@nextsparkjs/core 0.1.0-beta.187 → 0.1.0-beta.189

package/dist/lib/api/keys.js

@@ -70,30 +70,30 @@ class ApiKeyManager {
 }
 const API_SCOPES = {
   // Usuarios
-  "users:read": "Leer informaci\xF3n de usuarios",
-  "users:write": "Crear y actualizar usuarios",
-  "users:delete": "Eliminar usuarios",
+  "users:read": "Read user information",
+  "users:write": "Create and update users",
+  "users:delete": "Delete users",
   // Tasks
-  "tasks:read": "Leer tasks",
-  "tasks:write": "Crear y actualizar tasks",
-  "tasks:delete": "Eliminar tasks",
+  "tasks:read": "Read tasks",
+  "tasks:write": "Create and update tasks",
+  "tasks:delete": "Delete tasks",
   // Media (archivos, imágenes, videos)
-  "media:read": "Leer informaci\xF3n de archivos y media",
-  "media:write": "Subir y actualizar archivos",
-  "media:delete": "Eliminar archivos",
+  "media:read": "Read file and media information",
+  "media:write": "Upload and update files",
+  "media:delete": "Delete files",
   // Teams (equipos, miembros e invitaciones)
-  "teams:read": "Leer equipos, miembros e invitaciones",
-  "teams:write": "Crear y actualizar equipos, miembros e invitaciones",
-  "teams:delete": "Eliminar equipos",
+  "teams:read": "Read teams, members and invitations",
+  "teams:write": "Create and update teams, members and invitations",
+  "teams:delete": "Delete teams",
   // Billing (suscripciones, facturas, uso y planes)
-  "billing:read": "Leer suscripciones, facturas y uso",
-  "billing:write": "Gestionar suscripciones, checkout, cambios de plan y uso",
+  "billing:read": "Read subscriptions, invoices and usage",
+  "billing:write": "Manage subscriptions, checkout, plan changes and usage",
   // Administración
-  "admin:api-keys": "Gestionar API keys",
-  "admin:users": "Administraci\xF3n completa de usuarios",
-  "admin:devtools": "Acceso a las APIs de DevTools (registries, testing, scheduled actions)",
+  "admin:api-keys": "Manage API keys",
+  "admin:users": "Full user administration",
+  "admin:devtools": "Access to DevTools APIs (registries, testing, scheduled actions)",
   // Comodín (solo para superadmins)
-  "*": "Acceso completo (solo superadmin)"
+  "*": "Full access (superadmin only)"
 };
 function getApiScopes() {
   var _a;
@@ -108,33 +108,33 @@ function getAppApiScopes() {
 }
 const SCOPE_CATEGORIES = {
   users: {
-    name: "Usuarios",
-    description: "Gesti\xF3n de usuarios del sistema",
+    name: "Users",
+    description: "System user management",
     scopes: ["users:read", "users:write", "users:delete"]
   },
   tasks: {
     name: "Tasks",
-    description: "Gesti\xF3n de tareas y TODOs",
+    description: "Task and TODO management",
     scopes: ["tasks:read", "tasks:write", "tasks:delete"]
   },
   teams: {
     name: "Teams",
-    description: "Equipos, miembros e invitaciones",
+    description: "Teams, members and invitations",
     scopes: ["teams:read", "teams:write", "teams:delete"]
   },
   billing: {
     name: "Billing",
-    description: "Suscripciones, facturas, uso y planes",
+    description: "Subscriptions, invoices, usage and plans",
     scopes: ["billing:read", "billing:write"]
   },
   admin: {
-    name: "Administraci\xF3n",
-    description: "Funciones administrativas",
+    name: "Administration",
+    description: "Administrative functions",
     scopes: ["admin:api-keys", "admin:users", "admin:devtools"]
   },
   system: {
-    name: "Sistema",
-    description: "Acceso completo al sistema",
+    name: "System",
+    description: "Full system access",
     scopes: ["*"]
   }
 };

