@object-ui/auth 17.6.0 → 18.0.0

package/dist/AuthProvider.js

@@ -9,7 +9,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useState, useEffect, useCallback, useMemo, useRef } from 'react';
 import { authGateEvents } from './auth-gate-events.js';
 import { AuthCtx } from './AuthContext.js';
-import { createAuthClient, TokenStorage } from './createAuthClient.js';
+import { createAuthClient, takePreflightSession, TokenStorage } from './createAuthClient.js';
 import { ActiveOrganizationStorage, SessionUserScope } from './ActiveOrganizationStorage.js';
 /**
  * Prefix of every `MetadataProvider` seed entry in `sessionStorage`
@@ -29,8 +29,8 @@ const METADATA_SEED_CACHE_PREFIX = 'objectui:metadata:';
  * (objectui#5198).
  *
  * `sessionStorage` is per-TAB, not per-session, and no sign-out call site
- * reloads the page — `AppSidebar`, `AppHeader`, `UserMenu` and
- * `RemediationOverlay` all just call `signOut()` and let the SPA keep running.
+ * reloads the page — `AppHeader`, `UserMenu` and `RemediationOverlay` all
+ * just call `signOut()` and let the SPA keep running.
  * So without this the next person to sign in in the same tab (a shared or
  * kiosk browser, a handover, a support session) is SEEDED from the previous
  * user's entry, and what is in it is that user's PERMISSION-FILTERED app list —
@@ -141,9 +141,20 @@ function purgeSignedOutClientCaches() {
  */
 export function AuthProvider({ authUrl, client: externalClient, onAuthStateChange, enabled = true, previewMode, children, }) {
     const client = useMemo(() => externalClient ?? createAuthClient({ baseURL: authUrl }), [externalClient, authUrl]);
-    const [user, setUser] = useState(null);
-    const [session, setSession] = useState(null);
-    const [isLoading, setIsLoading] = useState(true);
+    // objectui#12808 — the console's pre-React preflight already asked
+    // `get-session` with the stored Bearer. When that answer is still the one we
+    // would get, it IS the first state, and the mount below does not ask again.
+    // Taken once per page load, in an initializer so it runs once per instance
+    // (StrictMode keeps the first call's result). Only for a provider that builds
+    // its own client from `authUrl`: an injected client may talk to another server.
+    const [bootSession] = useState(() => (enabled && previewMode == null && !externalClient ? takePreflightSession(authUrl) : null));
+    const [user, setUser] = useState(() => bootSession?.user ?? null);
+    const [session, setSession] = useState(() => bootSession?.session ?? null);
+    const [isLoading, setIsLoading] = useState(() => bootSession === null);
+    // What the boot answer was taken for. The mount effect skips its load while
+    // it still holds (a StrictMode effect replay included); the first run that
+    // finds anything else drops it for good, so every later run loads as before.
+    const bootSessionFor = useRef(bootSession ? authUrl : null);
     const [error, setError] = useState(null);
     const [remediationRequired, setRemediationRequired] = useState(null);
     // Organization / workspace state
@@ -181,6 +192,16 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
     // stale, previous-organization data over the newer one (see
     // `switchOrganization`).
     const sessionLoadGeneration = useRef(0);
+    // objectui#12809 — the member row asked for at the same time as
+    // `organization/list`, when the session already names its active
+    // organization. `get-active-member` answers for the session's active
+    // organization, so it does not have to wait for the list. Held with the org
+    // and user it was asked for and taken once, by the first
+    // `refreshActiveMember` for that same organization; anything else drops it
+    // (a switch, a sign-out, an active organization the list did not confirm).
+    // Not a cache: the answer is used for the moment it was asked in, never for
+    // a later question.
+    const bootMemberRef = useRef(null);
     /**
      * The ONE session loader. Runs on mount (below) and on every later
      * re-resolution — `refreshSession` on the context, and the rotation
@@ -260,6 +281,9 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
     }, [enabled, isPreviewMode, loadSession]);
     // Load session on mount (only if auth is enabled and not in preview mode)
     useEffect(() => {
+        if (isPreviewMode || !enabled || externalClient || bootSessionFor.current !== authUrl) {
+            bootSessionFor.current = null;
+        }
         if (isPreviewMode) {
             // Preview mode: simulate a user based on previewMode config
             const role = previewMode.simulatedRole ?? 'admin';
@@ -303,10 +327,13 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             setIsLoading(false);
             return;
         }
+        // The first state already holds the preflight's answer (see `bootSession`).
