@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/dist/components/app/guards/DeveloperGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeveloperGuard.d.ts","sourceRoot":"","sources":["../../../../src/components/app/guards/DeveloperGuard.tsx"],"names":[],"mappings":"AAUA,UAAU,mBAAmB;IAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,mBAAmB,2CAiGzE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC"}
+{"version":3,"file":"DeveloperGuard.d.ts","sourceRoot":"","sources":["../../../../src/components/app/guards/DeveloperGuard.tsx"],"names":[],"mappings":"AAUA,UAAU,mBAAmB;IAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,mBAAmB,2CAgHzE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAIxC"}

package/dist/components/app/guards/DeveloperGuard.js

@@ -2,7 +2,7 @@
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { useSession } from "../../../lib/auth-client.js";
 import { useRouter } from "next/navigation";
-import { useEffect } from "react";
+import { useEffect, useState } from "react";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "../../ui/card.js";
 import { AlertTriangle, ArrowLeft } from "lucide-react";
 import { Button } from "../../ui/button.js";
@@ -12,13 +12,17 @@ function DeveloperGuard({ children, fallback }) {
   const { data: session, isPending } = useSession();
   const router = useRouter();
   const t = useTranslations();
+  const [mounted, setMounted] = useState(false);
+  useEffect(() => {
+    setMounted(true);
+  }, []);
   useEffect(() => {
     var _a2;
-    if (!isPending && session && ((_a2 = session.user) == null ? void 0 : _a2.role) !== "developer") {
+    if (mounted && !isPending && session && ((_a2 = session.user) == null ? void 0 : _a2.role) !== "developer") {
       router.push("/dashboard?error=access_denied");
     }
-  }, [session, isPending, router]);
-  if (isPending) {
+  }, [mounted, session, isPending, router]);
+  if (!mounted || isPending) {
     return /* @__PURE__ */ jsx("div", { className: "flex items-center justify-center min-h-screen", children: /* @__PURE__ */ jsxs("div", { className: "animate-pulse", children: [
       /* @__PURE__ */ jsx("div", { className: "h-8 bg-muted rounded w-48 mb-4" }),
       /* @__PURE__ */ jsx("div", { className: "h-4 bg-muted rounded w-32" })

package/dist/components/app/guards/SuperAdminGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SuperAdminGuard.d.ts","sourceRoot":"","sources":["../../../../src/components/app/guards/SuperAdminGuard.tsx"],"names":[],"mappings":"AAUA,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,oBAAoB,2CA8F3E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAGzC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C"}
+{"version":3,"file":"SuperAdminGuard.d.ts","sourceRoot":"","sources":["../../../../src/components/app/guards/SuperAdminGuard.tsx"],"names":[],"mappings":"AAUA,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,oBAAoB,2CAyG3E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAIzC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAI3C"}

package/dist/components/app/guards/SuperAdminGuard.js

@@ -2,7 +2,7 @@
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { useSession } from "../../../lib/auth-client.js";
 import { useRouter } from "next/navigation";
-import { useEffect } from "react";
+import { useEffect, useState } from "react";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "../../ui/card.js";
 import { AlertTriangle, ArrowLeft } from "lucide-react";
 import { Button } from "../../ui/button.js";
@@ -12,13 +12,17 @@ function SuperAdminGuard({ children, fallback }) {
   const { data: session, isPending } = useSession();
   const router = useRouter();
   const t = useTranslations();
+  const [mounted, setMounted] = useState(false);
+  useEffect(() => {
+    setMounted(true);
+  }, []);
   useEffect(() => {
     var _a2, _b2;
-    if (!isPending && session && ((_a2 = session.user) == null ? void 0 : _a2.role) !== "superadmin" && ((_b2 = session.user) == null ? void 0 : _b2.role) !== "developer") {
+    if (mounted && !isPending && session && ((_a2 = session.user) == null ? void 0 : _a2.role) !== "superadmin" && ((_b2 = session.user) == null ? void 0 : _b2.role) !== "developer") {
       router.push("/dashboard?error=access_denied");
     }
-  }, [session, isPending, router]);
-  if (isPending) {
+  }, [mounted, session, isPending, router]);
+  if (!mounted || isPending) {
     return /* @__PURE__ */ jsx("div", { className: "flex items-center justify-center min-h-screen", children: /* @__PURE__ */ jsxs("div", { className: "animate-pulse", children: [
       /* @__PURE__ */ jsx("div", { className: "h-8 bg-muted rounded w-48 mb-4" }),
       /* @__PURE__ */ jsx("div", { className: "h-4 bg-muted rounded w-32" })

