@object-ui/auth 17.5.0 → 17.7.0

package/dist/AuthGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthGuard.d.ts","sourceRoot":"","sources":["../src/AuthGuard.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC3B,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gDAAgD;IAChD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,qCAAqC;IACrC,eAAe,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAClC,4CAA4C;IAC5C,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,EACxB,QAAe,EACf,aAAa,EACb,eAAe,EACf,QAAQ,GACT,EAAE,cAAc,qBAqBhB"}
+{"version":3,"file":"AuthGuard.d.ts","sourceRoot":"","sources":["../src/AuthGuard.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gDAAgD;IAChD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,qCAAqC;IACrC,eAAe,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAClC,4CAA4C;IAC5C,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,EACxB,QAAe,EACf,aAAa,EACb,eAAe,EACf,QAAQ,GACT,EAAE,cAAc,qBAkChB"}

package/dist/AuthGuard.js

@@ -1,5 +1,5 @@
 import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
-import { useAuth } from './useAuth';
+import { useAuth } from './useAuth.js';
 /**
  * Route guard component that conditionally renders children
  * based on authentication and authorization state.
@@ -23,9 +23,22 @@ export function AuthGuard({ fallback = null, requiredRoles, loadingFallback, chi
     if (!isAuthenticated) {
         return _jsx(_Fragment, { children: fallback });
     }
-    // Check role requirements
+    // Check role requirements.
+    //
+    // `positions` is the ONE published spelling (framework ADR-0090 D3 renamed
+    // `roles` → `positions` with no deprecation window; maintainer ruling on
+    // objectui#5424). When the session carries the key — protocol 17 always
+    // emits it — it is the whole answer, empty included: falling back to the
+    // coarse `user.role` scalar when the server said "no positions" would be
+    // exactly the over-admission this gate used to have (`role: 'admin'`
+    // passing a gate meant for an `admin` position). The scalar fallback exists
+    // for identities that lack the key entirely: the guest user the provider
+    // seeds when auth is disabled, and pre-positions deployments. The retired
+    // `roles` spelling is deliberately NOT read — resurrecting it as a fallback
+    // dialect is what ADR-0090 D3 forbids
+    // (`__tests__/authGuardPositions-5424.test.tsx` pins the refusal).
     if (requiredRoles && requiredRoles.length > 0 && user) {
-        const userRoles = user.roles ?? (user.role ? [user.role] : []);
+        const userRoles = user.positions ?? (user.role ? [user.role] : []);
         const hasRole = requiredRoles.some((role) => userRoles.includes(role));
         if (!hasRole) {
             return _jsx(_Fragment, { children: fallback });

package/dist/AuthProvider.d.ts

@@ -6,7 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import React from 'react';
-import type { AuthProviderOptions, PreviewModeOptions } from './types';
+import type { AuthProviderOptions, PreviewModeOptions } from './types.js';
 export interface AuthProviderProps extends AuthProviderOptions {
     children: React.ReactNode;
     /**

package/dist/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA4D,MAAM,OAAO,CAAC;AAEjF,OAAO,KAAK,EAAwB,mBAAmB,EAAE,kBAAkB,EAAyG,MAAM,SAAS,CAAC;AAKpM,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,OAAO,EACP,MAAM,EAAE,cAAc,EACtB,iBAAiB,EACjB,OAAc,EACd,WAAW,EACX,QAAQ,GACT,EAAE,iBAAiB,qBAytBnB"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA4D,MAAM,OAAO,CAAC;AAEjF,OAAO,KAAK,EAAwB,mBAAmB,EAAE,kBAAkB,EAAyG,MAAM,YAAY,CAAC;AA4GvM,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,OAAO,EACP,MAAM,EAAE,cAAc,EACtB,iBAAiB,EACjB,OAAc,EACd,WAAW,EACX,QAAQ,GACT,EAAE,iBAAiB,qBA43BnB"}

