "space-y-[1.125rem]", noValidate: true, children: [
+      /* @__PURE__ */ jsx11(
+        AuthField,
+        {
+          label: t.emailPlaceholder,
+          type: "email",
+          inputMode: "email",
+          value: email,
+          onChange: (e) => {
+            setEmail(e.target.value);
+            setIsSent(false);
+          },
+          required: true,
+          disabled: isPending,
+          autoComplete: "email",
+          autoCapitalize: "none",
+          spellCheck: false,
+          invalid: !!error,
+          fieldClassName
+        }
+      ),
+      /* @__PURE__ */ jsx11(
+        AuthSubmit,
+        {
+          spacedAbove: true,
+          pending: isPending,
+          disabled: !email.trim(),
+          pendingLabel: t.submitPending,
+          className: submitClassName,
+          children: isSent ? t.resend : t.submit
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxs9("p", { className: "text-center text-sm text-muted-foreground", children: [
+      t.usePassword,
+      " ",
+      /* @__PURE__ */ jsx11(
+        AuthLink,
+        {
+          to: withInviteToken(loginUrl, invite),
+          as: linkComponent,
+          className: AUTH_LINK_CLASS,
+          children: t.login
+        }
+      )
+    ] })
+  ] });
+}
+MagicLinkForm.defaults = {
+  title: DEFAULTS5.title,
+  subtitle: DEFAULTS5.subtitle
+};
+
+// src/components/reset-password-form.tsx
+import { useState as useState7 } from "react";
+import { jsx as jsx12, jsxs as jsxs10 } from "react/jsx-runtime";
+var MIN_PASSWORD_LENGTH2 = 8;
+var DEFAULTS6 = {
   title: "Nouveau mot de passe",
   subtitle: "Entre le code \xE0 6 chiffres re\xE7u par e-mail et ton nouveau mot de passe.",
   codePlaceholder: "Code de v\xE9rification",
@@ -1001,14 +1121,14 @@ function ResetPasswordForm({
   linkComponent,
   authClient
 }) {
-  const t = { ...DEFAULTS5, ...labels };
-  const [otp, setOtp] = useState6("");
-  const [password, setPassword] = useState6("");
-  const [confirmPassword, setConfirmPassword] = useState6("");
-  const [error, setError] = useState6();
-  const [isResetting, setIsResetting] = useState6(false);
-  const [isResending, setIsResending] = useState6(false);
-  const [resendMessage, setResendMessage] = useState6();
+  const t = { ...DEFAULTS6, ...labels };
+  const [otp, setOtp] = useState7("");
+  const [password, setPassword] = useState7("");
+  const [confirmPassword, setConfirmPassword] = useState7("");
+  const [error, setError] = useState7();
+  const [isResetting, setIsResetting] = useState7(false);
+  const [isResending, setIsResending] = useState7(false);
+  const [resendMessage, setResendMessage] = useState7();
   const tooShort = password.length > 0 && password.length < MIN_PASSWORD_LENGTH2;
   const mismatch = confirmPassword.length > 0 && confirmPassword !== password;
   const handleSubmit = async (e) => {
@@ -1062,11 +1182,11 @@ function ResetPasswordForm({
       setIsResending(false);
     }
   };
-  return /* @__PURE__ */ jsxs9("div", { className: "space-y-7", children: [
-    /* @__PURE__ */ jsx11(AuthAlert, { children: error }),
-    /* @__PURE__ */ jsx11(AuthAlert, { tone: "success", children: resendMessage }),
-    /* @__PURE__ */ jsxs9("form", { onSubmit: handleSubmit, className: "space-y-[1.125rem]", noValidate: true, children: [
-      /* @__PURE__ */ jsx11(
+  return /* @__PURE__ */ jsxs10("div", { className: "space-y-7", children: [
+    /* @__PURE__ */ jsx12(AuthAlert, { children: error }),
+    /* @__PURE__ */ jsx12(AuthAlert, { tone: "success", children: resendMessage }),
+    /* @__PURE__ */ jsxs10("form", { onSubmit: handleSubmit, className: "space-y-[1.125rem]", noValidate: true, children: [
+      /* @__PURE__ */ jsx12(
         AuthOtpField,
         {
           id: "reset-password-otp",
@@ -1077,7 +1197,7 @@ function ResetPasswordForm({
           fieldClassName
         }
       ),
-      /* @__PURE__ */ jsx11(
+      /* @__PURE__ */ jsx12(
         AuthField,
         {
           label: t.passwordPlaceholder,
@@ -1091,7 +1211,7 @@ function ResetPasswordForm({
           invalid: tooShort
         }
       ),
-      /* @__PURE__ */ jsx11(
+      /* @__PURE__ */ jsx12(
         AuthField,
         {
           label: t.confirmPlaceholder,
@@ -1104,7 +1224,7 @@ function ResetPasswordForm({
           invalid: mismatch
         }
       ),
-      /* @__PURE__ */ jsx11(
+      /* @__PURE__ */ jsx12(
         AuthSubmit,
         {
           spacedAbove: true,
@@ -1116,8 +1236,8 @@ function ResetPasswordForm({
         }
       )
     ] }),