package/dist/components/app/layouts/PublicFooter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PublicFooter.d.ts","sourceRoot":"","sources":["../../../../src/components/app/layouts/PublicFooter.tsx"],"names":[],"mappings":"AAKA,wBAAgB,YAAY,4CA0J3B"}
+{"version":3,"file":"PublicFooter.d.ts","sourceRoot":"","sources":["../../../../src/components/app/layouts/PublicFooter.tsx"],"names":[],"mappings":"AAMA,wBAAgB,YAAY,4CAyJ3B"}

package/dist/components/app/layouts/PublicFooter.js

@@ -3,11 +3,11 @@ import Link from "next/link";
 import { Separator } from "../../ui/separator.js";
 import { useTranslations } from "next-intl";
 import { sel } from "../../../lib/test/index.js";
+import { APP_NAME } from "../../../lib/config/index.js";
 function PublicFooter() {
   const currentYear = (/* @__PURE__ */ new Date()).getFullYear();
   const t = useTranslations("footer");
-  const tCommon = useTranslations("common");
-  const appName = tCommon("appName");
+  const appName = APP_NAME;
   const footerLinks = {
     product: [
       { name: "features", href: "/features" },

package/dist/components/app/layouts/PublicNavbar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PublicNavbar.d.ts","sourceRoot":"","sources":["../../../../src/components/app/layouts/PublicNavbar.tsx"],"names":[],"mappings":"AAYA,wBAAgB,YAAY,4CA0J3B"}
+{"version":3,"file":"PublicNavbar.d.ts","sourceRoot":"","sources":["../../../../src/components/app/layouts/PublicNavbar.tsx"],"names":[],"mappings":"AAaA,wBAAgB,YAAY,4CAyJ3B"}

package/dist/components/app/layouts/PublicNavbar.js

@@ -8,13 +8,13 @@ import { Menu, X } from "lucide-react";
 import { useState } from "react";
 import { sel } from "../../../lib/test/index.js";
 import { useTranslations } from "next-intl";
+import { APP_NAME } from "../../../lib/config/index.js";
 function PublicNavbar() {
   const { user, isLoading } = useAuth();
   const [isMenuOpen, setIsMenuOpen] = useState(false);
   const tNav = useTranslations("navigation");
   const tHome = useTranslations("home");
-  const tCommon = useTranslations("common");
-  const appName = tCommon("appName");
+  const appName = APP_NAME;
   const navigationItems = [
     { name: "features", href: "/features" },
     { name: "pricing", href: "/pricing" },

package/dist/components/app/misc/ThemeToggle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThemeToggle.d.ts","sourceRoot":"","sources":["../../../../src/components/app/misc/ThemeToggle.tsx"],"names":[],"mappings":"AAiBA,wBAAgB,WAAW,4CAmH1B"}
+{"version":3,"file":"ThemeToggle.d.ts","sourceRoot":"","sources":["../../../../src/components/app/misc/ThemeToggle.tsx"],"names":[],"mappings":"AAiBA,wBAAgB,WAAW,4CA4H1B"}

package/dist/components/app/misc/ThemeToggle.js

@@ -14,7 +14,7 @@ import { createAriaLabel, sel } from "../../../lib/test/index.js";
 import { useTranslations } from "next-intl";
 import { useAuth } from "../../../hooks/useAuth.js";
 function ThemeToggle() {
-  const { setTheme, theme } = useTheme();
+  const { setTheme, theme, forcedTheme } = useTheme();
   const { user } = useAuth();
   const [mounted, setMounted] = useState(false);
   const [statusMessage, setStatusMessage] = useState("");
@@ -50,6 +50,9 @@ function ThemeToggle() {
       }
     }
   }, [setTheme, t, user]);
+  if (forcedTheme) {
+    return null;
+  }
   if (!mounted) {
     return /* @__PURE__ */ jsxs(
       Button,