package/dist/AuthProvider.js

@@ -7,10 +7,112 @@ import { jsx as _jsx } from "react/jsx-runtime";
  * LICENSE file in the root directory of this source tree.
  */
 import { useState, useEffect, useCallback, useMemo, useRef } from 'react';
-import { authGateEvents } from './auth-gate-events';
-import { AuthCtx } from './AuthContext';
-import { createAuthClient, TokenStorage } from './createAuthClient';
-import { ActiveOrganizationStorage } from './createAuthenticatedFetch';
+import { authGateEvents } from './auth-gate-events.js';
+import { AuthCtx } from './AuthContext.js';
+import { createAuthClient, TokenStorage } from './createAuthClient.js';
+import { ActiveOrganizationStorage, SessionUserScope } from './ActiveOrganizationStorage.js';
+/**
+ * Prefix of every `MetadataProvider` seed entry in `sessionStorage`
+ * (`objectui:metadata:<type>:<orgId>:<principal>`, `@object-ui/app-shell`).
+ *
+ * Spelled out here rather than imported: `@object-ui/app-shell` depends on
+ * `@object-ui/auth`, so the constant cannot travel in that direction without a
+ * dependency cycle. The two ends are held together by BEHAVIOUR instead of by
+ * a shared symbol — `MetadataProvider.crossPrincipalSeed.test.tsx` fills the
+ * cache by running the real `MetadataProvider` and empties it by signing out
+ * through this provider, so a prefix that drifts on either side fails there
+ * rather than silently purging nothing.
+ */
+const METADATA_SEED_CACHE_PREFIX = 'objectui:metadata:';
+/**
+ * Drop the client-side caches that belong to the session being ended
+ * (objectui#5198).
+ *
+ * `sessionStorage` is per-TAB, not per-session, and no sign-out call site
+ * reloads the page — `AppHeader`, `UserMenu` and `RemediationOverlay` all
+ * just call `signOut()` and let the SPA keep running.
+ * So without this the next person to sign in in the same tab (a shared or
+ * kiosk browser, a handover, a support session) is SEEDED from the previous
+ * user's entry, and what is in it is that user's PERMISSION-FILTERED app list —
+ * the server filters `GET /api/v1/meta/:type` per session. That makes it a
+ * cross-principal disclosure, not ordinary staleness, which is why it is
+ * cleared here and not left to the tab being closed.
+ *
+ * Two properties of the loop are load-bearing:
+ *
+ *  - It matches by PREFIX. The keys are org-scoped (objectui#4486), so a purge
+ *    that recomputed the scope would depend on `ActiveOrganizationStorage`
+ *    still holding the org those entries were written under. A prefix sweep has
+ *    no such dependency and therefore no ordering hazard of its own.
+ *  - It runs BEFORE `ActiveOrganizationStorage.clear()` anyway, so the ordering
+ *    stays correct for anything scope-derived added later: clearing the org
+ *    first would leave such a purge computing the no-org scope and deleting
+ *    nothing while the real entries survived.
+ *
+ * `MetadataProvider` additionally keys the entry by session fingerprint, so a
+ * blob that escapes this purge (a tab open across the upgrade, a session ended
+ * by expiry rather than by this call) is unreadable rather than merely
+ * undeleted. The two halves are deliberately independent.
+ *
+ * ## The `try` guards the SNAPSHOT, not the walk (objectui#5777)
+ *
+ * `Object.keys(sessionStorage)` can itself throw — partitioned iframes, some
+ * privacy modes — and that is the reason a guard exists here at all, so it
+ * stays. What it must NOT do is wrap the loop: a `removeItem` that throws on
+ * key `n` would abort the walk, leaving every still-unvisited MATCHING key
+ * unswept, with the failure swallowed so the caller believes the sweep
+ * completed. The keys this purges are a cross-principal disclosure risk on a
+ * shared browser (objectui#5198), not ordinary staleness — a partial sweep
+ * leaves an arbitrary subset of the previous principal's permission-filtered
+ * app list readable to whoever signs in next in this tab. So each
+ * `removeItem` gets its own `try`: one uncooperative key costs exactly that
+ * key. Same defect class and same remedy as `sweepStore` in
+ * `ActiveOrganizationStorage.ts` (objectui#5763) — different file and
+ * different caller (sign-out, not sign-in) is why it is fixed here rather
+ * than there.
+ *
+ * ## Reported, not quarantined — same reason as `sweepStore`
+ *
+ * This function walks keys it does not own reads for: `MetadataProvider`
+ * (`@object-ui/app-shell`) is the reader of the seed cache, not this
+ * provider — there is no local `get()` here to guard, so there is nothing to
+ * quarantine the way `ActiveOrganizationStorage.clear()` quarantines a key
+ * (objectui#5731). What IS mirrored is the reporting channel: a key whose
+ * `removeItem` throws is named in a `console.warn`, so a partial sweep is
+ * discoverable instead of silent. The caller (`signOut`, above) cannot act on
+ * it either way — the session is already ending — so, like `sweepStore` on
+ * the sign-in path, this must not throw.
+ */
+function purgeSignedOutClientCaches() {
+    if (typeof sessionStorage !== 'undefined') {
+        let keys;
+        try {
+            // Snapshot the keys first (`Object.keys`) — removing entries during a
+            // live index walk shifts the ones behind it and skips half of them.
+            // Same idiom as the `MarketplacePackagePage` purge loop.
+            keys = Object.keys(sessionStorage);
+        }
+        catch {
+            keys = []; /* storage unavailable */
+        }
+        const unswept = [];
+        for (const key of keys) {