package/dist/lib/auth/callback-url.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Callback URL
+ *
+ * Where sign-in sends the user afterwards. `callbackUrl` arrives in the login
+ * URL, where anyone can write it, so only a path on this app counts: `//host`,
+ * `/\host` or an absolute URL would take the user to another site right after
+ * they authenticate.
+ */
+/** The path, query and hash of an in-app callback, or null for anything else. */
+export declare function safeCallbackPath(value: string | null | undefined): string | null;
+//# sourceMappingURL=callback-url.d.ts.map

package/dist/lib/auth/callback-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-url.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/callback-url.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAWhF"}

package/dist/lib/auth/callback-url.js

@@ -0,0 +1,14 @@
+const PLACEHOLDER_ORIGIN = "http://callback.invalid";
+function safeCallbackPath(value) {
+  if (!value || !value.startsWith("/")) return null;
+  try {
+    const url = new URL(value, PLACEHOLDER_ORIGIN);
+    const path = `${url.pathname}${url.search}${url.hash}`;
+    return url.origin === PLACEHOLDER_ORIGIN && !path.startsWith("//") ? path : null;
+  } catch {
+    return null;
+  }
+}
+export {
+  safeCallbackPath
+};

package/dist/lib/auth/otp-config.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Email OTP Config Resolution
+ *
+ * Turns the (optional, partially specified) `auth.otp` block of the merged app
+ * config into the concrete values handed to Better Auth's emailOTP plugin. Pure
+ * function — no side effects besides a `console.warn` on invalid input — so it
+ * is safe to import from client code too.
+ *
+ * Both numbers are read by the server (the plugin) and by the login form (the
+ * notice that counts the code down, and the length the input accepts). They
+ * live here so the two agree by construction: a duplicated literal is how the
+ * UI ends up promising five minutes for a code that lasts two.
+ *
+ * Resolution rules:
+ * - Every field falls back to the core default when missing.
+ * - Non-positive / non-finite values are rejected (warning) → default.
+ * - `otpLength` is additionally bounded to what Better Auth can generate.
+ */
+import type { AuthConfig } from '../config/types';
+export interface ResolvedOtpConfig {
+    /** Lifetime of an emailed code, in seconds. */
+    expiresIn: number;
+    /** Number of digits in an emailed code. */
+    otpLength: number;
+}
+export declare const DEFAULT_OTP_CONFIG: ResolvedOtpConfig;
+/**
+ * Resolve the email-OTP configuration the app runs with.
+ *
+ * @param authConfig - The merged `auth` config (core defaults + theme overrides).
+ *                     Only its `otp` block is read; `undefined`/`null` is
+ *                     allowed and yields the defaults.
+ */
+export declare function resolveOtpConfig(authConfig?: Pick<AuthConfig, 'otp'> | null): ResolvedOtpConfig;
+/**
+ * Seconds left before a code sent at `sentAt` expires, between 0 and the code's
+ * lifetime: a clock set back after the request would otherwise count more time
+ * than the server gives the code.
+ *
+ * @param sentAt - Epoch milliseconds of the moment the code was requested.
+ * @param expiresIn - Code lifetime in seconds.
+ * @param now - Epoch milliseconds to measure against (injectable for tests).
+ */
+export declare function getOtpSecondsRemaining(sentAt: number, expiresIn: number, now?: number): number;
+/**
+ * Format a remaining-seconds count as `m:ss`, always with both parts so the
+ * value reads as a duration on its own (a bare "45" needs a unit the
+ * surrounding sentence does not supply).
+ *
+ * Digits and a colon read the same in every locale this ships with, so the
+ * value can be interpolated into a translated sentence without each locale
+ * owning a time format.
+ */
+export declare function formatOtpCountdown(secondsRemaining: number): string;
+//# sourceMappingURL=otp-config.d.ts.map

package/dist/lib/auth/otp-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp-config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/otp-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,iBAAiB,CAAA;AAEhE,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,kBAAkB,EAAE,iBAGhC,CAAA;AA2BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,IAAI,GAC1C,iBAAiB,CAcnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAmB,GACvB,MAAM,CAGR;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAKnE"}

