@object-ui/auth 17.5.0 → 17.7.0

package/dist/RegisterForm.d.ts

@@ -6,7 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import React from 'react';
-import type { AuthLinkComponentProps } from './types';
+import type { AuthLinkComponentProps } from './types.js';
 /** Translatable labels for the RegisterForm */
 export interface RegisterFormLabels {
     nameLabel?: string;
@@ -23,8 +23,17 @@ export interface RegisterFormLabels {
     submittingButton?: string;
     hasAccountText?: string;
     signInText?: string;
-    /** Divider label between social sign-up and email/password (defaults to "or") */
+    /**
+     * Divider label between the social provider buttons and the email/password
+     * form (defaults to "or continue with email"). Rendered only when the server
+     * reports at least one social provider.
+     */
     orText?: string;
+    /**
+     * Social provider button label (defaults to "Sign up with {provider}");
+     * `{provider}` is replaced with the provider's display name.
+     */
+    socialButton?: string;
 }
 export interface RegisterFormProps {
     /** Callback on successful registration AND auto sign-in. Not called when the
@@ -34,6 +43,16 @@ export interface RegisterFormProps {
      *  sign-in on email verification. The page should swap the form for a
      *  "check your inbox" confirmation. */
     onVerificationRequired?: (email: string) => void;
+    /**
+     * Where the email-verification link should land once the address is
+     * verified — e.g. the invitation page the user registered from
+     * (objectui#10893). Forwarded to `signUp` as better-auth's sign-up
+     * `callbackURL`; see `SignUpData.callbackURL` for the only shapes the server
+     * accepts (a document-relative `./…` fails the whole sign-up). Omitted, the
+     * server default (`/`) applies. Only matters when the server requires email
+     * verification — an auto-signed-in registration calls `onSuccess` instead.
+     */
+    verificationCallbackURL?: string;
     /** Callback on registration error */
     onError?: (error: Error) => void;
     /** Link to login page */
@@ -70,5 +89,5 @@ export interface RegisterFormProps {
  * />
  * ```
  */
-export declare function RegisterForm({ onSuccess, onVerificationRequired, onError, loginUrl, title, description, icon, hideIcon, linkComponent: LinkComp, labels, errorMessages, }: RegisterFormProps): React.JSX.Element;
+export declare function RegisterForm({ onSuccess, onVerificationRequired, verificationCallbackURL, onError, loginUrl, title, description, icon, hideIcon, linkComponent: LinkComp, labels, errorMessages, }: RegisterFormProps): React.JSX.Element;
 //# sourceMappingURL=RegisterForm.d.ts.map

package/dist/RegisterForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RegisterForm.d.ts","sourceRoot":"","sources":["../src/RegisterForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAmB,MAAM,OAAO,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAWtD,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC;sFACkF;IAClF,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB;;2CAEuC;IACvC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,EAC3B,SAAS,EACT,sBAAsB,EACtB,OAAO,EACP,QAAmB,EACnB,KAA2B,EAC3B,WAAqD,EACrD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,iBAAiB,qBAuKnB"}
+{"version":3,"file":"RegisterForm.d.ts","sourceRoot":"","sources":["../src/RegisterForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAmB,MAAM,OAAO,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAWzD,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC;sFACkF;IAClF,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB;;2CAEuC;IACvC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,EAC3B,SAAS,EACT,sBAAsB,EACtB,uBAAuB,EACvB,OAAO,EACP,QAAmB,EACnB,KAA2B,EAC3B,WAAqD,EACrD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,iBAAiB,qBA4KnB"}

package/dist/RegisterForm.js

@@ -7,9 +7,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * LICENSE file in the root directory of this source tree.
  */
 import { useState } from 'react';
-import { useAuth } from './useAuth';
-import { SocialSignInButtons } from './SocialSignInButtons';
-import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthSpinner, } from './authStyles';
+import { useAuth } from './useAuth.js';
+import { SocialSignInButtons } from './SocialSignInButtons.js';
+import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthSpinner, } from './authStyles.js';
 const DefaultLink = ({ href, className, children }) => (_jsx("a", { href: href, className: className, children: children }));
 const DefaultUserPlusIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", className: "h-6 w-6", "aria-hidden": "true", children: [_jsx("path", { d: "M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2" }), _jsx("circle", { cx: "9", cy: "7", r: "4" }), _jsx("line", { x1: "19", y1: "8", x2: "19", y2: "14" }), _jsx("line", { x1: "22", y1: "11", x2: "16", y2: "11" })] }));
 /**
@@ -25,7 +25,7 @@ const DefaultUserPlusIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "n
  * />
  * ```
  */
-export function RegisterForm({ onSuccess, onVerificationRequired, onError, loginUrl = '/login', title = 'Create an account', description = 'Enter your information to get started', icon, hideIcon = false, linkComponent: LinkComp = DefaultLink, labels = {}, errorMessages, }) {