+            if (!key.startsWith(METADATA_SEED_CACHE_PREFIX))
+                continue;
+            try {
+                sessionStorage.removeItem(key);
+            }
+            catch {
+                unswept.push(key);
+            }
+        }
+        if (unswept.length > 0) {
+            console.warn(`[purgeSignedOutClientCaches] could not remove ${unswept.length} key(s) from sessionStorage: ` +
+                `${unswept.join(', ')}. The signed-out user's metadata seed cache may still be readable under these keys.`);
+        }
+    }
+    ActiveOrganizationStorage.clear();
+}
 /**
  * Authentication context provider.
  *
@@ -49,6 +151,12 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
     const [activeOrganization, setActiveOrganization] = useState(null);
     const [activeMember, setActiveMember] = useState(null);
     const [isOrganizationsLoading, setIsOrganizationsLoading] = useState(false);
+    // objectui#5619 — the two halves of "the membership answer has landed".
+    // Kept as POSITIVE resolution flags rather than another `isLoading`: a
+    // loading flag reads `false` both before the request starts and after it
+    // finishes, and that is precisely the ambiguity this card exists to remove.
+    const [organizationsResolved, setOrganizationsResolved] = useState(false);
+    const [activeMemberResolved, setActiveMemberResolved] = useState(false);
     // Determine if we're in preview mode
     const isPreviewMode = previewMode != null;
     // If auth is disabled or in preview mode, automatically set as authenticated
@@ -60,6 +168,19 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
     // `getSession` is already reflected in the answer we are about to apply, and
     // re-entering on it would loop this provider against the server forever.
     const sessionLoadInFlight = useRef(false);
+    // objectui#5750 — the org id `switchOrganization` last resolved to, tracked
+    // independently of React state so a switch that starts before the PREVIOUS
+    // switch's render has committed still compares against a value, not a stale
+    // closure. Kept in sync with every path that can move `activeOrganization`
+    // (not just `switchOrganization` itself — `refreshOrganizations`'
+    // single-membership repair also does), via the effect below.
+    const activeOrgIdRef = useRef(null);
+    // Bumped by every `switchOrganization` call that decides to re-resolve
+    // identity. Lets an EARLIER switch's still-in-flight `getSession()` notice
+    // a LATER switch superseded it and discard its answer instead of applying
+    // stale, previous-organization data over the newer one (see
+    // `switchOrganization`).
+    const sessionLoadGeneration = useRef(0);
     /**
      * The ONE session loader. Runs on mount (below) and on every later
      * re-resolution — `refreshSession` on the context, and the rotation
@@ -149,7 +270,13 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
                 email: 'preview@preview.local',
                 name,
                 role,
-                roles: [role],
+                // `positions` is the published spelling (framework ADR-0090 D3); this
+                // line was the LAST producer of the retired `roles` key
+                // (objectui#5424, maintainer ruling 2026-08-22). Emitting the position
+                // keeps every `positions` consumer — `AuthGuard`'s `requiredRoles`,
+                // the approver-identity derivations, workspace-admin leg 3 — seeing a
+                // preview identity shaped like a protocol-17 session.
+                positions: [role],
             });
             setSession({
                 token: 'preview-token',
@@ -207,11 +334,11 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             setIsLoading(false);
         }
     }, [client]);
-    const signUp = useCallback(async (name, email, password) => {
+    const signUp = useCallback(async (name, email, password, callbackURL) => {
         setIsLoading(true);
         setError(null);
         try {
-            const result = await client.signUp({ name, email, password });
+            const result = await client.signUp({ name, email, password, ...(callbackURL ? { callbackURL } : {}) });
             if (result.requiresVerification) {
                 // No session was created — the user must verify their email before
                 // they can sign in. Leave auth state untouched so the caller can
@@ -238,11 +365,27 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             setUser(null);
             setSession(null);
             setError(null);
+            // The organization block is the previous principal's data too: the list
+            // is the workspaces THAT user belongs to (the switcher renders it), and
+            // a lingering `activeOrganization` would additionally suppress the
+            // re-resolution below — `refreshOrganizations` only asks the server for
+            // the active org `if (orgs.length > 0 && !activeOrganization)`, so the
+            // next sign-in in this tab would inherit the previous user's active
+            // workspace in context while storage had (correctly) forgotten it.
+            // `activeMember` follows from the effect that watches `activeOrganization`.
+            // Same pairing `deleteOrganization` / `leaveOrganization` already use in
+            // this file: drop the in-memory reference and the stored id together.
+            setOrganizations([]);
+            setActiveOrganization(null);
         }
         catch (err) {
