@object-ui/auth 17.5.0 → 17.6.0

package/dist/AuthProvider.js

@@ -7,10 +7,112 @@ import { jsx as _jsx } from "react/jsx-runtime";
  * LICENSE file in the root directory of this source tree.
  */
 import { useState, useEffect, useCallback, useMemo, useRef } from 'react';
-import { authGateEvents } from './auth-gate-events';
-import { AuthCtx } from './AuthContext';
-import { createAuthClient, TokenStorage } from './createAuthClient';
-import { ActiveOrganizationStorage } from './createAuthenticatedFetch';
+import { authGateEvents } from './auth-gate-events.js';
+import { AuthCtx } from './AuthContext.js';
+import { createAuthClient, TokenStorage } from './createAuthClient.js';
+import { ActiveOrganizationStorage, SessionUserScope } from './ActiveOrganizationStorage.js';
+/**
+ * Prefix of every `MetadataProvider` seed entry in `sessionStorage`
+ * (`objectui:metadata:<type>:<orgId>:<principal>`, `@object-ui/app-shell`).
+ *
+ * Spelled out here rather than imported: `@object-ui/app-shell` depends on
+ * `@object-ui/auth`, so the constant cannot travel in that direction without a
+ * dependency cycle. The two ends are held together by BEHAVIOUR instead of by
+ * a shared symbol — `MetadataProvider.crossPrincipalSeed.test.tsx` fills the
+ * cache by running the real `MetadataProvider` and empties it by signing out
+ * through this provider, so a prefix that drifts on either side fails there
+ * rather than silently purging nothing.
+ */
+const METADATA_SEED_CACHE_PREFIX = 'objectui:metadata:';
+/**
+ * Drop the client-side caches that belong to the session being ended
+ * (objectui#5198).
+ *
+ * `sessionStorage` is per-TAB, not per-session, and no sign-out call site
+ * reloads the page — `AppSidebar`, `AppHeader`, `UserMenu` and
+ * `RemediationOverlay` all just call `signOut()` and let the SPA keep running.
+ * So without this the next person to sign in in the same tab (a shared or
+ * kiosk browser, a handover, a support session) is SEEDED from the previous
+ * user's entry, and what is in it is that user's PERMISSION-FILTERED app list —
+ * the server filters `GET /api/v1/meta/:type` per session. That makes it a
+ * cross-principal disclosure, not ordinary staleness, which is why it is
+ * cleared here and not left to the tab being closed.
+ *
+ * Two properties of the loop are load-bearing:
+ *
+ *  - It matches by PREFIX. The keys are org-scoped (objectui#4486), so a purge
+ *    that recomputed the scope would depend on `ActiveOrganizationStorage`
+ *    still holding the org those entries were written under. A prefix sweep has
+ *    no such dependency and therefore no ordering hazard of its own.
+ *  - It runs BEFORE `ActiveOrganizationStorage.clear()` anyway, so the ordering
+ *    stays correct for anything scope-derived added later: clearing the org
+ *    first would leave such a purge computing the no-org scope and deleting
+ *    nothing while the real entries survived.
+ *
+ * `MetadataProvider` additionally keys the entry by session fingerprint, so a
+ * blob that escapes this purge (a tab open across the upgrade, a session ended
+ * by expiry rather than by this call) is unreadable rather than merely
+ * undeleted. The two halves are deliberately independent.
+ *
+ * ## The `try` guards the SNAPSHOT, not the walk (objectui#5777)
+ *
+ * `Object.keys(sessionStorage)` can itself throw — partitioned iframes, some
+ * privacy modes — and that is the reason a guard exists here at all, so it
+ * stays. What it must NOT do is wrap the loop: a `removeItem` that throws on
+ * key `n` would abort the walk, leaving every still-unvisited MATCHING key
+ * unswept, with the failure swallowed so the caller believes the sweep
+ * completed. The keys this purges are a cross-principal disclosure risk on a
+ * shared browser (objectui#5198), not ordinary staleness — a partial sweep
+ * leaves an arbitrary subset of the previous principal's permission-filtered
+ * app list readable to whoever signs in next in this tab. So each
+ * `removeItem` gets its own `try`: one uncooperative key costs exactly that
+ * key. Same defect class and same remedy as `sweepStore` in
+ * `ActiveOrganizationStorage.ts` (objectui#5763) — different file and
+ * different caller (sign-out, not sign-in) is why it is fixed here rather
+ * than there.
+ *