package/dist/lib/auth/otp-config.js

@@ -0,0 +1,48 @@
+const DEFAULT_OTP_CONFIG = {
+  expiresIn: 60 * 5,
+  // 5 minutes
+  otpLength: 6
+};
+const MIN_OTP_LENGTH = 4;
+const MAX_OTP_LENGTH = 10;
+function isPositiveNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function resolveNumber(value, fallback, field) {
+  if (value === void 0) return fallback;
+  if (!isPositiveNumber(value) || Math.floor(value) < 1) {
+    console.warn(
+      `[Auth] Ignoring invalid auth.otp.${field} (${String(value)}); using default ${fallback}`
+    );
+    return fallback;
+  }
+  return Math.floor(value);
+}
+function resolveOtpConfig(authConfig) {
+  const cfg = (authConfig == null ? void 0 : authConfig.otp) ?? {};
+  const expiresIn = resolveNumber(cfg.expiresIn, DEFAULT_OTP_CONFIG.expiresIn, "expiresIn");
+  let otpLength = resolveNumber(cfg.otpLength, DEFAULT_OTP_CONFIG.otpLength, "otpLength");
+  if (otpLength < MIN_OTP_LENGTH || otpLength > MAX_OTP_LENGTH) {
+    console.warn(
+      `[Auth] auth.otp.otpLength (${otpLength}) is outside ${MIN_OTP_LENGTH}-${MAX_OTP_LENGTH}; using default ${DEFAULT_OTP_CONFIG.otpLength}`
+    );
+    otpLength = DEFAULT_OTP_CONFIG.otpLength;
+  }
+  return { expiresIn, otpLength };
+}
+function getOtpSecondsRemaining(sentAt, expiresIn, now = Date.now()) {
+  const elapsed = Math.floor((now - sentAt) / 1e3);
+  return Math.min(expiresIn, Math.max(0, expiresIn - elapsed));
+}
+function formatOtpCountdown(secondsRemaining) {
+  const total = Math.max(0, Math.floor(secondsRemaining));
+  const minutes = Math.floor(total / 60);
+  const seconds = total % 60;
+  return `${minutes}:${String(seconds).padStart(2, "0")}`;
+}
+export {
+  DEFAULT_OTP_CONFIG,
+  formatOtpCountdown,
+  getOtpSecondsRemaining,
+  resolveOtpConfig
+};

package/dist/lib/auth/registration-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration-helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/registration-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAGrF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAShF;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAKnE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAKzE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEnE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,OAAO,GACf,OAAO,CAGT;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEnE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,gBAAgB,CAY5E"}
+{"version":3,"file":"registration-helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/registration-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAIrF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAShF;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAKnE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAKzE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEnE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,OAAO,GACf,OAAO,CAGT;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEnE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,gBAAgB,CAa5E"}

package/dist/lib/auth/registration-helpers.js

@@ -1,4 +1,5 @@
 import { resolveAuthMethods } from "./auth-methods.js";
+import { resolveOtpConfig } from "./otp-config.js";
 function isRegistrationOpen(mode) {
   return mode === "open" || mode === "domain-open";
 }
@@ -41,7 +42,8 @@ function getPublicAuthConfig(authConfig) {
         enabled: isGoogleAuthEnabled(authConfig)
       }
     },
-    methods: resolveAuthMethods(authConfig)
+    methods: resolveAuthMethods(authConfig),
+    otp: resolveOtpConfig(authConfig)
   };
 }
 export {