-    /* @__PURE__ */ jsxs9("div", { className: "space-y-4 text-center text-sm text-muted-foreground", children: [
-      /* @__PURE__ */ jsx11(
+    /* @__PURE__ */ jsxs10("div", { className: "space-y-4 text-center text-sm text-muted-foreground", children: [
+      /* @__PURE__ */ jsx12(
         "button",
         {
           type: "button",
@@ -1127,10 +1247,10 @@ function ResetPasswordForm({
           children: isResending ? t.resendPending : t.resend
         }
       ),
-      /* @__PURE__ */ jsxs9("p", { children: [
+      /* @__PURE__ */ jsxs10("p", { children: [
         t.rememberPassword,
         " ",
-        /* @__PURE__ */ jsx11(
+        /* @__PURE__ */ jsx12(
           AuthLink,
           {
             to: loginUrl,
@@ -1144,25 +1264,25 @@ function ResetPasswordForm({
   ] });
 }
 ResetPasswordForm.defaults = {
-  title: DEFAULTS5.title,
-  subtitle: DEFAULTS5.subtitle
+  title: DEFAULTS6.title,
+  subtitle: DEFAULTS6.subtitle
 };
 
 // src/components/auth-heading.tsx
-import { jsx as jsx12, jsxs as jsxs10 } from "react/jsx-runtime";
+import { jsx as jsx13, jsxs as jsxs11 } from "react/jsx-runtime";
 function AuthHeading({
   title,
   subtitle,
   titleClassName = "text-[2rem] font-semibold leading-[1.1] tracking-[-0.03em] sm:text-[2.25rem]"
 }) {
-  return /* @__PURE__ */ jsxs10("header", { className: "space-y-2.5 text-center", children: [
-    /* @__PURE__ */ jsx12("h1", { className: titleClassName, children: title }),
-    subtitle && /* @__PURE__ */ jsx12("p", { className: "text-balance text-[0.9375rem] leading-relaxed text-muted-foreground", children: subtitle })
+  return /* @__PURE__ */ jsxs11("header", { className: "space-y-2.5 text-center", children: [
+    /* @__PURE__ */ jsx13("h1", { className: titleClassName, children: title }),
+    subtitle && /* @__PURE__ */ jsx13("p", { className: "text-balance text-[0.9375rem] leading-relaxed text-muted-foreground", children: subtitle })
   ] });
 }
 
 // src/components/auth-layout.tsx
-import { jsx as jsx13, jsxs as jsxs11 } from "react/jsx-runtime";
+import { jsx as jsx14, jsxs as jsxs12 } from "react/jsx-runtime";
 function AuthLayout({
   logo,
   panel,
@@ -1172,7 +1292,7 @@ function AuthLayout({
   children,
   footer
 }) {
-  return /* @__PURE__ */ jsxs11(
+  return /* @__PURE__ */ jsxs12(
     "div",
     {
       className: [
@@ -1186,7 +1306,7 @@ function AuthLayout({
         // screen, so the colour only has to sit behind the heading. Covering
         // the whole height would leave the panel's own copy showing under the
         // card, which reads as a second, half-hidden screen.
-        /* @__PURE__ */ jsx13(
+        /* @__PURE__ */ jsx14(
           "div",
           {
             "aria-hidden": "true",
@@ -1194,12 +1314,12 @@ function AuthLayout({
             children: panel
           }
         ),
-        /* @__PURE__ */ jsxs11("div", { className: `mx-auto w-full ${panel ? "max-w-4xl" : "max-w-[440px]"}`, children: [
+        /* @__PURE__ */ jsxs12("div", { className: `mx-auto w-full ${panel ? "max-w-4xl" : "max-w-[440px]"}`, children: [
           (logo || title) && // The mark sits tight above the title so the two read as one block
           // rather than as a stray label; the gap down to the card is the
           // largest on the screen — that step is what separates "who this is"
           // from "what you do here".
-          /* @__PURE__ */ jsxs11(
+          /* @__PURE__ */ jsxs12(
             "div",
             {
               className: [
@@ -1210,8 +1330,8 @@ function AuthLayout({
                 panel ? "text-white [&_p]:text-white/75 md:text-foreground md:[&_p]:text-muted-foreground" : ""
               ].filter(Boolean).join(" "),
               children: [
-                logo && /* @__PURE__ */ jsx13("div", { className: "flex justify-center", children: logo }),
-                title && /* @__PURE__ */ jsx13(
+                logo && /* @__PURE__ */ jsx14("div", { className: "flex justify-center", children: logo }),
+                title && /* @__PURE__ */ jsx14(
                   AuthHeading,
                   {
                     title,
@@ -1222,7 +1342,7 @@ function AuthLayout({
               ]
             }
           ),
-          /* @__PURE__ */ jsxs11(
+          /* @__PURE__ */ jsxs12(
             "div",
             {
               className: [
@@ -1236,7 +1356,7 @@ function AuthLayout({
               children: [
                 panel && // Decorative: it must never carry information the form does not,
                 // so it is hidden from assistive tech rather than described.