+ * ## Reported, not quarantined — same reason as `sweepStore`
+ *
+ * This function walks keys it does not own reads for: `MetadataProvider`
+ * (`@object-ui/app-shell`) is the reader of the seed cache, not this
+ * provider — there is no local `get()` here to guard, so there is nothing to
+ * quarantine the way `ActiveOrganizationStorage.clear()` quarantines a key
+ * (objectui#5731). What IS mirrored is the reporting channel: a key whose
+ * `removeItem` throws is named in a `console.warn`, so a partial sweep is
+ * discoverable instead of silent. The caller (`signOut`, above) cannot act on
+ * it either way — the session is already ending — so, like `sweepStore` on
+ * the sign-in path, this must not throw.
+ */
+function purgeSignedOutClientCaches() {
+    if (typeof sessionStorage !== 'undefined') {
+        let keys;
+        try {
+            // Snapshot the keys first (`Object.keys`) — removing entries during a
+            // live index walk shifts the ones behind it and skips half of them.
+            // Same idiom as the `MarketplacePackagePage` purge loop.
+            keys = Object.keys(sessionStorage);
+        }
+        catch {
+            keys = []; /* storage unavailable */
+        }
+        const unswept = [];
+        for (const key of keys) {
+            if (!key.startsWith(METADATA_SEED_CACHE_PREFIX))
+                continue;
+            try {
+                sessionStorage.removeItem(key);
+            }
+            catch {
+                unswept.push(key);
+            }
+        }
+        if (unswept.length > 0) {
+            console.warn(`[purgeSignedOutClientCaches] could not remove ${unswept.length} key(s) from sessionStorage: ` +
+                `${unswept.join(', ')}. The signed-out user's metadata seed cache may still be readable under these keys.`);
+        }
+    }
+    ActiveOrganizationStorage.clear();
+}
 /**
  * Authentication context provider.
  *
@@ -49,6 +151,12 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
     const [activeOrganization, setActiveOrganization] = useState(null);
     const [activeMember, setActiveMember] = useState(null);
     const [isOrganizationsLoading, setIsOrganizationsLoading] = useState(false);
+    // objectui#5619 — the two halves of "the membership answer has landed".
+    // Kept as POSITIVE resolution flags rather than another `isLoading`: a
+    // loading flag reads `false` both before the request starts and after it
+    // finishes, and that is precisely the ambiguity this card exists to remove.
+    const [organizationsResolved, setOrganizationsResolved] = useState(false);
+    const [activeMemberResolved, setActiveMemberResolved] = useState(false);
     // Determine if we're in preview mode
     const isPreviewMode = previewMode != null;
     // If auth is disabled or in preview mode, automatically set as authenticated
@@ -60,6 +168,19 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
     // `getSession` is already reflected in the answer we are about to apply, and
     // re-entering on it would loop this provider against the server forever.
     const sessionLoadInFlight = useRef(false);
+    // objectui#5750 — the org id `switchOrganization` last resolved to, tracked
+    // independently of React state so a switch that starts before the PREVIOUS
+    // switch's render has committed still compares against a value, not a stale
+    // closure. Kept in sync with every path that can move `activeOrganization`
+    // (not just `switchOrganization` itself — `refreshOrganizations`'
+    // single-membership repair also does), via the effect below.
+    const activeOrgIdRef = useRef(null);
+    // Bumped by every `switchOrganization` call that decides to re-resolve
+    // identity. Lets an EARLIER switch's still-in-flight `getSession()` notice
+    // a LATER switch superseded it and discard its answer instead of applying
+    // stale, previous-organization data over the newer one (see
+    // `switchOrganization`).
+    const sessionLoadGeneration = useRef(0);
     /**
      * The ONE session loader. Runs on mount (below) and on every later
      * re-resolution — `refreshSession` on the context, and the rotation
@@ -149,7 +270,13 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
                 email: 'preview@preview.local',
                 name,