+export function RegisterForm({ onSuccess, onVerificationRequired, verificationCallbackURL, onError, loginUrl = '/login', title = 'Create an account', description = 'Enter your information to get started', icon, hideIcon = false, linkComponent: LinkComp = DefaultLink, labels = {}, errorMessages, }) {
     const { signUp, isLoading } = useAuth();
     const [name, setName] = useState('');
     const [email, setEmail] = useState('');
@@ -47,7 +47,6 @@ export function RegisterForm({ onSuccess, onVerificationRequired, onError, login
         submittingButton: labels.submittingButton ?? 'Creating account…',
         hasAccountText: labels.hasAccountText ?? 'Already have an account?',
         signInText: labels.signInText ?? 'Sign in',
-        orText: labels.orText ?? 'or',
     };
     const handleSubmit = async (e) => {
         e.preventDefault();
@@ -64,7 +63,7 @@ export function RegisterForm({ onSuccess, onVerificationRequired, onError, login
         // that the server rejects as "Invalid email" (#3238) — trim before use.
         const trimmedEmail = email.trim();
         try {
-            const result = await signUp(name, trimmedEmail, password);
+            const result = await signUp(name, trimmedEmail, password, verificationCallbackURL);
             if (result?.requiresVerification) {
                 onVerificationRequired?.(trimmedEmail);
                 return;
@@ -78,5 +77,5 @@ export function RegisterForm({ onSuccess, onVerificationRequired, onError, login
             onError?.(authError);
         }
     };
-    return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: hideIcon ? undefined : (icon ?? _jsx(DefaultUserPlusIcon, {})), title: title, description: description }), _jsxs("div", { className: "space-y-5", children: [_jsx(SocialSignInButtons, { mode: "sign-up" }), _jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-name", className: AUTH_FIELD_LABEL_CLASS, children: l.nameLabel }), _jsx("input", { id: "register-name", type: "text", placeholder: l.namePlaceholder, value: name, onChange: (e) => setName(e.target.value), required: true, autoComplete: "name", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-email", className: AUTH_FIELD_LABEL_CLASS, children: l.emailLabel }), _jsx("input", { id: "register-email", type: "email", placeholder: l.emailPlaceholder, value: email, onChange: (e) => setEmail(e.target.value), required: true, autoComplete: "email", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-password", className: AUTH_FIELD_LABEL_CLASS, children: l.passwordLabel }), _jsx("input", { id: "register-password", type: "password", placeholder: l.passwordPlaceholder, value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 8, autoComplete: "new-password", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-confirm-password", className: AUTH_FIELD_LABEL_CLASS, children: l.confirmPasswordLabel }), _jsx("input", { id: "register-confirm-password", type: "password", placeholder: l.confirmPasswordPlaceholder, value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 8, autoComplete: "new-password", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("button", { type: "submit", disabled: isLoading, className: AUTH_PRIMARY_BUTTON_CLASS, children: [isLoading && _jsx(AuthSpinner, {}), isLoading ? l.submittingButton : l.submitButton] })] })] }), loginUrl && (_jsxs("p", { className: "px-8 text-center text-sm text-muted-foreground", children: [l.hasAccountText, ' ', _jsx(LinkComp, { href: loginUrl, className: AUTH_LINK_CLASS, children: l.signInText })] }))] }));
+    return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: hideIcon ? undefined : (icon ?? _jsx(DefaultUserPlusIcon, {})), title: title, description: description }), _jsxs("div", { className: "space-y-5", children: [_jsx(SocialSignInButtons, { mode: "sign-up", dividerText: labels.orText, buttonText: labels.socialButton }), _jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-name", className: AUTH_FIELD_LABEL_CLASS, children: l.nameLabel }), _jsx("input", { id: "register-name", type: "text", placeholder: l.namePlaceholder, value: name, onChange: (e) => setName(e.target.value), required: true, autoComplete: "name", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-email", className: AUTH_FIELD_LABEL_CLASS, children: l.emailLabel }), _jsx("input", { id: "register-email", type: "email", placeholder: l.emailPlaceholder, value: email, onChange: (e) => setEmail(e.target.value), required: true, autoComplete: "email", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-password", className: AUTH_FIELD_LABEL_CLASS, children: l.passwordLabel }), _jsx("input", { id: "register-password", type: "password", placeholder: l.passwordPlaceholder, value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 8, autoComplete: "new-password", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-confirm-password", className: AUTH_FIELD_LABEL_CLASS, children: l.confirmPasswordLabel }), _jsx("input", { id: "register-confirm-password", type: "password", placeholder: l.confirmPasswordPlaceholder, value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 8, autoComplete: "new-password", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("button", { type: "submit", disabled: isLoading, className: AUTH_PRIMARY_BUTTON_CLASS, children: [isLoading && _jsx(AuthSpinner, {}), isLoading ? l.submittingButton : l.submitButton] })] })] }), loginUrl && (_jsxs("p", { className: "px-8 text-center text-sm text-muted-foreground", children: [l.hasAccountText, ' ', _jsx(LinkComp, { href: loginUrl, className: AUTH_LINK_CLASS, children: l.signInText })] }))] }));
 }