package/dist/lib/auth/session-hint.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Session Hint
+ *
+ * Better Auth's session cookie is httpOnly, so client code cannot tell whether a
+ * visitor is signed in without asking the server. This readable cookie records
+ * whether the browser carries a session, and public pages ask for the session
+ * only when it says so: an anonymous visitor makes no session request. The proxy
+ * keeps it in line with the session cookie on every request, and client code
+ * updates it on sign-in, sign-out and each session it reads. It is a hint, never
+ * proof of anything: a stale one costs a single request that finds no session.
+ */
+export declare const SESSION_HINT_COOKIE = "nextspark.signed_in";
+/** As long as browsers keep a cookie: longer than any session. */
+export declare const SESSION_HINT_MAX_AGE: number;
+/**
+ * Whether a Cookie header carries Better Auth's session cookie. It says nothing
+ * about whether that session is still valid, only that there may be one to read.
+ */
+export declare function hasSessionCookie(cookieHeader: string | null | undefined): boolean;
+/** Whether this browser was signed in when client code last looked. */
+export declare function hasSessionHint(): boolean;
+/** Record whether this browser is signed in. */
+export declare function setSessionHint(signedIn: boolean): void;
+/**
+ * Call `onChange` whenever the hint may have changed: client code set it (a
+ * sign-in or sign-out on this page), or the tab comes back into view, after
+ * responses the proxy answered may have set it. Returns the function that stops
+ * listening. Its shape fits React's useSyncExternalStore.
+ */
+export declare function subscribeSessionHint(onChange: () => void): () => void;
+//# sourceMappingURL=session-hint.d.ts.map

package/dist/lib/auth/session-hint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-hint.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/session-hint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,QAAqB,CAAA;AAKtD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEjF;AAED,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAKD,gDAAgD;AAChD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAOtD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAUrE"}

package/dist/lib/auth/session-hint.js

@@ -0,0 +1,37 @@
+const SESSION_HINT_COOKIE = "nextspark.signed_in";
+const SESSION_HINT_MAX_AGE = 60 * 60 * 24 * 400;
+const SESSION_COOKIE = /(?:^|;\s*)(?:__Secure-)?better-auth[.-]session_token=[^;\s]/;
+function hasSessionCookie(cookieHeader) {
+  return SESSION_COOKIE.test(cookieHeader ?? "");
+}
+function hasSessionHint() {
+  if (typeof document === "undefined") return false;
+  return document.cookie.split(";").some((part) => part.trim() === `${SESSION_HINT_COOKIE}=1`);
+}
+const SESSION_HINT_CHANGE_EVENT = "nextspark:session-hint-change";
+function setSessionHint(signedIn) {
+  if (typeof document === "undefined" || hasSessionHint() === signedIn) return;
+  const secure = typeof location !== "undefined" && location.protocol === "https:" ? "; Secure" : "";
+  document.cookie = signedIn ? `${SESSION_HINT_COOKIE}=1; Max-Age=${SESSION_HINT_MAX_AGE}; Path=/; SameSite=Lax${secure}` : `${SESSION_HINT_COOKIE}=; Max-Age=0; Path=/; SameSite=Lax${secure}`;
+  window.dispatchEvent(new Event(SESSION_HINT_CHANGE_EVENT));
+}
+function subscribeSessionHint(onChange) {
+  if (typeof window === "undefined") return () => {
+  };
+  window.addEventListener(SESSION_HINT_CHANGE_EVENT, onChange);
+  window.addEventListener("focus", onChange);
+  document.addEventListener("visibilitychange", onChange);
+  return () => {
+    window.removeEventListener(SESSION_HINT_CHANGE_EVENT, onChange);
+    window.removeEventListener("focus", onChange);
+    document.removeEventListener("visibilitychange", onChange);
+  };
+}
+export {
+  SESSION_HINT_COOKIE,
+  SESSION_HINT_MAX_AGE,
+  hasSessionCookie,
+  hasSessionHint,
+  setSessionHint,
+  subscribeSessionHint
+};

package/dist/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAUA,OAAO,EAAgF,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAevH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA+GD,eAAO,MAAM,IAAI,qEAoWf,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,EAAE,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAUA,OAAO,EAAgF,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAgBvH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoHD,eAAO,MAAM,IAAI,qEAqWf,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,EAAE,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B"}