                 role,
-                roles: [role],
+                // `positions` is the published spelling (framework ADR-0090 D3); this
+                // line was the LAST producer of the retired `roles` key
+                // (objectui#5424, maintainer ruling 2026-08-22). Emitting the position
+                // keeps every `positions` consumer — `AuthGuard`'s `requiredRoles`,
+                // the approver-identity derivations, workspace-admin leg 3 — seeing a
+                // preview identity shaped like a protocol-17 session.
+                positions: [role],
             });
             setSession({
                 token: 'preview-token',
@@ -238,11 +365,27 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             setUser(null);
             setSession(null);
             setError(null);
+            // The organization block is the previous principal's data too: the list
+            // is the workspaces THAT user belongs to (the switcher renders it), and
+            // a lingering `activeOrganization` would additionally suppress the
+            // re-resolution below — `refreshOrganizations` only asks the server for
+            // the active org `if (orgs.length > 0 && !activeOrganization)`, so the
+            // next sign-in in this tab would inherit the previous user's active
+            // workspace in context while storage had (correctly) forgotten it.
+            // `activeMember` follows from the effect that watches `activeOrganization`.
+            // Same pairing `deleteOrganization` / `leaveOrganization` already use in
+            // this file: drop the in-memory reference and the stored id together.
+            setOrganizations([]);
+            setActiveOrganization(null);
         }
         catch (err) {
             setError(err instanceof Error ? err : new Error(String(err)));
         }
         finally {
+            // Unconditional: `createAuthClient.signOut` clears `TokenStorage` BEFORE
+            // it rethrows a server error, so a failed call still leaves this tab
+            // without a session — the caches it authenticated for must go with it.
+            purgeSignedOutClientCaches();
             setIsLoading(false);
         }
     }, [client]);
@@ -453,6 +596,10 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         finally {
             if (!isCancelled?.()) {
                 setIsOrganizationsLoading(false);
+                // In `finally`, so a failed `listOrganizations` still counts as an
+                // answer. It is not a good answer, but leaving it unresolved would
+                // strand every gate that waits on it (objectui#5619).
+                setOrganizationsResolved(true);
             }
         }
     }, [client, enabled, isPreviewMode, activeOrganization]);
@@ -468,12 +615,25 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
                 userId: 'preview-user',
                 role,
             });
+            // Neither mode runs `refreshOrganizations` (its effect requires a real
+            // `user`, and the callback itself returns early), so this is the one
+            // place that can close BOTH halves for them (objectui#5619).
+            setOrganizationsResolved(true);
+            setActiveMemberResolved(true);
             return;
         }
         if (!activeOrganization) {
+            // "No active organization" is a real answer about the member row — but
+            // only once the org list itself has come back, which is what
+            // `organizationsResolved` below contributes. On mount this branch runs
+            // with the pipeline not yet started, and the combined flag stays false.
             setActiveMember(null);
+            setActiveMemberResolved(true);
             return;
         }
+        // A switch re-opens the question: until `getActiveMember()` answers for the
+        // NEW org, `activeMember` still holds the OLD org's row.
+        setActiveMemberResolved(false);
         try {
             const member = await client.getActiveMember();
             setActiveMember(member);
@@ -482,7 +642,42 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             console.warn('[AuthProvider] Failed to load active member:', err);
             setActiveMember(null);