             setError(err instanceof Error ? err : new Error(String(err)));
         }
         finally {
+            // Unconditional: `createAuthClient.signOut` clears `TokenStorage` BEFORE
+            // it rethrows a server error, so a failed call still leaves this tab
+            // without a session — the caches it authenticated for must go with it.
+            purgeSignedOutClientCaches();
             setIsLoading(false);
         }
     }, [client]);
@@ -453,6 +596,10 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         finally {
             if (!isCancelled?.()) {
                 setIsOrganizationsLoading(false);
+                // In `finally`, so a failed `listOrganizations` still counts as an
+                // answer. It is not a good answer, but leaving it unresolved would
+                // strand every gate that waits on it (objectui#5619).
+                setOrganizationsResolved(true);
             }
         }
     }, [client, enabled, isPreviewMode, activeOrganization]);
@@ -468,12 +615,25 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
                 userId: 'preview-user',
                 role,
             });
+            // Neither mode runs `refreshOrganizations` (its effect requires a real
+            // `user`, and the callback itself returns early), so this is the one
+            // place that can close BOTH halves for them (objectui#5619).
+            setOrganizationsResolved(true);
+            setActiveMemberResolved(true);
             return;
         }
         if (!activeOrganization) {
+            // "No active organization" is a real answer about the member row — but
+            // only once the org list itself has come back, which is what
+            // `organizationsResolved` below contributes. On mount this branch runs
+            // with the pipeline not yet started, and the combined flag stays false.
             setActiveMember(null);
+            setActiveMemberResolved(true);
             return;
         }
+        // A switch re-opens the question: until `getActiveMember()` answers for the
+        // NEW org, `activeMember` still holds the OLD org's row.
+        setActiveMemberResolved(false);
         try {
             const member = await client.getActiveMember();
             setActiveMember(member);
@@ -482,7 +642,42 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             console.warn('[AuthProvider] Failed to load active member:', err);
             setActiveMember(null);
         }
+        finally {
+            setActiveMemberResolved(true);
+        }
     }, [client, enabled, isPreviewMode, previewMode, activeOrganization]);
+    /**
+     * objectui#5664 — the session-user-change invariant.
+     *
+     * Declared BEFORE the two effects below on purpose: effects run in the order
+     * their hooks were called, so this settles "whose browser is this" before
+     * `refreshActiveMember` and `refreshOrganizations` read or write anything
+     * org-scoped. `refreshOrganizations` in particular calls
+     * `ActiveOrganizationStorage.set()`, which resolves its key through the
+     * pointer this establishes.
+     *
+     * Keyed on the session user ID rather than wired into each of the five
+     * places that set `user` (mount / `refreshSession` / rotation, sign-in,
+     * sign-up, and the two provider flows). One implementation, and a sign-in
+     * path added later is covered without being told to be.
+     *
+     * Preview and auth-disabled mounts are excluded because their identities are
+     * SYNTHETIC — a fixed `preview-user` / `guest` id. Adopting one would read as
+     * a user change and purge a real user's state on any browser that opened a
+     * marketplace demo.
+     *
+     * What "purge" means, and why it is wholesale rather than key-by-key, is in
+     * `ActiveOrganizationStorage.ts`: it is an allowlist sweep, so the NEXT
+     * un-namespaced key is covered before anyone writes it.
+     */
+    useEffect(() => {
+        if (!enabled || isPreviewMode)
+            return;
+        const sessionUserId = user?.id;
+        if (!sessionUserId)
+            return;
+        SessionUserScope.adopt(sessionUserId);
+    }, [user?.id, enabled, isPreviewMode]);
     useEffect(() => {
         refreshActiveMember();
     }, [refreshActiveMember]);
@@ -494,8 +689,46 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         refreshOrganizations(() => cancelled);
         return () => { cancelled = true; };
     }, [user, enabled, isPreviewMode]); // eslint-disable-line react-hooks/exhaustive-deps
+    // objectui#5750 — keep `activeOrgIdRef` current for every path that can
+    // move `activeOrganization`, not only `switchOrganization` (e.g.
+    // `refreshOrganizations`' single-membership repair calls
+    // `client.setActiveOrganization` directly). `switchOrganization` also
+    // writes it synchronously on its own success, below — this effect is the
+    // fallback for every OTHER path, and re-affirms after commit.
+    useEffect(() => {
+        activeOrgIdRef.current = activeOrganization?.id ?? null;
+    }, [activeOrganization]);
+    /**
+     * objectui#5750 — `switchOrganization` now DECLARES the re-resolution
+     * instead of relying on the objectui#4467 rotation subscription noticing
+     * one by accident.
+     *
+     * Why that accident cannot be trusted here: `POST /organization/set-active`
+     * always returns the SIGNED `token.signature` spelling in `set-auth-token`
+     * (better-auth's `bearer()` fires for any response that stages a session