package/dist/SocialSignInButtons.d.ts

@@ -13,8 +13,15 @@ export interface SocialSignInButtonsProps {
     callbackURL?: string;
     /** Where the provider should redirect on error. Defaults to current page. */
     errorCallbackURL?: string;
-    /** Divider text shown between social buttons and the email form */
+    /** Divider text shown between social buttons and the email form (defaults to "or continue with email") */
     dividerText?: string;
+    /**
+     * Provider button label, for i18n. `{provider}` is replaced with the
+     * provider's display name, so a translation places the name where its
+     * grammar needs it. Defaults to "Continue with {provider}" in `sign-in`
+     * mode and "Sign up with {provider}" in `sign-up` mode.
+     */
+    buttonText?: string;
     /** Called once after config resolves with whether any social providers are available. */
     onProvidersResolved?: (hasProviders: boolean) => void;
 }
@@ -25,5 +32,5 @@ export interface SocialSignInButtonsProps {
  *
  * Returns `null` while loading or when the server reports no providers.
  */
-export declare function SocialSignInButtons({ mode, callbackURL, errorCallbackURL, dividerText, onProvidersResolved, }: SocialSignInButtonsProps): React.JSX.Element | null;
+export declare function SocialSignInButtons({ mode, callbackURL, errorCallbackURL, dividerText, buttonText, onProvidersResolved, }: SocialSignInButtonsProps): React.JSX.Element | null;
 //# sourceMappingURL=SocialSignInButtons.d.ts.map

package/dist/SocialSignInButtons.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SocialSignInButtons.d.ts","sourceRoot":"","sources":["../src/SocialSignInButtons.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAkFnD,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC7B,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,IAAI,CAAC;CACvD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,IAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,WAAsC,EACtC,mBAAmB,GACpB,EAAE,wBAAwB,4BAyF1B"}
+{"version":3,"file":"SocialSignInButtons.d.ts","sourceRoot":"","sources":["../src/SocialSignInButtons.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAkFnD,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC7B,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0GAA0G;IAC1G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,IAAI,CAAC;CACvD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,IAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,WAAsC,EACtC,UAAU,EACV,mBAAmB,GACpB,EAAE,wBAAwB,4BA2F1B"}

package/dist/SocialSignInButtons.js

@@ -7,8 +7,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * LICENSE file in the root directory of this source tree.
  */
 import { useEffect, useState } from 'react';
-import { useAuth } from './useAuth';
-import { AuthSpinner } from './authStyles';
+import { useAuth } from './useAuth.js';
+import { AuthSpinner } from './authStyles.js';
 // Brand name overrides for providers whose `name` from the server may be unset
 // or where we want to canonicalize casing.
 const PROVIDER_LABEL = {
@@ -48,7 +48,7 @@ function ProviderIcon({ id }) {
  *
  * Returns `null` while loading or when the server reports no providers.
  */
-export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallbackURL, dividerText = 'or continue with email', onProvidersResolved, }) {
+export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallbackURL, dividerText = 'or continue with email', buttonText, onProvidersResolved, }) {
     const { getAuthConfig, signInWithProvider } = useAuth();
     const [providers, setProviders] = useState([]);
     const [loading, setLoading] = useState(true);
@@ -86,7 +86,7 @@ export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallba
     }, [getAuthConfig]);
     if (loading || providers.length === 0)
         return null;
-    const label = mode === 'sign-in' ? 'Continue with' : 'Sign up with';
+    const labelTemplate = buttonText ?? (mode === 'sign-in' ? 'Continue with {provider}' : 'Sign up with {provider}');
     const defaultCallback = typeof window !== 'undefined' ? window.location.href : undefined;
     const onClick = async (provider) => {
         if (pendingId)
@@ -107,5 +107,5 @@ export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallba
             setPendingId(null);
         }
     };
-    return (_jsxs("div", { className: "flex flex-col gap-2", children: [error && (_jsx("div", { className: "rounded-md bg-destructive/15 p-3 text-sm text-destructive", role: "alert", children: error })), providers.map((p) => (_jsxs("button", { type: "button", onClick: () => onClick(p), disabled: pendingId !== null, "aria-busy": pendingId === p.id, className: "inline-flex h-10 w-full items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium ring-offset-background transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50", children: [pendingId === p.id ? _jsx(AuthSpinner, {}) : _jsx(ProviderIcon, { id: p.id }), label, " ", PROVIDER_LABEL[p.id] ?? p.name] }, p.id))), _jsxs("div", { className: "relative my-1", children: [_jsx("div", { className: "absolute inset-0 flex items-center", children: _jsx("span", { className: "w-full border-t" }) }), _jsx("div", { className: "relative flex justify-center text-xs uppercase", children: _jsx("span", { className: "bg-background px-2 text-muted-foreground", children: dividerText }) })] })] }));
+    return (_jsxs("div", { className: "flex flex-col gap-2", children: [error && (_jsx("div", { className: "rounded-md bg-destructive/15 p-3 text-sm text-destructive", role: "alert", children: error })), providers.map((p) => (_jsxs("button", { type: "button", onClick: () => onClick(p), disabled: pendingId !== null, "aria-busy": pendingId === p.id, className: "inline-flex h-10 w-full items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium ring-offset-background transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50", children: [pendingId === p.id ? _jsx(AuthSpinner, {}) : _jsx(ProviderIcon, { id: p.id }), labelTemplate.replace('{provider}', () => PROVIDER_LABEL[p.id] ?? p.name)] }, p.id))), _jsxs("div", { className: "relative my-1", children: [_jsx("div", { className: "absolute inset-0 flex items-center", children: _jsx("span", { className: "w-full border-t" }) }), _jsx("div", { className: "relative flex justify-center text-xs uppercase", children: _jsx("span", { className: "bg-background px-2 text-muted-foreground", children: dividerText }) })] })] }));
 }