         }
+        finally {
+            setActiveMemberResolved(true);
+        }
     }, [client, enabled, isPreviewMode, previewMode, activeOrganization]);
+    /**
+     * objectui#5664 — the session-user-change invariant.
+     *
+     * Declared BEFORE the two effects below on purpose: effects run in the order
+     * their hooks were called, so this settles "whose browser is this" before
+     * `refreshActiveMember` and `refreshOrganizations` read or write anything
+     * org-scoped. `refreshOrganizations` in particular calls
+     * `ActiveOrganizationStorage.set()`, which resolves its key through the
+     * pointer this establishes.
+     *
+     * Keyed on the session user ID rather than wired into each of the five
+     * places that set `user` (mount / `refreshSession` / rotation, sign-in,
+     * sign-up, and the two provider flows). One implementation, and a sign-in
+     * path added later is covered without being told to be.
+     *
+     * Preview and auth-disabled mounts are excluded because their identities are
+     * SYNTHETIC — a fixed `preview-user` / `guest` id. Adopting one would read as
+     * a user change and purge a real user's state on any browser that opened a
+     * marketplace demo.
+     *
+     * What "purge" means, and why it is wholesale rather than key-by-key, is in
+     * `ActiveOrganizationStorage.ts`: it is an allowlist sweep, so the NEXT
+     * un-namespaced key is covered before anyone writes it.
+     */
+    useEffect(() => {
+        if (!enabled || isPreviewMode)
+            return;
+        const sessionUserId = user?.id;
+        if (!sessionUserId)
+            return;
+        SessionUserScope.adopt(sessionUserId);
+    }, [user?.id, enabled, isPreviewMode]);
     useEffect(() => {
         refreshActiveMember();
     }, [refreshActiveMember]);
@@ -494,8 +689,46 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         refreshOrganizations(() => cancelled);
         return () => { cancelled = true; };
     }, [user, enabled, isPreviewMode]); // eslint-disable-line react-hooks/exhaustive-deps
+    // objectui#5750 — keep `activeOrgIdRef` current for every path that can
+    // move `activeOrganization`, not only `switchOrganization` (e.g.
+    // `refreshOrganizations`' single-membership repair calls
+    // `client.setActiveOrganization` directly). `switchOrganization` also
+    // writes it synchronously on its own success, below — this effect is the
+    // fallback for every OTHER path, and re-affirms after commit.
+    useEffect(() => {
+        activeOrgIdRef.current = activeOrganization?.id ?? null;
+    }, [activeOrganization]);
+    /**
+     * objectui#5750 — `switchOrganization` now DECLARES the re-resolution
+     * instead of relying on the objectui#4467 rotation subscription noticing
+     * one by accident.
+     *
+     * Why that accident cannot be trusted here: `POST /organization/set-active`
+     * always returns the SIGNED `token.signature` spelling in `set-auth-token`
+     * (better-auth's `bearer()` fires for any response that stages a session
+     * cookie), which differs from the UNSIGNED `session.token` spelling the
+     * client normally holds — so `TokenStorage.set` reads the flip as a
+     * rotation and the objectui#4467 subscription re-resolves identity. That
+     * accidental rotation is deterministic on the RAW token, not on the
+     * organization — so a SECOND switch whose response lands before the FIRST
+     * switch's follow-up `get-session` has re-armed it (re-stored the unsigned
+     * spelling) writes the SAME signed value already in storage. No value
+     * change, no notification, no re-resolution — `user.positions` is left
+     * answering for the organization the FIRST switch targeted, while
+     * `activeOrganization` already reads as the new one. Measured in #5749/#5750.
+     *
+     * The fix does not add a second call on the common path: it SUPPRESSES the
+     * accidental one (via `sessionLoadInFlight`, the same flag that already
+     * suppresses the rotation observed inside `loadSession`'s own
+     * `getSession()` call) and re-resolves explicitly instead, so a switch that
+     * changes the active organization still spends exactly one `get-session` —
+     * now unconditionally, so it does not depend on which spelling happened to