+     * cookie), which differs from the UNSIGNED `session.token` spelling the
+     * client normally holds — so `TokenStorage.set` reads the flip as a
+     * rotation and the objectui#4467 subscription re-resolves identity. That
+     * accidental rotation is deterministic on the RAW token, not on the
+     * organization — so a SECOND switch whose response lands before the FIRST
+     * switch's follow-up `get-session` has re-armed it (re-stored the unsigned
+     * spelling) writes the SAME signed value already in storage. No value
+     * change, no notification, no re-resolution — `user.positions` is left
+     * answering for the organization the FIRST switch targeted, while
+     * `activeOrganization` already reads as the new one. Measured in #5749/#5750.
+     *
+     * The fix does not add a second call on the common path: it SUPPRESSES the
+     * accidental one (via `sessionLoadInFlight`, the same flag that already
+     * suppresses the rotation observed inside `loadSession`'s own
+     * `getSession()` call) and re-resolves explicitly instead, so a switch that
+     * changes the active organization still spends exactly one `get-session` —
+     * now unconditionally, so it does not depend on which spelling happened to
+     * already be in storage.
+     */
     const switchOrganization = useCallback(async (orgId) => {
         setError(null);
+        const previousOrgId = activeOrgIdRef.current;
+        sessionLoadInFlight.current = true;
         try {
             const org = await client.setActiveOrganization(orgId);
             setActiveOrganization(org);
@@ -506,13 +739,28 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             else {
                 ActiveOrganizationStorage.clear();
             }
+            const newOrgId = org?.id ?? null;
+            if (newOrgId !== previousOrgId) {
+                activeOrgIdRef.current = newOrgId;
+                // A LATER switch may already be in flight by the time this
+                // `getSession()` answer comes back (no debounce guards repeat
+                // switches — see the WorkspaceSwitcher/OrganizationLayout callers).
+                // Discard this answer if a newer switch has since claimed the
+                // generation, rather than clobber fresher, later-organization data
+                // with a stale, earlier one.
+                const generation = ++sessionLoadGeneration.current;
+                await loadSession(() => sessionLoadGeneration.current !== generation);
+            }
         }
         catch (err) {
             const authError = err instanceof Error ? err : new Error(String(err));
             setError(authError);
             throw authError;
         }
-    }, [client]);
+        finally {
+            sessionLoadInFlight.current = false;
+        }
+    }, [client, loadSession]);
     const createOrganization = useCallback(async (data) => {
         setError(null);
         try {
@@ -576,6 +824,22 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
     // Guest mode (enabled=false) and preview mode both have hardcoded `isAuthenticated`
     // and a no-op signOut backend, so consumers should hide sign-out UIs.
     const isAuthEnabled = enabled && !isPreviewMode;
+    // objectui#5619 — see `AuthContext.isMembershipResolved` for the contract.
+    //
+    // Three modes, three reasons:
+    //  - preview / auth-disabled: no pipeline runs; `refreshActiveMember`'s first
+    //    branch closes both halves on its own effect.
+    //  - no user: there is no membership to fetch, so the question is answered.
+    //    Without this the flag would sit false forever on an unauthenticated
+    //    visitor and hang any gate that waits on it. Consumers that must also
+    //    wait for the SESSION read `isLoading` alongside this (the hook does).
+    //  - signed in: both halves, because "no active organization" only means
+    //    "no member row" once the org list has actually come back.
+    const isMembershipResolved = !isAuthEnabled
+        ? activeMemberResolved
+        : user == null
+            ? true
+            : organizationsResolved && activeMemberResolved;
     const value = useMemo(() => ({
         user,
         session,
@@ -611,6 +875,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         activeOrganization,
         activeMember,
         isOrganizationsLoading,
+        isMembershipResolved,
         switchOrganization,
         createOrganization,
         refreshOrganizations,
@@ -633,7 +898,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         signIn, signUp, signOut, refreshSession, updateUser, forgotPassword, sendVerificationEmail, resetPassword, changePassword, setInitialPassword, hasLocalPassword, getAuthConfig, signInWithProvider,
         sendPhoneOtp, signInWithPhoneOtp, signInWithPhonePassword, requestPhonePasswordReset, resetPasswordWithPhoneOtp,
         remediationRequired, enrollTotp, verifyTotp,
-        organizations, activeOrganization, activeMember, isOrganizationsLoading, switchOrganization, createOrganization, refreshOrganizations,
+        organizations, activeOrganization, activeMember, isOrganizationsLoading, isMembershipResolved, switchOrganization, createOrganization, refreshOrganizations,
         updateOrganization, deleteOrganization, leaveOrganization,
         getMembers, inviteMember, describeDelegableScope, removeMember, updateMemberRole,
         listInvitations, cancelInvitation, getInvitation, acceptInvitation, rejectInvitation, listUserInvitations,