package/dist/components/auth/DevKeyring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DevKeyring.d.ts","sourceRoot":"","sources":["../../../src/components/auth/DevKeyring.tsx"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,wBAAwB,CAAA;AAE9E,UAAU,eAAe;IACvB,0CAA0C;IAC1C,MAAM,EAAE,gBAAgB,CAAA;CACzB;AA2GD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,2CA+HrD"}
+{"version":3,"file":"DevKeyring.d.ts","sourceRoot":"","sources":["../../../src/components/auth/DevKeyring.tsx"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,wBAAwB,CAAA;AAE9E,UAAU,eAAe;IACvB,0CAA0C;IAC1C,MAAM,EAAE,gBAAgB,CAAA;CACzB;AA2GD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,2CAwIrD"}

package/dist/components/auth/DevKeyring.js

@@ -88,11 +88,19 @@ function DevKeyring({ config }) {
   if (!(config == null ? void 0 : config.enabled) || !((_a = config.users) == null ? void 0 : _a.length)) return null;
   const fillForm = useCallback((email, password) => {
     const showEmailButton = document.querySelector('[data-cy="login-show-email"]');
+    const usePasswordToggle = () => {
+      var _a2;
+      return (_a2 = document.querySelector('[data-cy="login-use-password"]')) == null ? void 0 : _a2.click();
+    };
     if (showEmailButton) {
       showEmailButton.click();
-      setTimeout(() => fillInputs(email, password), 100);
+      setTimeout(() => {
+        usePasswordToggle();
+        setTimeout(() => fillInputs(email, password), 50);
+      }, 100);
     } else {
-      fillInputs(email, password);
+      usePasswordToggle();
+      setTimeout(() => fillInputs(email, password), 50);
     }
     setIsOpen(false);
   }, []);

package/dist/components/auth/SessionCookieRefresher.d.ts

@@ -0,0 +1,21 @@
+import { type UseSessionCookieRefreshOptions } from '../../hooks/useSessionCookieRefresh';
+/**
+ * Drop-in client component that keeps the session cookie renewed for
+ * installed PWAs / long-lived tabs. Renders nothing.
+ *
+ * The root layout template mounts it once; it re-issues the session cookie
+ * through Better Auth's `get-session` Route Handler on app open, when the tab
+ * becomes visible again and when the device comes back online. See
+ * `useSessionCookieRefresh` for the options and `lib/auth/session-refresh.ts`
+ * for why render-time session reads cannot do this themselves.
+ *
+ * @example
+ * ```tsx
+ * // app/layout.tsx
+ * <SessionCookieRefresher />
+ * // or, for a theme with 90-day sessions that only wants a daily check:
+ * <SessionCookieRefresher minIntervalMs={24 * 60 * 60 * 1000} />
+ * ```
+ */
+export declare function SessionCookieRefresher(props?: UseSessionCookieRefreshOptions): any;
+//# sourceMappingURL=SessionCookieRefresher.d.ts.map

package/dist/components/auth/SessionCookieRefresher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionCookieRefresher.d.ts","sourceRoot":"","sources":["../../../src/components/auth/SessionCookieRefresher.tsx"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,qCAAqC,CAAA;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,GAAE,8BAAmC,OAGhF"}

package/dist/components/auth/SessionCookieRefresher.js

@@ -0,0 +1,11 @@
+"use client";
+import {
+  useSessionCookieRefresh
+} from "../../hooks/useSessionCookieRefresh.js";
+function SessionCookieRefresher(props = {}) {
+  useSessionCookieRefresh(props);
+  return null;
+}
+export {
+  SessionCookieRefresher
+};

package/dist/components/auth/forms/LoginForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginForm.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/forms/LoginForm.tsx"],"names":[],"mappings":"AAqGA,wBAAgB,SAAS,4CA6YxB"}
+{"version":3,"file":"LoginForm.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/forms/LoginForm.tsx"],"names":[],"mappings":"AAmIA,wBAAgB,SAAS,4CAisBxB"}