package/dist/UserMenu.d.ts

@@ -21,7 +21,7 @@ export interface UserMenuProps {
  * Shows avatar, name, email, and common actions (profile, settings, sign out).
  *
  * This is a headless component that provides the user data and actions.
- * The actual dropdown rendering is handled by the consumer (e.g., AppSidebar).
+ * The actual dropdown rendering is handled by the consumer.
  *
  * @example
  * ```tsx

package/dist/UserMenu.js

@@ -1,12 +1,12 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useAuth } from './useAuth';
-import { getUserInitials } from './types';
+import { useAuth } from './useAuth.js';
+import { getUserInitials } from './types.js';
 /**
  * User menu component displaying the authenticated user's info.
  * Shows avatar, name, email, and common actions (profile, settings, sign out).
  *
  * This is a headless component that provides the user data and actions.
- * The actual dropdown rendering is handled by the consumer (e.g., AppSidebar).
+ * The actual dropdown rendering is handled by the consumer.
  *
  * @example
  * ```tsx

package/dist/createAuthClient.d.ts

@@ -5,7 +5,7 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import type { AuthClient, AuthClientConfig } from './types';
+import type { AuthClient, AuthClientConfig } from './types.js';
 /**
  * Simple token storage backed by localStorage.
  * Falls back to in-memory storage when localStorage is unavailable (SSR, tests).

package/dist/createAuthClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,SAAS,CAAC;AAIjB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;kCACD,IAAI;WAE/B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aAkBf,IAAI;IASb;;;OAGG;gCACyB,MAAM,IAAI,GAAG,MAAM,IAAI;CAMpD,CAAC;AAwIF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAqrBrE"}
+{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,YAAY,CAAC;AAKpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;kCACD,IAAI;WAE/B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aAkBf,IAAI;IASb;;;OAGG;gCACyB,MAAM,IAAI,GAAG,MAAM,IAAI;CAMpD,CAAC;AA2KF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA2rBrE"}