package/dist/ForgotPasswordForm.d.ts

@@ -6,7 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import React from 'react';
-import type { AuthLinkComponentProps } from './types';
+import type { AuthLinkComponentProps } from './types.js';
 /** Translatable labels for the ForgotPasswordForm */
 export interface ForgotPasswordFormLabels {
     emailLabel?: string;

package/dist/ForgotPasswordForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ForgotPasswordForm.d.ts","sourceRoot":"","sources":["../src/ForgotPasswordForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAEnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAYtD,qDAAqD;AACrD,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,wBAAwB;IACxB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,OAAO,EACP,QAAmB,EACnB,KAA6B,EAC7B,WAAyF,EACzF,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,GACZ,EAAE,uBAAuB,qBA0UzB"}
+{"version":3,"file":"ForgotPasswordForm.d.ts","sourceRoot":"","sources":["../src/ForgotPasswordForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAEnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAYzD,qDAAqD;AACrD,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,wBAAwB;IACxB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,OAAO,EACP,QAAmB,EACnB,KAA6B,EAC7B,WAAyF,EACzF,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,GACZ,EAAE,uBAAuB,qBA0UzB"}

package/dist/ForgotPasswordForm.js

@@ -7,8 +7,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * LICENSE file in the root directory of this source tree.
  */
 import { useEffect, useState } from 'react';
-import { useAuth } from './useAuth';
-import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
+import { useAuth } from './useAuth.js';
+import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles.js';
 const DefaultLink = ({ href, className, children }) => (_jsx("a", { href: href, className: className, children: children }));
 const DefaultKeyIcon = () => (_jsx("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", className: "h-6 w-6", "aria-hidden": "true", children: _jsx("path", { d: "M21 2l-2 2m-7.61 7.61a5.5 5.5 0 1 1-7.778 7.778 5.5 5.5 0 0 1 7.777-7.777zm0 0L15.5 7.5m0 0l3 3L22 7l-3-3m-3.5 3.5L19 4" }) }));
 /**
@@ -72,7 +72,7 @@ export function ForgotPasswordForm({ onSuccess, onError, loginUrl = '/login', ti
         submittingButton: labels.submittingButton ?? 'Sending…',
         successTitle: labels.successTitle ?? 'Check your email',
         successDescription: labels.successDescription ??
-            "We've sent a password reset link to {{email}}. Please check your inbox.",
+            "We've sent a password reset link to {email}. Please check your inbox.",
         backToSignInText: labels.backToSignInText ?? 'Back to sign in',
         rememberPasswordText: labels.rememberPasswordText ?? 'Remember your password?',
         signInText: labels.signInText ?? 'Sign in',
@@ -156,8 +156,8 @@ export function ForgotPasswordForm({ onSuccess, onError, loginUrl = '/login', ti
         return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: _jsx("span", { className: "flex h-12 w-12 items-center justify-center rounded-2xl bg-emerald-500/10 text-emerald-600 ring-1 ring-emerald-500/15 dark:text-emerald-400", children: _jsx(AuthMailIcon, {}) }), title: l.phoneSuccessTitle, description: l.phoneSuccessDescription }), loginUrl && (_jsx("p", { className: "text-center text-sm text-muted-foreground", children: _jsxs(LinkComp, { href: loginUrl, className: AUTH_LINK_CLASS, children: ["\u2190 ", l.backToSignInText] }) }))] }));
     }
     if (submitted) {
-        const successMsg = l.successDescription.includes('{{email}}')
-            ? l.successDescription.replace('{{email}}', email)
+        const successMsg = l.successDescription.includes('{email}')
+            ? l.successDescription.replace('{email}', email)
             : `${l.successDescription} ${email}`;
         return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: _jsx("span", { className: "flex h-12 w-12 items-center justify-center rounded-2xl bg-emerald-500/10 text-emerald-600 ring-1 ring-emerald-500/15 dark:text-emerald-400", children: _jsx(AuthMailIcon, {}) }), title: l.successTitle, description: successMsg }), loginUrl && (_jsx("p", { className: "text-center text-sm text-muted-foreground", children: _jsxs(LinkComp, { href: loginUrl, className: AUTH_LINK_CLASS, children: ["\u2190 ", l.backToSignInText] }) }))] }));
     }