package/dist/lib/auth.js

@@ -16,6 +16,7 @@ import { shouldSkipTeamCreation, getSignupContext } from "./auth-context.js";
 import { isDomainAllowed } from "./auth/registration-helpers.js";
 import { registrationGuardPlugin } from "./auth/registration-guard-plugin.js";
 import { resolveSessionConfig } from "./auth/session-config.js";
+import { resolveOtpConfig } from "./auth/otp-config.js";
 import { isPasswordLoginEnabled } from "./auth/auth-methods.js";
 import { getCorsOrigins, isPrivateLanOrigin, normalizeCorsEnvironment } from "./utils/cors.js";
 async function hasPendingInvitationForEmail(email) {
@@ -45,6 +46,7 @@ const pool = new Pool({
   max: 20
 });
 const sessionConfig = resolveSessionConfig(AUTH_CONFIG);
+const otpConfig = resolveOtpConfig(AUTH_CONFIG);
 function resolveNonOwnerSignupRole() {
   var _a, _b, _c, _d;
   const cfg = AUTH_CONFIG.signupIntent;
@@ -220,13 +222,13 @@ const auth = betterAuth({
           email,
           otp,
           type,
-          appName: process.env.NEXT_PUBLIC_APP_NAME || "Your App"
+          appName: process.env.NEXT_PUBLIC_APP_NAME || "Your App",
+          expiresIn: otpConfig.expiresIn
         }, I18N_CONFIG.defaultLocale);
         await emailService.send({ to: email, ...template });
       },
-      otpLength: 6,
-      expiresIn: 300,
-      // 5 minutes
+      otpLength: otpConfig.otpLength,
+      expiresIn: otpConfig.expiresIn,
       sendVerificationOnSignUp: false,
       disableSignUp: false
       // auto-create user on first OTP sign-in

package/dist/lib/blocks/loader.d.ts

@@ -1,8 +1,9 @@
 /**
  * Block Loader Utility
  *
- * Provides access to lazy-loaded block components from the generated registry.
- * Components are pre-loaded as React.lazy by the registry generator.
+ * Block components behind React.lazy, from the lazy half of the generated
+ * registry, which imports none of them statically. Client components render
+ * blocks through here; server rendering goes through loader.server.ts.
  *
  * @module core/lib/blocks/loader
  */
@@ -22,15 +23,6 @@ export declare function getBlockComponents(): Record<string, BlockComponent>;
  * @returns The block component or undefined if not found
  */
 export declare function getBlockComponent(slug: string): BlockComponent | undefined;
-/**
- * Get all SSR block components (direct imports, no React.lazy)
- * Use for public page rendering where no-JS SSR is required
- */
-export declare function getBlockComponentsSSR(): Record<string, BlockComponent>;
-/**
- * Get a specific SSR block component by slug (direct import, no React.lazy)
- */
-export declare function getBlockComponentSSR(slug: string): BlockComponent | undefined;
 /**
  * Check if a block exists in the registry
  *

package/dist/lib/blocks/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/lib/blocks/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAIrC,KAAK,cAAc,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;AAExC;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAEnE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE1E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAEtE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgD3F"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/lib/blocks/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAIrC,KAAK,cAAc,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;AAExC;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAEnE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgD3F"}

package/dist/lib/blocks/loader.js

@@ -1,16 +1,10 @@
-import { BLOCK_COMPONENTS, BLOCK_COMPONENTS_SSR } from "@nextsparkjs/registries/block-registry";
+import { BLOCK_COMPONENTS } from "@nextsparkjs/registries/block-registry.lazy";
 function getBlockComponents() {
   return BLOCK_COMPONENTS;
 }
 function getBlockComponent(slug) {
   return BLOCK_COMPONENTS[slug];
 }
-function getBlockComponentsSSR() {
-  return BLOCK_COMPONENTS_SSR;
-}
-function getBlockComponentSSR(slug) {
-  return BLOCK_COMPONENTS_SSR[slug];
-}
 function hasBlock(slug) {
   return slug in BLOCK_COMPONENTS;
 }
@@ -54,9 +48,7 @@ function normalizeBlockProps(props) {
 }
 export {
   getBlockComponent,
-  getBlockComponentSSR,
   getBlockComponents,
-  getBlockComponentsSSR,
   hasBlock,
   normalizeBlockProps
 };