package/dist/createAuthClient.js

@@ -7,6 +7,7 @@
  */
 import { createAuthClient as createBetterAuthClient } from 'better-auth/client';
 import { organizationClient, twoFactorClient } from 'better-auth/client/plugins';
+import { AUTH_INVITATION_STATUSES, isAuthInvitationStatus } from './invitation-status.js';
 const TOKEN_STORAGE_KEY = 'auth-session-token';
 /**
  * Simple token storage backed by localStorage.
@@ -109,6 +110,37 @@ function toAuthError(error, fallbackMessage) {
         err.code = error.code;
     return err;
 }
+/**
+ * The wire boundary for invitations (objectui#3879).
+ *
+ * better-auth's client hands these routes back as `any`, so `as AuthInvitation`
+ * was a claim nothing checked — and with `status` narrowed to a closed union,
+ * an unchecked cast would make that union a comment again the day a backend
+ * stored a fifth value. This is the ONE place the claim is verified.
+ *
+ * It fails LOUDLY, naming the offending value, rather than degrading: a status
+ * outside better-auth's own `InvitationStatus` is a producer defect, and the
+ * alternatives all hide it — a neutral badge label renders it as UI copy in ten
+ * packs (the objectui#3879 symptom), and dropping the row deletes an invitation
+ * from an administrative ledger without saying so. Both call paths already
+ * render a rejection with a retry (`InvitationsPage`, `AcceptInvitationPage`),
+ * so the throw lands on a designed surface; `resolveOrgErrorMessage` shows the
+ * sentence verbatim, which is that module's own stated preference over
+ * swallowing an error.
+ */
+function asAuthInvitation(raw, method) {
+    const status = raw?.status;
+    if (!isAuthInvitationStatus(status)) {
+        throw new Error(`${method}: unexpected invitation status ${JSON.stringify(status)} — ` +
+            `expected one of ${AUTH_INVITATION_STATUSES.join(' | ')}`);
+    }
+    return raw;
+}
+/** Same boundary, per row, for the list-returning invitation routes. */
+function asAuthInvitations(raw, method) {
+    const rows = Array.isArray(raw) ? raw : [];
+    return rows.map((row) => asAuthInvitation(row, method));
+}
 /**
  * Resolve a baseURL (which may be relative or absolute) into the
  * `{ origin, basePath }` pair required by the better-auth client.
@@ -328,6 +360,12 @@ export function createAuthClient(config) {
                 email: signUpData.email,
                 password: signUpData.password,
                 name: signUpData.name,
+                // objectui#10893 — the verification mail's link lands here. Without
+                // it better-auth writes `callbackURL=/`, and an invitee who registers
+                // from an invitation link is dropped on the workspace picker instead
+                // of the invitation. Only sent when the caller has somewhere to go,
+                // so the server default is untouched otherwise.
+                ...(signUpData.callbackURL ? { callbackURL: signUpData.callbackURL } : {}),
             });
             if (error) {
                 throw toAuthError(error);
@@ -753,7 +791,7 @@ export function createAuthClient(config) {
             });
             if (error)
                 throw toAuthError(error, 'Failed to invite member');
-            return data;
+            return asAuthInvitation(data, 'inviteMember');
         },
         async removeMember(removeData) {
             const { error } = await betterAuth.organization.removeMember({
@@ -802,7 +840,7 @@ export function createAuthClient(config) {
             });
             if (error)
                 throw toAuthError(error, 'Failed to list invitations');
-            return (data ?? []);
+            return asAuthInvitations(data, 'listInvitations');
         },
         async cancelInvitation(invitationId) {
             const { error } = await betterAuth.organization.cancelInvitation({ invitationId });
@@ -815,7 +853,7 @@ export function createAuthClient(config) {
             });
             if (error)
                 throw toAuthError(error, 'Failed to load invitation');
-            return data;
+            return asAuthInvitation(data, 'getInvitation');
         },
         async acceptInvitation(invitationId) {
             const { error } = await betterAuth.organization.acceptInvitation({ invitationId });
@@ -831,7 +869,7 @@ export function createAuthClient(config) {
             const { data, error } = await betterAuth.organization.listUserInvitations();
             if (error)
                 throw toAuthError(error, 'Failed to list invitations');
-            return (data ?? []);
+            return asAuthInvitations(data, 'listUserInvitations');
         },
     };
 }