package/dist/components/auth/forms/LoginForm.js

@@ -16,16 +16,28 @@ import { Checkbox } from "../../ui/checkbox.js";
 import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "../../ui/card.js";
 import { Separator } from "../../ui/separator.js";
 import { LastUsedBadge } from "../../ui/last-used-badge.js";
-import { Mail, Lock, Loader2, AlertCircle, Users } from "lucide-react";
+import { Mail, Lock, Loader2, AlertCircle, Users, KeyRound } from "lucide-react";
 import { GoogleIcon } from "../../ui/google-icon.js";
 import { sel } from "../../../lib/test/index.js";
 import { useTranslations } from "next-intl";
 import { AuthTranslationPreloader } from "../../../lib/i18n/AuthTranslationPreloader.js";
 import { DevKeyring } from "../DevKeyring.js";
 import { DEV_CONFIG, PUBLIC_AUTH_CONFIG } from "../../../lib/config/config-sync.js";
+import { getPrimaryEmailMethod } from "../../../lib/auth/auth-methods.js";
 function getErrorMessageFromCode(error, t, context) {
   const authError = error;
   const errorCode = authError.code || getErrorCodeFromMessage(error.message);
+  if (context === "otp") {
+    const lower = (error.message || "").toLowerCase();
+    if (lower.includes("expired")) return t("login.errors.otpExpired", { defaultValue: error.message });
+    if (lower.includes("too many") || lower.includes("rate") || lower.includes("attempts")) {
+      return t("login.errors.otpTooMany", { defaultValue: error.message });
+    }
+    if (lower.includes("invalid") || lower.includes("otp") || lower.includes("code")) {
+      return t("login.errors.otpInvalid", { defaultValue: error.message });
+    }
+    return error.message || t("login.messages.otpVerifyFailed");
+  }
   const baseKey = context === "email" ? "login.errors" : "login.errors.google";
   switch (errorCode) {
     case "INVALID_CREDENTIALS":
@@ -82,22 +94,48 @@ function buildLoginSchema(t) {
     password: z.string().min(6, t("login.errors.passwordTooShort", { defaultValue: "Password must be at least 6 characters" }))
   });
 }
+const OTP_CODE_LENGTH = 6;
+function buildOtpEmailSchema(t) {
+  return z.string().trim().email({ message: t("login.errors.invalidEmail", { defaultValue: "Invalid email" }) });
+}
+function buildOtpCodeSchema(t) {
+  return z.string().trim().regex(new RegExp(`^\\d{${OTP_CODE_LENGTH}}$`), {
+    message: t("login.errors.otpInvalidCode", { defaultValue: `Enter the ${OTP_CODE_LENGTH}-digit code` })
+  });
+}
 function LoginForm() {
   var _a, _b, _c;
   const registrationMode = PUBLIC_AUTH_CONFIG.registration.mode;
   const googleEnabled = PUBLIC_AUTH_CONFIG.providers.google.enabled;
-  const signupVisible = registrationMode === "open" || registrationMode === "domain-open";
+  const methods = PUBLIC_AUTH_CONFIG.methods;
+  const otpEnabled = methods.includes("email-otp");
   const devKeyringActive = process.env.NODE_ENV !== "production" && !!((_b = (_a = DEV_CONFIG) == null ? void 0 : _a.devKeyring) == null ? void 0 : _b.enabled);
-  const emailLoginAllowed = registrationMode !== "domain-restricted" || devKeyringActive;
+  const passwordEnabled = methods.includes("email-password") || devKeyringActive;
+  const signupVisible = (registrationMode === "open" || registrationMode === "domain-open") && methods.includes("email-password");
+  const emailLoginAllowed = (registrationMode !== "domain-restricted" || devKeyringActive) && (otpEnabled || passwordEnabled);
+  const primaryEmailMode = (() => {
+    const primary = getPrimaryEmailMethod(methods);
+    if (primary === "email-otp" && otpEnabled) return "otp";
+    if (primary === "email-password") return "password";
+    return otpEnabled ? "otp" : "password";
+  })();
   const [loadingProvider, setLoadingProvider] = useState(null);
   const [error, setError] = useState(null);
   const [statusMessage, setStatusMessage] = useState("");
   const [showEmailForm, setShowEmailForm] = useState(!googleEnabled);
+  const [emailMode, setEmailMode] = useState(primaryEmailMode);
+  const [otpStep, setOtpStep] = useState("email");
+  const [otpEmail, setOtpEmail] = useState("");
+  const [otpCode, setOtpCode] = useState("");
+  const [otpEmailError, setOtpEmailError] = useState(null);
+  const [otpCodeError, setOtpCodeError] = useState(null);
   const isProcessingRef = useRef(false);
-  const { signIn, googleSignIn } = useAuth();
+  const { signIn, googleSignIn, sendOtp, signInWithOtp } = useAuth();
   const { lastMethod, isReady } = useLastAuthMethod();
   const t = useTranslations("auth");
   const loginSchema = useMemo(() => buildLoginSchema(t), [t]);
+  const otpEmailSchema = useMemo(() => buildOtpEmailSchema(t), [t]);
+  const otpCodeSchema = useMemo(() => buildOtpCodeSchema(t), [t]);
   const searchParams = useSearchParams();
   const inviteEmail = searchParams.get("email");
   const fromInvite = searchParams.get("fromInvite") === "true";
@@ -105,8 +143,75 @@ function LoginForm() {
   useEffect(() => {
     if (fromInvite && inviteEmail) {
       setShowEmailForm(true);
+      setOtpEmail(inviteEmail);
     }