package/dist/lib/blocks/loader.server.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Block components for server rendering: direct imports, no React.lazy, so a
+ * public page renders its blocks in the HTML without waiting on client JS.
+ *
+ * They come from block-registry.ts, which imports every block component
+ * statically. A client component that imports this module carries every block
+ * into its bundle, so only server code imports it; client code uses loader.ts.
+ *
+ * @module core/lib/blocks/loader.server
+ */
+import { ComponentType } from 'react';
+type BlockComponent = ComponentType<any>;
+/** Every block component for server rendering, by slug. */
+export declare function getBlockComponentsSSR(): Record<string, BlockComponent>;
+/** A block component for server rendering, or undefined when the slug has none. */
+export declare function getBlockComponentSSR(slug: string): BlockComponent | undefined;
+export {};
+//# sourceMappingURL=loader.server.d.ts.map

package/dist/lib/blocks/loader.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.server.d.ts","sourceRoot":"","sources":["../../../src/lib/blocks/loader.server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAIrC,KAAK,cAAc,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;AAExC,2DAA2D;AAC3D,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAEtE;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE7E"}

package/dist/lib/blocks/loader.server.js

@@ -0,0 +1,11 @@
+import { BLOCK_COMPONENTS_SSR } from "@nextsparkjs/registries/block-registry";
+function getBlockComponentsSSR() {
+  return BLOCK_COMPONENTS_SSR;
+}
+function getBlockComponentSSR(slug) {
+  return BLOCK_COMPONENTS_SSR[slug];
+}
+export {
+  getBlockComponentSSR,
+  getBlockComponentsSSR
+};

package/dist/lib/blocks/sanitize-html.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Sanitising for the HTML a block renders through dangerouslySetInnerHTML.
+ *
+ * Rich-text block fields hold markup on purpose — that is what the editor is
+ * for — so the value cannot simply be escaped. What it can be is restricted to
+ * markup that only formats: an allowlist of tags and attributes, with no event
+ * handlers and no `javascript:` URLs.
+ *
+ * This runs at render, which is where every path meets. Content reaches the
+ * database through the dashboard, the v1 API with an API key, sample data and
+ * whatever a project imports; sanitising at one of those leaves the others, and
+ * leaves whatever is already stored. Note the flip side: what is stored is
+ * still the raw input, so a consumer reading the API directly gets what was
+ * written, not this.
+ *
+ * Not marked server-only, though blocks are server components: devtools
+ * previews a block in the browser, through the lazy half of the block registry,
+ * so this module has to survive being bundled for the client. It does —
+ * sanitize-html parses with htmlparser2, not a DOM — and that preview is the
+ * only route that pays for it.
+ *
+ * @module core/lib/blocks/sanitize-html
+ */
+/**
+ * The HTML of a rich-text block field, reduced to markup that only formats.
+ *
+ * @param html - The stored field value.
+ * @returns Markup safe to hand to dangerouslySetInnerHTML; '' for no input.
+ */
+export declare function sanitizeBlockHtml(html: string | null | undefined): string;
+//# sourceMappingURL=sanitize-html.d.ts.map

package/dist/lib/blocks/sanitize-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-html.d.ts","sourceRoot":"","sources":["../../../src/lib/blocks/sanitize-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAmEH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGzE"}