package/dist/createAuthenticatedFetch.d.ts

@@ -15,15 +15,13 @@ export interface AuthenticatedAdapterOptions {
     [key: string]: unknown;
 }
 /**
- * Get/set the active organization ID for tenant-scoped API requests.
- * Used by createAuthenticatedFetch to inject X-Tenant-ID header.
+ * Re-exported from its own module so this file stays the WIRE lane and the
+ * storage lane has one home. `ActiveOrganizationStorage` moved out when it
+ * gained per-user scoping (objectui#5664); the export identity is unchanged,
+ * so `@object-ui/auth`'s barrel, this package's tests and every consumer
+ * import the same symbol from the same place they did before.
  */
-export declare const ActiveOrganizationStorage: {
-    _memoryValue: string | null;
-    get(): string | null;
-    set(orgId: string): void;
-    clear(): void;
-};
+export { ActiveOrganizationStorage, SessionUserScope, purgePreviousUserClientState, getSessionOwnerChangeCount, subscribeSessionOwnerChange, } from './ActiveOrganizationStorage.js';
 export interface CreateAuthenticatedFetchOptions {
     /**
      * When true, requests whose URL resolves to a different origin than the
@@ -39,7 +37,9 @@ export interface CreateAuthenticatedFetchOptions {
 /**
  * Creates an authenticated fetch wrapper that injects the Bearer token
  * from localStorage into every request to the ObjectStack API.
- * Also injects X-Tenant-ID header when an active organization is set.
+ * Also injects X-Tenant-ID header when an active organization is set — see the
+ * "The `X-Tenant-ID` edge contract" section of this package's README for what
+ * that header means, who reads it, and the window in which it is not sent.
  *
  * @example
  * ```ts

package/dist/createAuthenticatedFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthenticatedFetch.d.ts","sourceRoot":"","sources":["../src/createAuthenticatedFetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;;GAGG;AACH,eAAO,MAAM,yBAAyB;kBACd,MAAM,GAAG,IAAI;WAE5B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aASf,IAAI;CAQd,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,+BAA+B,GACxC,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2ErE"}
+{"version":3,"file":"createAuthenticatedFetch.d.ts","sourceRoot":"","sources":["../src/createAuthenticatedFetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,+BAA+B,GACxC,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CA+GrE"}

package/dist/createAuthenticatedFetch.js

@@ -5,43 +5,17 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import { TokenStorage } from './createAuthClient';
-import { authGateEvents, detectAuthGate } from './auth-gate-events';
-const ACTIVE_ORG_STORAGE_KEY = 'auth-active-organization-id';
+import { TokenStorage } from './createAuthClient.js';
+import { authGateEvents, detectAuthGate } from './auth-gate-events.js';
+import { ActiveOrganizationStorage } from './ActiveOrganizationStorage.js';
 /**
- * Get/set the active organization ID for tenant-scoped API requests.
- * Used by createAuthenticatedFetch to inject X-Tenant-ID header.
+ * Re-exported from its own module so this file stays the WIRE lane and the
+ * storage lane has one home. `ActiveOrganizationStorage` moved out when it
+ * gained per-user scoping (objectui#5664); the export identity is unchanged,
+ * so `@object-ui/auth`'s barrel, this package's tests and every consumer
+ * import the same symbol from the same place they did before.
  */
-export const ActiveOrganizationStorage = {
-    _memoryValue: null,
-    get() {
-        try {
-            if (typeof localStorage !== 'undefined') {
-                return localStorage.getItem(ACTIVE_ORG_STORAGE_KEY);
-            }
-        }
-        catch { /* SSR / test */ }
-        return this._memoryValue;
-    },
-    set(orgId) {
-        this._memoryValue = orgId;
-        try {
-            if (typeof localStorage !== 'undefined') {
-                localStorage.setItem(ACTIVE_ORG_STORAGE_KEY, orgId);
-            }
-        }
-        catch { /* SSR / test */ }
-    },
-    clear() {
-        this._memoryValue = null;
-        try {
-            if (typeof localStorage !== 'undefined') {
-                localStorage.removeItem(ACTIVE_ORG_STORAGE_KEY);
-            }
-        }
-        catch { /* SSR / test */ }
-    },
-};
+export { ActiveOrganizationStorage, SessionUserScope, purgePreviousUserClientState, getSessionOwnerChangeCount, subscribeSessionOwnerChange, } from './ActiveOrganizationStorage.js';