   }, [fromInvite, inviteEmail]);
+  const switchEmailMode = useCallback((mode) => {
+    setEmailMode(mode);
+    setError(null);
+    setOtpEmailError(null);
+    setOtpCodeError(null);
+    setOtpStep("email");
+    setOtpCode("");
+  }, []);
+  const handleSendOtp = useCallback(async (event) => {
+    var _a2;
+    event == null ? void 0 : event.preventDefault();
+    if (loadingProvider) return;
+    const parsed = otpEmailSchema.safeParse(otpEmail);
+    if (!parsed.success) {
+      setOtpEmailError(((_a2 = parsed.error.issues[0]) == null ? void 0 : _a2.message) ?? t("login.errors.invalidEmail"));
+      return;
+    }
+    setOtpEmailError(null);
+    setOtpCodeError(null);
+    setError(null);
+    setLoadingProvider("email");
+    setStatusMessage(t("login.messages.otpSending"));
+    try {
+      await sendOtp(parsed.data);
+      setOtpEmail(parsed.data);
+      setOtpCode("");
+      setOtpStep("code");
+      setStatusMessage(t("login.messages.otpSent"));
+    } catch (err) {
+      const error2 = err instanceof Error ? err : new Error(t("login.messages.otpSendFailed"));
+      const errorMessage = error2.message || t("login.messages.otpSendFailed");
+      setError(errorMessage);
+      setStatusMessage(t("login.messages.signInError", { error: errorMessage }));
+    } finally {
+      setLoadingProvider(null);
+    }
+  }, [loadingProvider, otpEmail, otpEmailSchema, sendOtp, t]);
+  const handleVerifyOtp = useCallback(async (event) => {
+    var _a2;
+    event == null ? void 0 : event.preventDefault();
+    if (loadingProvider) return;
+    const parsed = otpCodeSchema.safeParse(otpCode);
+    if (!parsed.success) {
+      setOtpCodeError(((_a2 = parsed.error.issues[0]) == null ? void 0 : _a2.message) ?? t("login.errors.otpInvalidCode"));
+      return;
+    }
+    setOtpCodeError(null);
+    setError(null);
+    setLoadingProvider("email");
+    setStatusMessage(t("login.messages.otpVerifying"));
+    try {
+      await signInWithOtp({
+        email: otpEmail,
+        otp: parsed.data,
+        redirectTo: callbackUrl || void 0
+      });
+      setStatusMessage(t("login.messages.signInSuccess"));
+    } catch (err) {
+      const error2 = err instanceof Error ? err : new Error(t("login.messages.otpVerifyFailed"));
+      const errorMessage = getErrorMessageFromCode(error2, t, "otp");
+      setError(errorMessage);
+      setStatusMessage(t("login.messages.signInError", { error: errorMessage }));
+    } finally {
+      setLoadingProvider(null);
+    }
+  }, [loadingProvider, otpCode, otpCodeSchema, otpEmail, signInWithOtp, callbackUrl, t]);
   const {
     register,
     handleSubmit,
@@ -258,11 +363,189 @@ function LoginForm() {
               }
             ) }),
             showEmailForm && emailLoginAllowed && /* @__PURE__ */ jsxs(Fragment, { children: [
-              /* @__PURE__ */ jsxs("div", { className: "relative my-6", children: [
+              googleEnabled && /* @__PURE__ */ jsxs("div", { className: "relative my-6", children: [
                 /* @__PURE__ */ jsx("div", { className: "absolute inset-0 flex items-center", children: /* @__PURE__ */ jsx(Separator, { className: "w-full" }) }),
                 /* @__PURE__ */ jsx("div", { className: "relative flex justify-center text-xs uppercase", children: /* @__PURE__ */ jsx("span", { className: "bg-background px-2 text-muted-foreground", children: t("login.form.orContinueWith") }) })
               ] }),
-              /* @__PURE__ */ jsxs(
+              emailMode === "otp" && otpEnabled && /* @__PURE__ */ jsxs(
+                "form",
+                {
+                  onSubmit: otpStep === "email" ? handleSendOtp : handleVerifyOtp,
+                  className: "space-y-4",
+                  "aria-labelledby": "login-heading",
+                  noValidate: true,
+                  "data-cy": sel("auth.login.otpForm"),
+                  children: [
+                    otpStep === "email" ? /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+                      /* @__PURE__ */ jsx(Label, { htmlFor: "otp-email", children: t("login.form.email") }),
+                      /* @__PURE__ */ jsxs("div", { className: "relative", children: [
+                        /* @__PURE__ */ jsx(Mail, { className: "absolute left-3 top-3 h-4 w-4 text-muted-foreground", "aria-hidden": "true" }),
+                        /* @__PURE__ */ jsx(
+                          Input,
+                          {
+                            id: "otp-email",
+                            type: "email",
+                            autoComplete: "email",
+                            inputMode: "email",
+                            value: otpEmail,
+                            onChange: (e) => setOtpEmail(e.target.value),
+                            placeholder: t("login.form.emailPlaceholder"),
+                            className: `pl-9 ${fromInvite ? "bg-muted cursor-not-allowed" : ""}`,
+                            readOnly: fromInvite,
+                            "aria-required": "true",