+     * already be in storage.
+     */
     const switchOrganization = useCallback(async (orgId) => {
         setError(null);
+        const previousOrgId = activeOrgIdRef.current;
+        sessionLoadInFlight.current = true;
         try {
             const org = await client.setActiveOrganization(orgId);
             setActiveOrganization(org);
@@ -506,13 +739,28 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             else {
                 ActiveOrganizationStorage.clear();
             }
+            const newOrgId = org?.id ?? null;
+            if (newOrgId !== previousOrgId) {
+                activeOrgIdRef.current = newOrgId;
+                // A LATER switch may already be in flight by the time this
+                // `getSession()` answer comes back (no debounce guards repeat
+                // switches — see the WorkspaceSwitcher/OrganizationLayout callers).
+                // Discard this answer if a newer switch has since claimed the
+                // generation, rather than clobber fresher, later-organization data
+                // with a stale, earlier one.
+                const generation = ++sessionLoadGeneration.current;
+                await loadSession(() => sessionLoadGeneration.current !== generation);
+            }
         }
         catch (err) {
             const authError = err instanceof Error ? err : new Error(String(err));
             setError(authError);
             throw authError;
         }
-    }, [client]);
+        finally {
+            sessionLoadInFlight.current = false;
+        }
+    }, [client, loadSession]);
     const createOrganization = useCallback(async (data) => {
         setError(null);
         try {
@@ -576,6 +824,22 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
     // Guest mode (enabled=false) and preview mode both have hardcoded `isAuthenticated`
     // and a no-op signOut backend, so consumers should hide sign-out UIs.
     const isAuthEnabled = enabled && !isPreviewMode;
+    // objectui#5619 — see `AuthContext.isMembershipResolved` for the contract.
+    //
+    // Three modes, three reasons:
+    //  - preview / auth-disabled: no pipeline runs; `refreshActiveMember`'s first
+    //    branch closes both halves on its own effect.
+    //  - no user: there is no membership to fetch, so the question is answered.
+    //    Without this the flag would sit false forever on an unauthenticated
+    //    visitor and hang any gate that waits on it. Consumers that must also
+    //    wait for the SESSION read `isLoading` alongside this (the hook does).
+    //  - signed in: both halves, because "no active organization" only means
+    //    "no member row" once the org list has actually come back.
+    const isMembershipResolved = !isAuthEnabled
+        ? activeMemberResolved
+        : user == null
+            ? true
+            : organizationsResolved && activeMemberResolved;
     const value = useMemo(() => ({
         user,
         session,
@@ -611,6 +875,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         activeOrganization,
         activeMember,
         isOrganizationsLoading,
+        isMembershipResolved,
         switchOrganization,
         createOrganization,
         refreshOrganizations,
@@ -633,7 +898,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         signIn, signUp, signOut, refreshSession, updateUser, forgotPassword, sendVerificationEmail, resetPassword, changePassword, setInitialPassword, hasLocalPassword, getAuthConfig, signInWithProvider,
         sendPhoneOtp, signInWithPhoneOtp, signInWithPhonePassword, requestPhonePasswordReset, resetPasswordWithPhoneOtp,
         remediationRequired, enrollTotp, verifyTotp,
-        organizations, activeOrganization, activeMember, isOrganizationsLoading, switchOrganization, createOrganization, refreshOrganizations,
+        organizations, activeOrganization, activeMember, isOrganizationsLoading, isMembershipResolved, switchOrganization, createOrganization, refreshOrganizations,
         updateOrganization, deleteOrganization, leaveOrganization,
         getMembers, inviteMember, describeDelegableScope, removeMember, updateMemberRole,
         listInvitations, cancelInvitation, getInvitation, acceptInvitation, rejectInvitation, listUserInvitations,