-                /* @__PURE__ */ jsx13(
+                /* @__PURE__ */ jsx14(
                   "div",
                   {
                     "aria-hidden": "true",
@@ -1244,11 +1364,11 @@ function AuthLayout({
                     children: panel
                   }
                 ),
-                /* @__PURE__ */ jsx13("div", { className: panel ? "px-5 pb-12 pt-7 sm:p-7" : "sm:p-7", children })
+                /* @__PURE__ */ jsx14("div", { className: panel ? "px-5 pb-12 pt-7 sm:p-7" : "sm:p-7", children })
               ]
             }
           ),
-          footer && /* @__PURE__ */ jsx13("div", { className: "mt-8 text-center text-xs leading-relaxed text-muted-foreground", children: footer })
+          footer && /* @__PURE__ */ jsx14("div", { className: "mt-8 text-center text-xs leading-relaxed text-muted-foreground", children: footer })
         ] })
       ]
     }
@@ -1256,7 +1376,7 @@ function AuthLayout({
 }
 
 // src/components/invitation-notice.tsx
-import { jsx as jsx14, jsxs as jsxs12 } from "react/jsx-runtime";
+import { jsx as jsx15, jsxs as jsxs13 } from "react/jsx-runtime";
 function defaultSupportEmail() {
   if (typeof window === "undefined") return void 0;
   const host = window.location.hostname;
@@ -1276,15 +1396,15 @@ function InvitationNotice({
   action
 }) {
   const contact = supportEmail ?? defaultSupportEmail();
-  return /* @__PURE__ */ jsxs12("div", { className: "space-y-8", children: [
-    /* @__PURE__ */ jsxs12("div", { children: [
-      /* @__PURE__ */ jsx14("h1", { className: "text-2xl font-bold tracking-tight", children: title }),
-      /* @__PURE__ */ jsx14("p", { className: "mt-1 text-sm text-muted-foreground", children: REASON_MESSAGE[reason] ?? REASON_MESSAGE.unknown })
+  return /* @__PURE__ */ jsxs13("div", { className: "space-y-8", children: [
+    /* @__PURE__ */ jsxs13("div", { children: [
+      /* @__PURE__ */ jsx15("h1", { className: "text-2xl font-bold tracking-tight", children: title }),
+      /* @__PURE__ */ jsx15("p", { className: "mt-1 text-sm text-muted-foreground", children: REASON_MESSAGE[reason] ?? REASON_MESSAGE.unknown })
     ] }),
-    contact ? /* @__PURE__ */ jsxs12("p", { className: "text-sm text-muted-foreground", children: [
+    contact ? /* @__PURE__ */ jsxs13("p", { className: "text-sm text-muted-foreground", children: [
       "\xC9crivez-nous \xE0",
       " ",
-      /* @__PURE__ */ jsx14(
+      /* @__PURE__ */ jsx15(
         "a",
         {
           href: `mailto:${contact}`,
@@ -1323,6 +1443,39 @@ function clearOAuthError(param = "error") {
   url.searchParams.delete(param);
   window.history.replaceState({}, "", url.toString());
 }
+
+// src/magic-link-error.ts
+var MAGIC_LINK_ERROR_DEFAULTS = {
+  invalidToken: "Ce lien n'est plus valide. Il expire apr\xE8s 5 minutes et ne fonctionne qu'une fois \u2014 demandes-en un nouveau.",
+  signUpDisabled: "Aucun compte n'existe pour cette adresse. Cr\xE9e-en un d'abord.",
+  failed: "La connexion par lien a \xE9chou\xE9. R\xE9essaie."
+};
+function magicLinkErrorMessage(code, labels = {}) {
+  const t = { ...MAGIC_LINK_ERROR_DEFAULTS, ...labels };
+  switch (code) {
+    case "INVALID_TOKEN":
+      return t.invalidToken;
+    case "new_user_signup_disabled":
+      return t.signUpDisabled;
+    default:
+      return t.failed;
+  }
+}
+var MAGIC_LINK_ERROR_CODES = /* @__PURE__ */ new Set([
+  "INVALID_TOKEN",
+  "new_user_signup_disabled",
+  "failed_to_create_user",
+  "failed_to_create_session"
+]);
+function isMagicLinkError(code) {
+  return !!code && MAGIC_LINK_ERROR_CODES.has(code);
+}
+function initialMagicLinkError(labels = {}, param = "error") {
+  if (typeof window === "undefined") return void 0;
+  const code = new URLSearchParams(window.location.search).get(param);
+  if (!isMagicLinkError(code)) return void 0;
+  return magicLinkErrorMessage(code, labels);
+}
 export {
   AuthField,
   AuthLayout,
@@ -1331,14 +1484,18 @@ export {
   ForgotPasswordForm,
   InvitationNotice,
   LoginForm,
+  MagicLinkForm,
   RegisterForm,
   ResetPasswordForm,
   SocialButtons,
   VerifyEmailForm,
   clearOAuthError,
+  initialMagicLinkError,
   initialOAuthError,
   isEmailNotVerified,
   isInvitationFailure,
+  isMagicLinkError,
+  magicLinkErrorMessage,
   normalizeInviteToken,
   oauthErrorMessage,
   useLogout,