+                            "aria-describedby": otpEmailError ? "otp-email-error" : "otp-email-help",
+                            "aria-invalid": otpEmailError ? "true" : "false",
+                            "data-cy": sel("auth.login.otpEmailInput")
+                          }
+                        )
+                      ] }),
+                      /* @__PURE__ */ jsx("p", { id: "otp-email-help", className: "text-xs text-muted-foreground", children: t("login.form.otp.emailHelp") }),
+                      otpEmailError && /* @__PURE__ */ jsx(
+                        "p",
+                        {
+                          id: "otp-email-error",
+                          className: "text-sm text-destructive",
+                          role: "alert",
+                          "aria-live": "assertive",
+                          "data-cy": sel("auth.login.otpEmailError"),
+                          children: otpEmailError
+                        }
+                      )
+                    ] }) : /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+                      /* @__PURE__ */ jsxs(Alert, { "data-cy": sel("auth.login.otpSentNotice"), children: [
+                        /* @__PURE__ */ jsx(Mail, { className: "h-4 w-4", "aria-hidden": "true" }),
+                        /* @__PURE__ */ jsx(AlertDescription, { children: t("login.form.otp.codeSent", { email: otpEmail }) })
+                      ] }),
+                      /* @__PURE__ */ jsx(Label, { htmlFor: "otp-code", children: t("login.form.otp.codeLabel") }),
+                      /* @__PURE__ */ jsxs("div", { className: "relative", children: [
+                        /* @__PURE__ */ jsx(KeyRound, { className: "absolute left-3 top-3 h-4 w-4 text-muted-foreground", "aria-hidden": "true" }),
+                        /* @__PURE__ */ jsx(
+                          Input,
+                          {
+                            id: "otp-code",
+                            type: "text",
+                            inputMode: "numeric",
+                            autoComplete: "one-time-code",
+                            pattern: "[0-9]*",
+                            maxLength: OTP_CODE_LENGTH,
+                            value: otpCode,
+                            onChange: (e) => setOtpCode(e.target.value.replace(/\D/g, "").slice(0, OTP_CODE_LENGTH)),
+                            placeholder: t("login.form.otp.codePlaceholder"),
+                            className: "pl-9 tracking-widest",
+                            autoFocus: true,
+                            "aria-required": "true",
+                            "aria-describedby": otpCodeError ? "otp-code-error" : void 0,
+                            "aria-invalid": otpCodeError ? "true" : "false",
+                            "data-cy": sel("auth.login.otpCodeInput")
+                          }
+                        )
+                      ] }),
+                      otpCodeError && /* @__PURE__ */ jsx(
+                        "p",
+                        {
+                          id: "otp-code-error",
+                          className: "text-sm text-destructive",
+                          role: "alert",
+                          "aria-live": "assertive",
+                          "data-cy": sel("auth.login.otpCodeError"),
+                          children: otpCodeError
+                        }
+                      )
+                    ] }),
+                    error && /* @__PURE__ */ jsxs(
+                      Alert,
+                      {
+                        variant: "destructive",
+                        role: "alert",
+                        "aria-live": "assertive",
+                        "data-cy": sel("auth.login.errorAlert"),
+                        children: [
+                          /* @__PURE__ */ jsx(AlertCircle, { className: "h-4 w-4", "aria-hidden": "true" }),
+                          /* @__PURE__ */ jsx(AlertDescription, { children: error })
+                        ]
+                      }
+                    ),
+                    otpStep === "email" ? /* @__PURE__ */ jsx(
+                      Button,
+                      {
+                        type: "submit",
+                        disabled: !!loadingProvider,
+                        className: "w-full",
+                        "data-cy": sel("auth.login.otpSend"),
+                        children: loadingProvider === "email" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+                          /* @__PURE__ */ jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin", "aria-hidden": "true" }),
+                          t("login.form.otp.sendingCode")
+                        ] }) : t("login.form.otp.sendCode")
+                      }
+                    ) : /* @__PURE__ */ jsxs(Fragment, { children: [
+                      /* @__PURE__ */ jsx(
+                        Button,
+                        {
+                          type: "submit",