package/dist/ForgotPasswordForm.d.ts

@@ -6,7 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import React from 'react';
-import type { AuthLinkComponentProps } from './types';
+import type { AuthLinkComponentProps } from './types.js';
 /** Translatable labels for the ForgotPasswordForm */
 export interface ForgotPasswordFormLabels {
     emailLabel?: string;

package/dist/ForgotPasswordForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ForgotPasswordForm.d.ts","sourceRoot":"","sources":["../src/ForgotPasswordForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAEnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAYtD,qDAAqD;AACrD,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,wBAAwB;IACxB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,OAAO,EACP,QAAmB,EACnB,KAA6B,EAC7B,WAAyF,EACzF,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,GACZ,EAAE,uBAAuB,qBA0UzB"}
+{"version":3,"file":"ForgotPasswordForm.d.ts","sourceRoot":"","sources":["../src/ForgotPasswordForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAEnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAYzD,qDAAqD;AACrD,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,wBAAwB;IACxB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,OAAO,EACP,QAAmB,EACnB,KAA6B,EAC7B,WAAyF,EACzF,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,GACZ,EAAE,uBAAuB,qBA0UzB"}

package/dist/ForgotPasswordForm.js

@@ -7,8 +7,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * LICENSE file in the root directory of this source tree.
  */
 import { useEffect, useState } from 'react';
-import { useAuth } from './useAuth';
-import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
+import { useAuth } from './useAuth.js';
+import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles.js';
 const DefaultLink = ({ href, className, children }) => (_jsx("a", { href: href, className: className, children: children }));
 const DefaultKeyIcon = () => (_jsx("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", className: "h-6 w-6", "aria-hidden": "true", children: _jsx("path", { d: "M21 2l-2 2m-7.61 7.61a5.5 5.5 0 1 1-7.778 7.778 5.5 5.5 0 0 1 7.777-7.777zm0 0L15.5 7.5m0 0l3 3L22 7l-3-3m-3.5 3.5L19 4" }) }));
 /**
@@ -72,7 +72,7 @@ export function ForgotPasswordForm({ onSuccess, onError, loginUrl = '/login', ti
         submittingButton: labels.submittingButton ?? 'Sending…',
         successTitle: labels.successTitle ?? 'Check your email',
         successDescription: labels.successDescription ??
-            "We've sent a password reset link to {{email}}. Please check your inbox.",
+            "We've sent a password reset link to {email}. Please check your inbox.",
         backToSignInText: labels.backToSignInText ?? 'Back to sign in',
         rememberPasswordText: labels.rememberPasswordText ?? 'Remember your password?',
         signInText: labels.signInText ?? 'Sign in',
@@ -156,8 +156,8 @@ export function ForgotPasswordForm({ onSuccess, onError, loginUrl = '/login', ti
         return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: _jsx("span", { className: "flex h-12 w-12 items-center justify-center rounded-2xl bg-emerald-500/10 text-emerald-600 ring-1 ring-emerald-500/15 dark:text-emerald-400", children: _jsx(AuthMailIcon, {}) }), title: l.phoneSuccessTitle, description: l.phoneSuccessDescription }), loginUrl && (_jsx("p", { className: "text-center text-sm text-muted-foreground", children: _jsxs(LinkComp, { href: loginUrl, className: AUTH_LINK_CLASS, children: ["\u2190 ", l.backToSignInText] }) }))] }));
     }
     if (submitted) {
-        const successMsg = l.successDescription.includes('{{email}}')
-            ? l.successDescription.replace('{{email}}', email)
+        const successMsg = l.successDescription.includes('{email}')
+            ? l.successDescription.replace('{email}', email)
             : `${l.successDescription} ${email}`;
         return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: _jsx("span", { className: "flex h-12 w-12 items-center justify-center rounded-2xl bg-emerald-500/10 text-emerald-600 ring-1 ring-emerald-500/15 dark:text-emerald-400", children: _jsx(AuthMailIcon, {}) }), title: l.successTitle, description: successMsg }), loginUrl && (_jsx("p", { className: "text-center text-sm text-muted-foreground", children: _jsxs(LinkComp, { href: loginUrl, className: AUTH_LINK_CLASS, children: ["\u2190 ", l.backToSignInText] }) }))] }));
     }

package/dist/LoginForm.d.ts

@@ -6,7 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import React from 'react';
-import type { AuthLinkComponentProps } from './types';
+import type { AuthLinkComponentProps } from './types.js';
 /** Translatable labels for the LoginForm */
 export interface LoginFormLabels {
     emailLabel?: string;

package/dist/LoginForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginForm.d.ts","sourceRoot":"","sources":["../src/LoginForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAInD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAYtD,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8GAA8G;IAC9G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAsBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,EACxB,SAAS,EACT,OAAO,EACP,WAAyB,EACzB,iBAAsC,EACtC,KAAiC,EACjC,WAAyD,EACzD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,cAAc,qBAgbhB"}
+{"version":3,"file":"LoginForm.d.ts","sourceRoot":"","sources":["../src/LoginForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAInD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAYzD,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8GAA8G;IAC9G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAsBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,EACxB,SAAS,EACT,OAAO,EACP,WAAyB,EACzB,iBAAsC,EACtC,KAAiC,EACjC,WAAyD,EACzD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,cAAc,qBAgbhB"}

package/dist/LoginForm.js

@@ -7,10 +7,10 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
  * LICENSE file in the root directory of this source tree.
  */
 import { useEffect, useState } from 'react';
-import { useAuth } from './useAuth';
-import { SocialSignInButtons } from './SocialSignInButtons';
-import { looksLikePhoneIdentifier, normalizePhoneIdentifier } from './phone-identifier';
-import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthSpinner, } from './authStyles';
+import { useAuth } from './useAuth.js';
+import { SocialSignInButtons } from './SocialSignInButtons.js';
+import { looksLikePhoneIdentifier, normalizePhoneIdentifier } from './phone-identifier.js';
+import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthSpinner, } from './authStyles.js';
 const DefaultLink = ({ href, className, children }) => (_jsx("a", { href: href, className: className, children: children }));
 const DefaultLockIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", className: "h-6 w-6", "aria-hidden": "true", children: [_jsx("rect", { x: "3", y: "11", width: "18", height: "11", rx: "2" }), _jsx("path", { d: "M7 11V7a5 5 0 0 1 10 0v4" })] }));
 /**