 /** True when `url` resolves to a different origin than the current page. */
 function isCrossOrigin(url) {
     if (typeof window === 'undefined' || !window.location)
@@ -56,7 +30,9 @@ function isCrossOrigin(url) {
 /**
  * Creates an authenticated fetch wrapper that injects the Bearer token
  * from localStorage into every request to the ObjectStack API.
- * Also injects X-Tenant-ID header when an active organization is set.
+ * Also injects X-Tenant-ID header when an active organization is set — see the
+ * "The `X-Tenant-ID` edge contract" section of this package's README for what
+ * that header means, who reads it, and the window in which it is not sent.
  *
  * @example
  * ```ts
@@ -83,7 +59,43 @@ export function createAuthenticatedFetch(options) {
         if (token && isApiCall) {
             headers.set('Authorization', `Bearer ${token}`);
         }
-        // Inject tenant header for multi-tenant routing
+        // ── `X-Tenant-ID` — the edge routing contract (objectui#5279) ────────
+        //
+        // WHAT IT MEANS. A routing hint for the hosting edge: "this request belongs
+        // to tenant <id>". The value is the better-auth `activeOrganizationId` the
+        // session already carries. It is NOT an identity claim, NOT an
+        // authorization input, and NOT what scopes rows.
+        //
+        // DO NOT DELETE THIS ON THE STRENGTH OF A GREP. The framework
+        // (`objectstack`) does not read it: `resolveAuthzContext` takes `tenantId`
+        // from the API-key principal or `session.activeOrganizationId` and never
+        // from a header, and environment routing reads the hostname and
+        // `X-Environment-Id`. So a search confined to this repo plus the framework
+        // finds zero consumers and reads as "dead stamp" — which is the false
+        // premise objectui#5279 was filed on. The consumer is in the CLOUD repo,
+        // which neither checkout contains: `service-tenant`'s `tenant-context.ts`
+        // resolves the header, and `tenant-router`'s `turso-multi-tenant.zod.ts`
+        // configures that resolution. The configuration contract IS readable from
+        // here — `TenantRoutingConfigSchema` in `@objectstack/spec/cloud` defaults
+        // `tenantHeaderName` to `X-Tenant-ID` and ranks `header` SECOND of six
+        // identification sources, behind `subdomain`.
+        //
+        // THE UNSTAMPED-FIRST-REQUEST GAP. `ActiveOrganizationStorage` is filled
+        // only after AuthProvider's async organization chain resolves, so early
+        // requests go out with the header ABSENT — never present-and-empty. A
+        // reader must fall through to its next identification source rather than
+        // fail closed. Nothing about row visibility rides on this: the framework
+        // scopes from the session, so a response computed inside the window is
+        // still computed for the right tenant.
+        //
+        // Not gated on `isApiCall`, unlike `Authorization` and `Accept-Language`
+        // above — recorded as the behaviour that ships, not endorsed; the
+        // asymmetry is reported on objectui#5279 for triage to route. A wrapper
+        // built with `sameOriginOnly` short-circuits every cross-origin request
+        // before this line.
+        //
+        // Full contract, including what a reader may and may not assume: this
+        // package's README, "The `X-Tenant-ID` edge contract".
         const activeOrgId = ActiveOrganizationStorage.get();
         if (activeOrgId) {
             headers.set('X-Tenant-ID', activeOrgId);
@@ -94,7 +106,7 @@ export function createAuthenticatedFetch(options) {
         // switcher, so reading it here means a language switch carries the new
         // `Accept-Language` on every subsequent request — closing the gap where
         // server-resolved labels stayed in the old language until a page refresh
-        // (issue #1319). We only fold it in for our own API calls, and never
+        // (issue objectstack-ai/objectstack#1319). We only fold it in for our own API calls, and never
         // clobber an `Accept-Language` the caller set explicitly.
         if (isApiCall && !headers.has('Accept-Language') && typeof document !== 'undefined') {
             const lang = document.documentElement.lang;