+                          disabled: !!loadingProvider,
+                          className: "w-full",
+                          "data-cy": sel("auth.login.otpSubmit"),
+                          children: loadingProvider === "email" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+                            /* @__PURE__ */ jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin", "aria-hidden": "true" }),
+                            t("login.form.otp.verifyingCode")
+                          ] }) : t("login.form.otp.verifyCode")
+                        }
+                      ),
+                      /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between text-sm", children: [
+                        /* @__PURE__ */ jsx(
+                          "button",
+                          {
+                            type: "button",
+                            onClick: () => void handleSendOtp(),
+                            disabled: !!loadingProvider,
+                            className: "text-primary hover:underline focus:outline-none focus:ring-2 focus:ring-accent disabled:opacity-50 min-h-[44px] inline-flex items-center",
+                            "data-cy": sel("auth.login.otpResend"),
+                            children: t("login.form.otp.resendCode")
+                          }
+                        ),
+                        /* @__PURE__ */ jsx(
+                          "button",
+                          {
+                            type: "button",
+                            onClick: () => {
+                              setOtpStep("email");
+                              setOtpCode("");
+                              setOtpCodeError(null);
+                              setError(null);
+                            },
+                            disabled: !!loadingProvider,
+                            className: "text-muted-foreground hover:text-primary focus:outline-none focus:ring-2 focus:ring-accent disabled:opacity-50 min-h-[44px] inline-flex items-center",
+                            "data-cy": sel("auth.login.otpChangeEmail"),
+                            children: t("login.form.otp.changeEmail")
+                          }
+                        )
+                      ] })
+                    ] }),
+                    passwordEnabled && /* @__PURE__ */ jsx("div", { className: "text-center", children: /* @__PURE__ */ jsx(
+                      "button",
+                      {
+                        type: "button",
+                        onClick: () => switchEmailMode("password"),
+                        disabled: !!loadingProvider,
+                        className: "text-sm text-muted-foreground hover:text-primary focus:outline-none focus:ring-2 focus:ring-accent min-h-[44px] inline-flex items-center",
+                        "data-cy": sel("auth.login.usePassword"),
+                        children: t("login.form.usePassword")
+                      }
+                    ) }),
+                    googleEnabled && /* @__PURE__ */ jsx("div", { className: "text-center", children: /* @__PURE__ */ jsx(
+                      "button",
+                      {
+                        type: "button",
+                        onClick: () => setShowEmailForm(false),
+                        className: "text-sm text-muted-foreground hover:text-primary focus:outline-none focus:ring-2 focus:ring-accent min-h-[44px] inline-flex items-center",
+                        "data-cy": sel("auth.login.hideEmail"),
+                        children: t("login.form.backToGoogle", { defaultValue: "Back to main options" })
+                      }
+                    ) })
+                  ]
+                }
+              ),
+              (emailMode === "password" || !otpEnabled) && passwordEnabled && /* @__PURE__ */ jsxs(
                 "form",
                 {
                   onSubmit: handleSubmit(onSubmit),
@@ -411,6 +694,17 @@ function LoginForm() {
                       }
                     ),
                     /* @__PURE__ */ jsx("div", { id: "submit-help", className: "sr-only", children: t("login.form.submitHelp") }),
+                    otpEnabled && /* @__PURE__ */ jsx("div", { className: "text-center mt-4", children: /* @__PURE__ */ jsx(
+                      "button",
+                      {
+                        type: "button",
+                        onClick: () => switchEmailMode("otp"),
+                        disabled: !!loadingProvider,
+                        className: "text-sm text-muted-foreground hover:text-primary focus:outline-none focus:ring-2 focus:ring-accent min-h-[44px] inline-flex items-center",
+                        "data-cy": sel("auth.login.useOtp"),
+                        children: t("login.form.useOtp")
+                      }
+                    ) }),
                     googleEnabled && /* @__PURE__ */ jsx("div", { className: "text-center mt-4", children: /* @__PURE__ */ jsx(
                       "button",
                       {