package/dist/PreviewBanner.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { useAuth } from './useAuth';
+import { useAuth } from './useAuth.js';
 /**
  * Banner component that displays a message when the app is in preview mode.
  * Only renders when preview mode is active. Uses the bannerMessage from

package/dist/RegisterForm.d.ts

@@ -6,7 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import React from 'react';
-import type { AuthLinkComponentProps } from './types';
+import type { AuthLinkComponentProps } from './types.js';
 /** Translatable labels for the RegisterForm */
 export interface RegisterFormLabels {
     nameLabel?: string;

package/dist/RegisterForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RegisterForm.d.ts","sourceRoot":"","sources":["../src/RegisterForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAmB,MAAM,OAAO,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAWtD,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC;sFACkF;IAClF,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB;;2CAEuC;IACvC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,EAC3B,SAAS,EACT,sBAAsB,EACtB,OAAO,EACP,QAAmB,EACnB,KAA2B,EAC3B,WAAqD,EACrD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,iBAAiB,qBAuKnB"}
+{"version":3,"file":"RegisterForm.d.ts","sourceRoot":"","sources":["../src/RegisterForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAmB,MAAM,OAAO,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAWzD,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC;sFACkF;IAClF,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB;;2CAEuC;IACvC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,EAC3B,SAAS,EACT,sBAAsB,EACtB,OAAO,EACP,QAAmB,EACnB,KAA2B,EAC3B,WAAqD,EACrD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,iBAAiB,qBAuKnB"}

package/dist/RegisterForm.js

@@ -7,9 +7,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * LICENSE file in the root directory of this source tree.
  */
 import { useState } from 'react';
-import { useAuth } from './useAuth';
-import { SocialSignInButtons } from './SocialSignInButtons';
-import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthSpinner, } from './authStyles';
+import { useAuth } from './useAuth.js';
+import { SocialSignInButtons } from './SocialSignInButtons.js';
+import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthSpinner, } from './authStyles.js';
 const DefaultLink = ({ href, className, children }) => (_jsx("a", { href: href, className: className, children: children }));
 const DefaultUserPlusIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", className: "h-6 w-6", "aria-hidden": "true", children: [_jsx("path", { d: "M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2" }), _jsx("circle", { cx: "9", cy: "7", r: "4" }), _jsx("line", { x1: "19", y1: "8", x2: "19", y2: "14" }), _jsx("line", { x1: "22", y1: "11", x2: "16", y2: "11" })] }));
 /**

package/dist/SocialSignInButtons.js

@@ -7,8 +7,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * LICENSE file in the root directory of this source tree.
  */
 import { useEffect, useState } from 'react';
-import { useAuth } from './useAuth';
-import { AuthSpinner } from './authStyles';
+import { useAuth } from './useAuth.js';
+import { AuthSpinner } from './authStyles.js';
 // Brand name overrides for providers whose `name` from the server may be unset
 // or where we want to canonicalize casing.
 const PROVIDER_LABEL = {

package/dist/UserMenu.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useAuth } from './useAuth';
-import { getUserInitials } from './types';
+import { useAuth } from './useAuth.js';
+import { getUserInitials } from './types.js';
 /**
  * User menu component displaying the authenticated user's info.
  * Shows avatar, name, email, and common actions (profile, settings, sign out).

package/dist/createAuthClient.d.ts

@@ -5,7 +5,7 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import type { AuthClient, AuthClientConfig } from './types';
+import type { AuthClient, AuthClientConfig } from './types.js';
 /**
  * Simple token storage backed by localStorage.
  * Falls back to in-memory storage when localStorage is unavailable (SSR, tests).