package/dist/lib/blocks/sanitize-html.js

@@ -0,0 +1,60 @@
+import sanitizeHtmlLib from "sanitize-html";
+const OPTIONS = {
+  allowedTags: [
+    ...sanitizeHtmlLib.defaults.allowedTags,
+    "img",
+    "h1",
+    "h2",
+    "figure",
+    "figcaption",
+    "picture",
+    "source",
+    "del",
+    "ins",
+    "mark",
+    "small",
+    "u"
+  ],
+  allowedAttributes: {
+    ...sanitizeHtmlLib.defaults.allowedAttributes,
+    img: ["src", "srcset", "alt", "title", "width", "height", "loading", "decoding"],
+    source: ["src", "srcset", "type", "media"],
+    a: ["href", "name", "target", "rel", "title"],
+    // The editor writes Tailwind classes into the markup, and dropping them
+    // would strip the formatting the author applied rather than secure it.
+    "*": ["class", "id", "dir", "lang", "style"]
+  },
+  // No `javascript:`, and no `data:` either: an `<a href="data:text/html,…">`
+  // navigates to attacker-authored markup on this origin.
+  allowedSchemes: ["http", "https", "mailto", "tel"],
+  allowedSchemesByTag: { img: ["http", "https", "data"] },
+  // Inline styles survive, but only declarations that cannot script or reach
+  // out: no `url()`, no `expression()`, no `-moz-binding`.
+  allowedStyles: {
+    "*": {
+      color: [/^[^;{}()]*$/],
+      "background-color": [/^[^;{}()]*$/],
+      "text-align": [/^(left|right|center|justify)$/],
+      "font-size": [/^[\d.]+(px|em|rem|%|pt)$/],
+      "font-weight": [/^(normal|bold|lighter|bolder|[1-9]00)$/],
+      "font-style": [/^(normal|italic|oblique)$/],
+      "text-decoration": [/^[a-z\s-]+$/],
+      margin: [/^[\d.\s]+(px|em|rem|%)?$/],
+      padding: [/^[\d.\s]+(px|em|rem|%)?$/],
+      width: [/^[\d.]+(px|em|rem|%)$/],
+      height: [/^[\d.]+(px|em|rem|%)$/]
+    }
+  },
+  // A link that opens a new tab hands the opener to the destination without
+  // this; the editor has no way to set it, so it is added here.
+  transformTags: {
+    a: (tagName, attribs) => attribs.target === "_blank" ? { tagName, attribs: { ...attribs, rel: "noopener noreferrer" } } : { tagName, attribs }
+  }
+};
+function sanitizeBlockHtml(html) {
+  if (!html) return "";
+  return sanitizeHtmlLib(html, OPTIONS);
+}
+export {
+  sanitizeBlockHtml
+};

package/dist/lib/config/config-sync.d.ts

@@ -39,6 +39,7 @@ export declare const PUBLIC_AUTH_CONFIG: {
         };
     };
     methods: import("./types").AuthLoginMethod[];
+    otp: import("../auth/otp-config").ResolvedOtpConfig;
 };
 export declare const TOPBAR_CONFIG: any;
 export declare const SIDEBAR_CONFIG: any;