+        if (bootSessionFor.current !== null)
+            return;
         let cancelled = false;
         loadSession(() => cancelled);
         return () => { cancelled = true; };
-    }, [client, enabled, isPreviewMode, previewMode, loadSession]);
+    }, [client, enabled, isPreviewMode, previewMode, loadSession, authUrl, externalClient]);
     // Notify on auth state changes
     useEffect(() => {
         onAuthStateChange?.({
@@ -334,11 +361,11 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             setIsLoading(false);
         }
     }, [client]);
-    const signUp = useCallback(async (name, email, password) => {
+    const signUp = useCallback(async (name, email, password, callbackURL) => {
         setIsLoading(true);
         setError(null);
         try {
-            const result = await client.signUp({ name, email, password });
+            const result = await client.signUp({ name, email, password, ...(callbackURL ? { callbackURL } : {}) });
             if (result.requiresVerification) {
                 // No session was created — the user must verify their email before
                 // they can sign in. Leave auth state untouched so the caller can
@@ -377,6 +404,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             // this file: drop the in-memory reference and the stored id together.
             setOrganizations([]);
             setActiveOrganization(null);
+            bootMemberRef.current = null;
         }
         catch (err) {
             setError(err instanceof Error ? err : new Error(String(err)));
@@ -547,7 +575,17 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         }
     }, [client]);
     // --- Organization methods ---
-    const refreshOrganizations = useCallback(async (isCancelled) => {
+    /**
+     * `sessionActiveOrgId` — objectui#12809. Passed only by the load that follows
+     * a `get-session` answer (the effect below), and only when that answer
+     * carries the organization plugin's `activeOrganizationId`. The session
+     * already names the server's active organization, so it is named from that
+     * id and the list answer: no `get-full-organization` round trip, whose extra
+     * fields (members, invitations) nothing the console reads. Every other caller
+     * (a mutation, `refreshOrganizations()` on the context) asks the server, as
+     * before: the session in hand may predate what that mutation changed.
+     */
+    const refreshOrganizations = useCallback(async (isCancelled, sessionActiveOrgId) => {
         if (!enabled || isPreviewMode)
             return;
         setIsOrganizationsLoading(true);
@@ -559,12 +597,19 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
             // If no active org is set but orgs exist, try to get active from server
             if (orgs.length > 0 && !activeOrganization) {
                 let active = null;
-                try {
-                    active = await client.getActiveOrganization();
+                if (sessionActiveOrgId !== undefined) {
+                    // An id the list does not carry is no membership of this user's: the
+                    // server's full-organization read refuses it the same way.
+                    active = (sessionActiveOrgId && orgs.find((o) => o.id === sessionActiveOrgId)) || null;
                 }
-                catch {
-                    // No active org set — that's fine
-                    active = null;
+                else {
+                    try {
+                        active = await client.getActiveOrganization();
+                    }
+                    catch {
+                        // No active org set — that's fine
+                        active = null;
+                    }
                 }
                 // Single-membership repair (ADR-0081): a session created before the
                 // server-side active-org stamp existed carries no active org even
@@ -579,10 +624,27 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
                         active = null;
                     }
                 }
-                if (active && !isCancelled?.()) {
+                if (isCancelled?.())
+                    return orgs;
+                if (bootMemberRef.current && bootMemberRef.current.orgId !== active?.id) {
+                    bootMemberRef.current = null;
+                }
+                if (active) {
                     setActiveOrganization(active);
                     ActiveOrganizationStorage.set(active.id);
                 }
+                else if (activeOrgIdRef.current === null) {
+                    // objectui#12698 — the server answered "no active organization"
+                    // (and, at one membership, refused the repair above). The stored id
+                    // is a cache of a SERVER-owned fact, so it goes with that answer:
+                    // left in place it keeps stamping `X-Tenant-ID` and keying the
+                    // metadata seed cache for an organization this session does not
+                    // hold — e.g. the one a refused `set-active` cleared server-side
+                    // (better-auth nulls the session's active org before it refuses a
+                    // non-member). The `activeOrgIdRef` guard keeps a user switch that
+                    // landed while this request was in flight from being wiped.