package/dist/components/auth/index.d.ts

@@ -7,5 +7,6 @@ export { LoginForm } from './forms/LoginForm';
 export { SignupForm } from './forms/SignupForm';
 export { AuthWrapper } from './layouts/AuthWrapper';
 export { AuthWrapperWithPreload } from './layouts/AuthWrapperWithPreload';
+export { SessionCookieRefresher } from './SessionCookieRefresher';
 export { DevKeyring } from './DevKeyring';
 //# sourceMappingURL=index.d.ts.map

package/dist/components/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAGzE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAGzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAGjE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA"}

package/dist/components/auth/index.js

@@ -2,11 +2,13 @@ import { LoginForm } from "./forms/LoginForm.js";
 import { SignupForm } from "./forms/SignupForm.js";
 import { AuthWrapper } from "./layouts/AuthWrapper.js";
 import { AuthWrapperWithPreload } from "./layouts/AuthWrapperWithPreload.js";
+import { SessionCookieRefresher } from "./SessionCookieRefresher.js";
 import { DevKeyring } from "./DevKeyring.js";
 export {
   AuthWrapper,
   AuthWrapperWithPreload,
   DevKeyring,
   LoginForm,
+  SessionCookieRefresher,
   SignupForm
 };

package/dist/components/billing/InvoicesTable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InvoicesTable.d.ts","sourceRoot":"","sources":["../../../src/components/billing/InvoicesTable.tsx"],"names":[],"mappings":"AAaA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAI7E,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,aAAa,EAAE,MAAM,CAAA;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACrC;AAED,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,SAAiB,EACjB,KAAK,EACL,KAAK,EACL,MAAM,EACN,YAAY,GACb,EAAE,kBAAkB,2CA+HpB"}
+{"version":3,"file":"InvoicesTable.d.ts","sourceRoot":"","sources":["../../../src/components/billing/InvoicesTable.tsx"],"names":[],"mappings":"AAaA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAI7E,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,aAAa,EAAE,MAAM,CAAA;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACrC;AAED,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,SAAiB,EACjB,KAAK,EACL,KAAK,EACL,MAAM,EACN,YAAY,GACb,EAAE,kBAAkB,2CAiIpB"}