package/dist/createAuthClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,SAAS,CAAC;AAIjB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;kCACD,IAAI;WAE/B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aAkBf,IAAI;IASb;;;OAGG;gCACyB,MAAM,IAAI,GAAG,MAAM,IAAI;CAMpD,CAAC;AAwIF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAqrBrE"}
+{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,YAAY,CAAC;AAKpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;kCACD,IAAI;WAE/B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aAkBf,IAAI;IASb;;;OAGG;gCACyB,MAAM,IAAI,GAAG,MAAM,IAAI;CAMpD,CAAC;AA2KF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAqrBrE"}

package/dist/createAuthClient.js

@@ -7,6 +7,7 @@
  */
 import { createAuthClient as createBetterAuthClient } from 'better-auth/client';
 import { organizationClient, twoFactorClient } from 'better-auth/client/plugins';
+import { AUTH_INVITATION_STATUSES, isAuthInvitationStatus } from './invitation-status.js';
 const TOKEN_STORAGE_KEY = 'auth-session-token';
 /**
  * Simple token storage backed by localStorage.
@@ -109,6 +110,37 @@ function toAuthError(error, fallbackMessage) {
         err.code = error.code;
     return err;
 }
+/**
+ * The wire boundary for invitations (objectui#3879).
+ *
+ * better-auth's client hands these routes back as `any`, so `as AuthInvitation`
+ * was a claim nothing checked — and with `status` narrowed to a closed union,
+ * an unchecked cast would make that union a comment again the day a backend
+ * stored a fifth value. This is the ONE place the claim is verified.
+ *
+ * It fails LOUDLY, naming the offending value, rather than degrading: a status
+ * outside better-auth's own `InvitationStatus` is a producer defect, and the
+ * alternatives all hide it — a neutral badge label renders it as UI copy in ten
+ * packs (the objectui#3879 symptom), and dropping the row deletes an invitation
+ * from an administrative ledger without saying so. Both call paths already
+ * render a rejection with a retry (`InvitationsPage`, `AcceptInvitationPage`),
+ * so the throw lands on a designed surface; `resolveOrgErrorMessage` shows the
+ * sentence verbatim, which is that module's own stated preference over
+ * swallowing an error.
+ */
+function asAuthInvitation(raw, method) {
+    const status = raw?.status;
+    if (!isAuthInvitationStatus(status)) {
+        throw new Error(`${method}: unexpected invitation status ${JSON.stringify(status)} — ` +
+            `expected one of ${AUTH_INVITATION_STATUSES.join(' | ')}`);
+    }
+    return raw;
+}
+/** Same boundary, per row, for the list-returning invitation routes. */
+function asAuthInvitations(raw, method) {
+    const rows = Array.isArray(raw) ? raw : [];
+    return rows.map((row) => asAuthInvitation(row, method));
+}
 /**
  * Resolve a baseURL (which may be relative or absolute) into the
  * `{ origin, basePath }` pair required by the better-auth client.
@@ -753,7 +785,7 @@ export function createAuthClient(config) {
             });
             if (error)
                 throw toAuthError(error, 'Failed to invite member');
-            return data;
+            return asAuthInvitation(data, 'inviteMember');
         },
         async removeMember(removeData) {
             const { error } = await betterAuth.organization.removeMember({
@@ -802,7 +834,7 @@ export function createAuthClient(config) {
             });
             if (error)
                 throw toAuthError(error, 'Failed to list invitations');
-            return (data ?? []);
+            return asAuthInvitations(data, 'listInvitations');
         },
         async cancelInvitation(invitationId) {
             const { error } = await betterAuth.organization.cancelInvitation({ invitationId });
@@ -815,7 +847,7 @@ export function createAuthClient(config) {
             });
             if (error)
                 throw toAuthError(error, 'Failed to load invitation');
-            return data;
+            return asAuthInvitation(data, 'getInvitation');
         },
         async acceptInvitation(invitationId) {
             const { error } = await betterAuth.organization.acceptInvitation({ invitationId });
@@ -831,7 +863,7 @@ export function createAuthClient(config) {
             const { data, error } = await betterAuth.organization.listUserInvitations();
             if (error)
                 throw toAuthError(error, 'Failed to list invitations');
-            return (data ?? []);
+            return asAuthInvitations(data, 'listUserInvitations');
         },
     };
 }