+                    ActiveOrganizationStorage.clear();
+                }
             }
             return orgs;
         }
@@ -634,8 +696,12 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         // A switch re-opens the question: until `getActiveMember()` answers for the
         // NEW org, `activeMember` still holds the OLD org's row.
         setActiveMemberResolved(false);
+        const boot = bootMemberRef.current;
+        bootMemberRef.current = null;
         try {
-            const member = await client.getActiveMember();
+            const member = boot && boot.orgId === activeOrganization.id
+                ? await boot.answer
+                : await client.getActiveMember();
             setActiveMember(member);
         }
         catch (err) {
@@ -682,11 +748,27 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
         refreshActiveMember();
     }, [refreshActiveMember]);
     // Load organizations once user is authenticated
+    //
+    // objectui#12809 — a session answer that carries the organization plugin's
+    // `activeOrganizationId` already names the server's active organization, so
+    // the member row is asked for now, beside `organization/list`, instead of
+    // after the active organization lands. A StrictMode effect replay finds the
+    // same question already asked and does not ask again.
     useEffect(() => {
         if (!(user && enabled && !isPreviewMode))
             return;
         let cancelled = false;
-        refreshOrganizations(() => cancelled);
+        const sessionActiveOrgId = session?.activeOrganizationId;
+        if (typeof sessionActiveOrgId === 'string' && !activeOrganization) {
+            const asked = bootMemberRef.current;
+            if (!asked || asked.orgId !== sessionActiveOrgId || asked.userId !== user.id) {
+                const answer = client.getActiveMember();
+                // Taken later, or dropped: either way it must not surface as unhandled.
+                answer.catch(() => undefined);
+                bootMemberRef.current = { orgId: sessionActiveOrgId, userId: user.id, answer };
+            }
+        }
+        refreshOrganizations(() => cancelled, sessionActiveOrgId);
         return () => { cancelled = true; };
     }, [user, enabled, isPreviewMode]); // eslint-disable-line react-hooks/exhaustive-deps
     // objectui#5750 — keep `activeOrgIdRef` current for every path that can
@@ -728,6 +810,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
     const switchOrganization = useCallback(async (orgId) => {
         setError(null);
         const previousOrgId = activeOrgIdRef.current;
+        bootMemberRef.current = null;
         sessionLoadInFlight.current = true;
         try {
             const org = await client.setActiveOrganization(orgId);

package/dist/LoginForm.d.ts

@@ -22,8 +22,18 @@ export interface LoginFormLabels {
     submittingButton?: string;
     noAccountText?: string;
     signUpText?: string;
-    /** Divider label between social sign-in and email/password (defaults to "or") */
+    /**
+     * Divider label between the social provider buttons and the email/password
+     * form (defaults to "or continue with email"). Rendered only when the server
+     * reports at least one social provider, and only while that form is shown:
+     * under SSO-only mode it appears once "Use a password instead" reveals it.
+     */
     orText?: string;
+    /**
+     * Social provider button label (defaults to "Continue with {provider}");
+     * `{provider}` is replaced with the provider's display name.
+     */
+    socialButton?: string;
     /** Label for the SSO sign-in button (defaults to "Sign in with SSO") */
     ssoButton?: string;
     /**
@@ -52,19 +62,32 @@ export interface LoginFormLabels {
     usePasswordSignInText?: string;
     /** Description shown above the form in SSO-only mode (defaults to "Sign in with your organization's single sign-on"). */
     ssoOnlyDescription?: string;
+    /** Accessible name of the password field's reveal toggle while the password is hidden (defaults to "Show password"). */
+    showPasswordText?: string;
+    /** Accessible name of the password field's reveal toggle while the password is shown (defaults to "Hide password"). */
+    hidePasswordText?: string;
 }
 export interface LoginFormProps {
     /** Callback on successful login */
     onSuccess?: () => void;
     /** Callback on login error */
     onError?: (error: Error) => void;
-    /** Link to registration page */
+    /**
+     * Link to registration page. The "Sign up" link renders only when this is
+     * set: there is no default, so leaving it out (or passing `undefined`, as a
+     * caller does when the server reports `emailPassword.disableSignUp`) renders
+     * no link.
+     */
     registerUrl?: string;
     /** Link to forgot password page */
     forgotPasswordUrl?: string;
     /** Custom title */
     title?: string;
-    /** Custom description */
+    /**
+     * Custom description. Not shown while the server's auth config is still
+     * resolving, since it may describe a password form the server does not
+     * offer; under SSO-only mode `labels.ssoOnlyDescription` replaces it.
+     */
     description?: string;
     /** Custom icon shown above the title (defaults to a small lock disc) */
     icon?: React.ReactNode;
@@ -81,6 +104,14 @@ export interface LoginFormProps {
     errorMessages?: Record<string, string>;
     /** Hide the icon disc above the form title. Defaults to false. */
     hideIcon?: boolean;
+    /**
+     * Render no header — no icon disc, no title, no description — because the
+     * host draws its own above the form. Defaults to false, which renders the
+     * header exactly as before. Under SSO-only ("enforced") mode the form still
+     * says how to sign in: the SSO-only description, which the header would
+     * otherwise carry, renders as one muted line above the federated buttons.
+     */
+    hideHeader?: boolean;
 }
 /**
  * Login form component with email/password authentication.