package/dist/LoginForm.d.ts

@@ -6,7 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import React from 'react';
-import type { AuthLinkComponentProps } from './types';
+import type { AuthLinkComponentProps } from './types.js';
 /** Translatable labels for the LoginForm */
 export interface LoginFormLabels {
     emailLabel?: string;
@@ -22,8 +22,17 @@ export interface LoginFormLabels {
     submittingButton?: string;
     noAccountText?: string;
     signUpText?: string;
-    /** Divider label between social sign-in and email/password (defaults to "or") */
+    /**
+     * Divider label between the social provider buttons and the email/password
+     * form (defaults to "or continue with email"). Rendered only when the server
+     * reports at least one social provider.
+     */
     orText?: string;
+    /**
+     * Social provider button label (defaults to "Continue with {provider}");
+     * `{provider}` is replaced with the provider's display name.
+     */
+    socialButton?: string;
     /** Label for the SSO sign-in button (defaults to "Sign in with SSO") */
     ssoButton?: string;
     /**

package/dist/LoginForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginForm.d.ts","sourceRoot":"","sources":["../src/LoginForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAInD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAYtD,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8GAA8G;IAC9G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAsBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,EACxB,SAAS,EACT,OAAO,EACP,WAAyB,EACzB,iBAAsC,EACtC,KAAiC,EACjC,WAAyD,EACzD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,cAAc,qBAgbhB"}
+{"version":3,"file":"LoginForm.d.ts","sourceRoot":"","sources":["../src/LoginForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAInD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAWzD,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8GAA8G;IAC9G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAsBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,EACxB,SAAS,EACT,OAAO,EACP,WAAyB,EACzB,iBAAsC,EACtC,KAAiC,EACjC,WAAyD,EACzD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,cAAc,qBAsbhB"}