package/dist/index.d.ts

@@ -19,23 +19,25 @@
  *
  * @packageDocumentation
  */
-export { AuthProvider, type AuthProviderProps } from './AuthProvider';
-export { useAuth } from './useAuth';
-export { useIsWorkspaceAdmin } from './useIsWorkspaceAdmin';
-export { AuthGuard, type AuthGuardProps } from './AuthGuard';
-export { AuthShell, type AuthShellProps, type AuthShellBrandPanel } from './AuthShell';
-export { LoginForm, type LoginFormProps, type LoginFormLabels } from './LoginForm';
-export { RegisterForm, type RegisterFormProps, type RegisterFormLabels } from './RegisterForm';
-export { ForgotPasswordForm, type ForgotPasswordFormProps, type ForgotPasswordFormLabels } from './ForgotPasswordForm';
-export { SocialSignInButtons, type SocialSignInButtonsProps } from './SocialSignInButtons';
-export { UserMenu, type UserMenuProps } from './UserMenu';
-export { PreviewBanner, type PreviewBannerProps } from './PreviewBanner';
-export { createAuthClient, TokenStorage } from './createAuthClient';
-export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier';
-export { createAuthenticatedFetch, ActiveOrganizationStorage, type AuthenticatedAdapterOptions } from './createAuthenticatedFetch';
-export { getUserInitials } from './types';
-export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, type OrgRole, } from './org-roles';
-export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
-export type { AuthUser, AuthClientSession, AuthState, AuthClient, AuthClientConfig, AuthLinkComponentProps, AuthProviderOptions, PreviewModeOptions, SignInCredentials, SignUpData, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthSocialProvider, AuthPublicConfig, SignInWithProviderOptions, TenancyPosture, DelegableScope, } from './types';
-export type { AuthContextValue } from './AuthContext';
+export { AuthProvider, type AuthProviderProps } from './AuthProvider.js';
+export { useAuth } from './useAuth.js';
+export { useWorkspaceAdminStatus, type WorkspaceAdminStatus } from './useWorkspaceAdminStatus.js';
+export { AuthGuard, type AuthGuardProps } from './AuthGuard.js';
+export { AuthShell, type AuthShellProps, type AuthShellBrandPanel } from './AuthShell.js';
+export { LoginForm, type LoginFormProps, type LoginFormLabels } from './LoginForm.js';
+export { RegisterForm, type RegisterFormProps, type RegisterFormLabels } from './RegisterForm.js';
+export { ForgotPasswordForm, type ForgotPasswordFormProps, type ForgotPasswordFormLabels } from './ForgotPasswordForm.js';
+export { SocialSignInButtons, type SocialSignInButtonsProps } from './SocialSignInButtons.js';
+export { UserMenu, type UserMenuProps } from './UserMenu.js';
+export { PreviewBanner, type PreviewBannerProps } from './PreviewBanner.js';
+export { createAuthClient, TokenStorage } from './createAuthClient.js';
+export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier.js';
+export { createAuthenticatedFetch, ActiveOrganizationStorage, type AuthenticatedAdapterOptions } from './createAuthenticatedFetch.js';
+export { getSessionOwnerChangeCount, subscribeSessionOwnerChange } from './ActiveOrganizationStorage.js';
+export { getUserInitials } from './types.js';
+export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, type OrgRole, } from './org-roles.js';
+export { AUTH_INVITATION_STATUSES, isAuthInvitationStatus, type AuthInvitationStatus, } from './invitation-status.js';
+export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles.js';
+export type { AuthUser, AuthClientSession, AuthState, AuthClient, AuthClientConfig, AuthLinkComponentProps, AuthProviderOptions, PreviewModeOptions, SignInCredentials, SignUpData, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthSocialProvider, AuthPublicConfig, SignInWithProviderOptions, TenancyPosture, DelegableScope, } from './types.js';
+export type { AuthContextValue } from './AuthContext.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACnI,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAO1C,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,OAAO,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,cAAc,EACd,cAAc,GACf,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAOvC,OAAO,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC1H,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAMtI,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAO7C,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,OAAO,GACb,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -19,27 +19,44 @@
  *
  * @packageDocumentation
  */
-export { AuthProvider } from './AuthProvider';
-export { useAuth } from './useAuth';
-export { useIsWorkspaceAdmin } from './useIsWorkspaceAdmin';
-export { AuthGuard } from './AuthGuard';
-export { AuthShell } from './AuthShell';
-export { LoginForm } from './LoginForm';
-export { RegisterForm } from './RegisterForm';
-export { ForgotPasswordForm } from './ForgotPasswordForm';
-export { SocialSignInButtons } from './SocialSignInButtons';
-export { UserMenu } from './UserMenu';
-export { PreviewBanner } from './PreviewBanner';
-export { createAuthClient, TokenStorage } from './createAuthClient';
-export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier';
-export { createAuthenticatedFetch, ActiveOrganizationStorage } from './createAuthenticatedFetch';
-export { getUserInitials } from './types';
+export { AuthProvider } from './AuthProvider.js';
+export { useAuth } from './useAuth.js';
+// objectui#5619 — replaces `useIsWorkspaceAdmin(): boolean`, which had no way
+// to say "not resolved yet" and so answered "not an admin" about an
+// administrator whose adminship lives only in the active member row. The old
+// name is REMOVED rather than kept alongside: a caller that misses the third
+// state is the whole defect, and a deleted export makes that a compile error
+// instead of a silent access-denied screen.
+export { useWorkspaceAdminStatus } from './useWorkspaceAdminStatus.js';
+export { AuthGuard } from './AuthGuard.js';
+export { AuthShell } from './AuthShell.js';
+export { LoginForm } from './LoginForm.js';
+export { RegisterForm } from './RegisterForm.js';
+export { ForgotPasswordForm } from './ForgotPasswordForm.js';
+export { SocialSignInButtons } from './SocialSignInButtons.js';
+export { UserMenu } from './UserMenu.js';
+export { PreviewBanner } from './PreviewBanner.js';
+export { createAuthClient, TokenStorage } from './createAuthClient.js';
+export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier.js';
+export { createAuthenticatedFetch, ActiveOrganizationStorage } from './createAuthenticatedFetch.js';
+// objectui#10193 — "the browser changed hands in this page-load". The purge on a
+// change of session user clears storage; state already derived from it in
+// memory (the UI language, first of all) is re-derived by whoever owns it, and
+// these two are how that owner finds out — including one that mounts after the
+// purge fired.
+export { getSessionOwnerChangeCount, subscribeSessionOwnerChange } from './ActiveOrganizationStorage.js';
+export { getUserInitials } from './types.js';
 // Organization membership-role vocabulary — a CLOSED, framework-owned list of
 // four (framework ADR-0108), re-exported from `@objectstack/spec`'s
 // `BUILTIN_MEMBERSHIP_ROLES` so it cannot drift — plus the labels and
 // narrowing helpers every org screen shares, which stay console-owned
 // (see `org-roles.ts` for the boundary).
-export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, } from './org-roles';
+export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, } from './org-roles.js';
+// Invitation lifecycle vocabulary — a CLOSED set of four, bound to better-auth's
+// own `InvitationStatus` so it cannot drift, plus the narrowing guard the wire
+// boundary uses. Exported because a screen switching on `AuthInvitation.status`
+// needs the union by name (objectui#3879).
+export { AUTH_INVITATION_STATUSES, isAuthInvitationStatus, } from './invitation-status.js';
 // Shared auth form primitives — exposed so consumers can build custom forms
 // that match the look of LoginForm / RegisterForm / ForgotPasswordForm.
-export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
+export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles.js';