package/dist/lib/config/config-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-sync.d.ts","sourceRoot":"","sources":["../../../src/lib/config/config-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA+NH,eAAO,MAAM,iBAAiB,KAAkB,CAAA;AAChD,eAAO,MAAM,gBAAgB,KAAwB,CAAA;AACrD,eAAO,MAAM,UAAU,6BAAkB,CAAA;AAGzC,eAAO,MAAM,iBAAiB,KAA0C,CAAA;AACxE,eAAO,MAAM,cAAc,KAAuC,CAAA;AAClE,eAAO,MAAM,eAAe,KAA6C,CAAA;AACzE,eAAO,MAAM,YAAY,KAA0C,CAAA;AACnE,eAAO,MAAM,QAAQ,KAA6B,CAAA;AAClD,eAAO,MAAM,WAAW,KAAgC,CAAA;AAGxD,eAAO,MAAM,WAAW,KAAyB,CAAA;AACjD,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAC5D,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAC5D,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,WAAW,KAAyB,CAAA;AAUjD,eAAO,MAAM,kBAAkB;;cAEqC,OAAO,SAAS,EAAE,gBAAgB;;;;;;;;CAYxD,CAAA;AAI9C,eAAO,MAAM,aAAa,KAA0B,CAAA;AACpD,eAAO,MAAM,cAAc,KAA2B,CAAA;AACtD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,kBAAkB,KAA+B,CAAA;AAC9D,eAAO,MAAM,oBAAoB,KAAiC,CAAA;AAIlE,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,OAExD,CAAA;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,eAAO,MAAM,uBAAuB,QAAO,mBAAmB,EAE7D,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,KAAG,OAExD,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,KAAG,CAAC,GAAG,SAGzF,CAAA;AAGD,MAAM,MAAM,eAAe,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;AACpF,MAAM,MAAM,oBAAoB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACnF,MAAM,MAAM,QAAQ,GAAG,OAAO,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"config-sync.d.ts","sourceRoot":"","sources":["../../../src/lib/config/config-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAgOH,eAAO,MAAM,iBAAiB,KAAkB,CAAA;AAChD,eAAO,MAAM,gBAAgB,KAAwB,CAAA;AACrD,eAAO,MAAM,UAAU,6BAAkB,CAAA;AAGzC,eAAO,MAAM,iBAAiB,KAA0C,CAAA;AACxE,eAAO,MAAM,cAAc,KAAuC,CAAA;AAClE,eAAO,MAAM,eAAe,KAA6C,CAAA;AACzE,eAAO,MAAM,YAAY,KAA0C,CAAA;AACnE,eAAO,MAAM,QAAQ,KAA6B,CAAA;AAClD,eAAO,MAAM,WAAW,KAAgC,CAAA;AAGxD,eAAO,MAAM,WAAW,KAAyB,CAAA;AACjD,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAC5D,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAC5D,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,WAAW,KAAyB,CAAA;AAcjD,eAAO,MAAM,kBAAkB;;cAEqC,OAAO,SAAS,EAAE,gBAAgB;;;;;;;;;CAaxD,CAAA;AAI9C,eAAO,MAAM,aAAa,KAA0B,CAAA;AACpD,eAAO,MAAM,cAAc,KAA2B,CAAA;AACtD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,kBAAkB,KAA+B,CAAA;AAC9D,eAAO,MAAM,oBAAoB,KAAiC,CAAA;AAIlE,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,OAExD,CAAA;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,eAAO,MAAM,uBAAuB,QAAO,mBAAmB,EAE7D,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,KAAG,OAExD,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,KAAG,CAAC,GAAG,SAGzF,CAAA;AAGD,MAAM,MAAM,eAAe,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;AACpF,MAAM,MAAM,oBAAoB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACnF,MAAM,MAAM,QAAQ,GAAG,OAAO,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA"}

package/dist/lib/config/config-sync.js

@@ -5,6 +5,7 @@ import { ThemeService } from "../services/theme.service.js";
 import { mergeConfigs } from "../utils/config-merge.js";
 import { mergeRolesConfig } from "./roles-merge.js";
 import { resolveAuthMethods } from "../auth/auth-methods.js";
+import { resolveOtpConfig } from "../auth/otp-config.js";
 import {
   AVAILABLE_ROLES as REGISTRY_AVAILABLE_ROLES,
   ROLE_HIERARCHY as REGISTRY_ROLE_HIERARCHY,
@@ -143,6 +144,7 @@ const TEAMS_CONFIG = APP_CONFIG_MERGED.teams;
 const MEDIA_CONFIG = APP_CONFIG_MERGED.media;
 const AUTH_CONFIG = APP_CONFIG_MERGED.auth;
 const RESOLVED_AUTH_METHODS = resolveAuthMethods(APP_CONFIG_MERGED.auth);
+const RESOLVED_OTP_CONFIG = resolveOtpConfig(APP_CONFIG_MERGED.auth);
 const PUBLIC_AUTH_CONFIG = {
   registration: {
     mode: ((_b = (_a = APP_CONFIG_MERGED.auth) == null ? void 0 : _a.registration) == null ? void 0 : _b.mode) ?? "open"
@@ -154,7 +156,8 @@ const PUBLIC_AUTH_CONFIG = {
       enabled: ((_e = (_d = (_c = APP_CONFIG_MERGED.auth) == null ? void 0 : _c.providers) == null ? void 0 : _d.google) == null ? void 0 : _e.enabled) !== false && RESOLVED_AUTH_METHODS.includes("google")
     }
   },
-  methods: RESOLVED_AUTH_METHODS
+  methods: RESOLVED_AUTH_METHODS,
+  otp: RESOLVED_OTP_CONFIG
 };
 const TOPBAR_CONFIG = DASHBOARD_CONFIG.topbar;
 const SIDEBAR_CONFIG = DASHBOARD_CONFIG.sidebar;