package/dist/LoginForm.js

@@ -7,10 +7,10 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
  * LICENSE file in the root directory of this source tree.
  */
 import { useEffect, useState } from 'react';
-import { useAuth } from './useAuth';
-import { SocialSignInButtons } from './SocialSignInButtons';
-import { looksLikePhoneIdentifier, normalizePhoneIdentifier } from './phone-identifier';
-import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthSpinner, } from './authStyles';
+import { useAuth } from './useAuth.js';
+import { SocialSignInButtons } from './SocialSignInButtons.js';
+import { looksLikePhoneIdentifier, normalizePhoneIdentifier } from './phone-identifier.js';
+import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthSpinner, } from './authStyles.js';
 const DefaultLink = ({ href, className, children }) => (_jsx("a", { href: href, className: className, children: children }));
 const DefaultLockIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", className: "h-6 w-6", "aria-hidden": "true", children: [_jsx("rect", { x: "3", y: "11", width: "18", height: "11", rx: "2" }), _jsx("path", { d: "M7 11V7a5 5 0 0 1 10 0v4" })] }));
 /**
@@ -117,7 +117,6 @@ export function LoginForm({ onSuccess, onError, registerUrl = '/register', forgo
         submittingButton: labels.submittingButton ?? 'Signing in…',
         noAccountText: labels.noAccountText ?? "Don't have an account?",
         signUpText: labels.signUpText ?? 'Sign up',
-        orText: labels.orText ?? 'or',
         ssoButton: labels.ssoButton ?? 'Sign in with SSO',
         usePasswordText: labels.usePasswordText ?? 'Use a password instead',
         backToSsoText: labels.backToSsoText ?? 'Back to single sign-on',
@@ -234,7 +233,7 @@ export function LoginForm({ onSuccess, onError, registerUrl = '/register', forgo
             setSsoSubmitting(false);
         }
     };
-    return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: hideIcon ? undefined : (icon ?? _jsx(DefaultLockIcon, {})), title: title, description: ssoEnforced && !showPasswordFallback ? l.ssoOnlyDescription : description }), _jsx("div", { className: "space-y-5", children: configPending ? (_jsx("div", { className: "flex justify-center py-10", role: "status", "aria-live": "polite", "data-testid": "login-config-loading", children: _jsx(AuthSpinner, {}) })) : (_jsxs(_Fragment, { children: [_jsx(SocialSignInButtons, { mode: "sign-in", onProvidersResolved: (hasProviders) => setHasSocialProviders(hasProviders) }), passwordFormVisible ? (mode === 'phone-otp' ? (_jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-phone", className: AUTH_FIELD_LABEL_CLASS, children: l.phoneLabel }), _jsx("input", { id: "login-phone", type: "tel", placeholder: l.phonePlaceholder, value: phone, onChange: (e) => setPhone(e.target.value), required: true, autoComplete: "tel", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-otp", className: AUTH_FIELD_LABEL_CLASS, children: l.otpCodeLabel }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { id: "login-otp", type: "text", inputMode: "numeric", placeholder: l.otpCodePlaceholder, value: otpCode, onChange: (e) => setOtpCode(e.target.value), required: true, autoComplete: "one-time-code", disabled: isLoading, className: AUTH_INPUT_CLASS }), _jsxs("button", { type: "button", onClick: handleSendOtp, disabled: otpSending || otpCooldown > 0 || !phone.trim() || isLoading, className: "shrink-0 rounded-md border border-input bg-background px-3 py-2 text-sm font-medium transition-colors hover:bg-accent disabled:opacity-50", children: [otpSending && _jsx(AuthSpinner, {}), otpCooldown > 0
+    return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: hideIcon ? undefined : (icon ?? _jsx(DefaultLockIcon, {})), title: title, description: ssoEnforced && !showPasswordFallback ? l.ssoOnlyDescription : description }), _jsx("div", { className: "space-y-5", children: configPending ? (_jsx("div", { className: "flex justify-center py-10", role: "status", "aria-live": "polite", "data-testid": "login-config-loading", children: _jsx(AuthSpinner, {}) })) : (_jsxs(_Fragment, { children: [_jsx(SocialSignInButtons, { mode: "sign-in", dividerText: labels.orText, buttonText: labels.socialButton, onProvidersResolved: (hasProviders) => setHasSocialProviders(hasProviders) }), passwordFormVisible ? (mode === 'phone-otp' ? (_jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-phone", className: AUTH_FIELD_LABEL_CLASS, children: l.phoneLabel }), _jsx("input", { id: "login-phone", type: "tel", placeholder: l.phonePlaceholder, value: phone, onChange: (e) => setPhone(e.target.value), required: true, autoComplete: "tel", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-otp", className: AUTH_FIELD_LABEL_CLASS, children: l.otpCodeLabel }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { id: "login-otp", type: "text", inputMode: "numeric", placeholder: l.otpCodePlaceholder, value: otpCode, onChange: (e) => setOtpCode(e.target.value), required: true, autoComplete: "one-time-code", disabled: isLoading, className: AUTH_INPUT_CLASS }), _jsxs("button", { type: "button", onClick: handleSendOtp, disabled: otpSending || otpCooldown > 0 || !phone.trim() || isLoading, className: "shrink-0 rounded-md border border-input bg-background px-3 py-2 text-sm font-medium transition-colors hover:bg-accent disabled:opacity-50", children: [otpSending && _jsx(AuthSpinner, {}), otpCooldown > 0
                                                             ? l.resendOtpCountdownText.replace('{seconds}', String(otpCooldown))
                                                             : l.sendOtpButton] })] })] }), _jsxs("button", { type: "submit", disabled: isLoading || !otpSent, className: AUTH_PRIMARY_BUTTON_CLASS, children: [isLoading && _jsx(AuthSpinner, {}), isLoading ? l.submittingButton : l.submitButton] }), _jsx("button", { type: "button", onClick: () => switchMode('password'), className: "w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.usePasswordSignInText })] })) : (_jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-email", className: AUTH_FIELD_LABEL_CLASS, children: phonePasswordEnabled ? l.emailOrPhoneLabel : l.emailLabel }), _jsx("input", { id: "login-email", 
                                             // `text` (not `email`) when a phone number is also accepted, so the

package/dist/PreviewBanner.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { useAuth } from './useAuth';
+import { useAuth } from './useAuth.js';
 /**
  * Banner component that displays a message when the app is in preview mode.
  * Only renders when preview mode is active. Uses the bannerMessage from