@@ -96,5 +127,5 @@ export interface LoginFormProps {
  * />
  * ```
  */
-export declare function LoginForm({ onSuccess, onError, registerUrl, forgotPasswordUrl, title, description, icon, hideIcon, linkComponent: LinkComp, labels, errorMessages, }: LoginFormProps): React.JSX.Element;
+export declare function LoginForm({ onSuccess, onError, registerUrl, forgotPasswordUrl, title, description, icon, hideIcon, hideHeader, linkComponent: LinkComp, labels, errorMessages, }: LoginFormProps): React.JSX.Element;
 //# sourceMappingURL=LoginForm.d.ts.map

package/dist/LoginForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginForm.d.ts","sourceRoot":"","sources":["../src/LoginForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAInD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAYzD,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8GAA8G;IAC9G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAsBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,EACxB,SAAS,EACT,OAAO,EACP,WAAyB,EACzB,iBAAsC,EACtC,KAAiC,EACjC,WAAyD,EACzD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,cAAc,qBAgbhB"}
+{"version":3,"file":"LoginForm.d.ts","sourceRoot":"","sources":["../src/LoginForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAInD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAWzD,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8GAA8G;IAC9G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wHAAwH;IACxH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uHAAuH;IACvH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAwDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,EACxB,SAAS,EACT,OAAO,EACP,WAAW,EACX,iBAAsC,EACtC,KAAiC,EACjC,WAAyD,EACzD,IAAI,EACJ,QAAgB,EAChB,UAAkB,EAClB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,cAAc,qBAkehB"}

package/dist/LoginForm.js

@@ -12,6 +12,8 @@ import { SocialSignInButtons } from './SocialSignInButtons.js';
 import { looksLikePhoneIdentifier, normalizePhoneIdentifier } from './phone-identifier.js';
 import { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthErrorBanner, AuthFormHeader, AuthSpinner, } from './authStyles.js';
 const DefaultLink = ({ href, className, children }) => (_jsx("a", { href: href, className: className, children: children }));
+const EyeIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", className: "h-4 w-4", "aria-hidden": "true", children: [_jsx("path", { d: "M2 12s3-7 10-7 10 7 10 7-3 7-10 7-10-7-10-7Z" }), _jsx("circle", { cx: "12", cy: "12", r: "3" })] }));
+const EyeOffIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", className: "h-4 w-4", "aria-hidden": "true", children: [_jsx("path", { d: "M10.73 5.08A10.4 10.4 0 0 1 12 5c7 0 10 7 10 7a13.2 13.2 0 0 1-1.67 2.68" }), _jsx("path", { d: "M6.61 6.61A13.5 13.5 0 0 0 2 12s3 7 10 7a9.7 9.7 0 0 0 5.39-1.61" }), _jsx("path", { d: "M9.88 9.88a3 3 0 1 0 4.24 4.24" }), _jsx("path", { d: "m2 2 20 20" })] }));
 const DefaultLockIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", className: "h-6 w-6", "aria-hidden": "true", children: [_jsx("rect", { x: "3", y: "11", width: "18", height: "11", rx: "2" }), _jsx("path", { d: "M7 11V7a5 5 0 0 1 10 0v4" })] }));
 /**
  * Login form component with email/password authentication.
@@ -27,10 +29,13 @@ const DefaultLockIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none"
  * />
  * ```
  */
-export function LoginForm({ onSuccess, onError, registerUrl = '/register', forgotPasswordUrl = '/forgot-password', title = 'Sign in to your account', description = 'Enter your email and password to continue', icon, hideIcon = false, linkComponent: LinkComp = DefaultLink, labels = {}, errorMessages, }) {
+export function LoginForm({ onSuccess, onError, registerUrl, forgotPasswordUrl = '/forgot-password', title = 'Sign in to your account', description = 'Enter your email and password to continue', icon, hideIcon = false, hideHeader = false, linkComponent: LinkComp = DefaultLink, labels = {}, errorMessages, }) {
     const { signIn, isLoading, getAuthConfig, sendPhoneOtp, signInWithPhoneOtp, signInWithPhonePassword } = useAuth();
     const [email, setEmail] = useState('');
     const [password, setPassword] = useState('');
+    // The password field's reveal toggle. Local and ephemeral on purpose: a
+    // revealed password must not survive a remount or reach any URL or storage.
+    const [passwordVisible, setPasswordVisible] = useState(false);
     const [error, setError] = useState(null);
     // Phone-OTP sign-in (framework#2780). Only offered when the server reports
     // `features.phoneNumberOtp` — i.e. the phoneNumber plugin is on AND a
@@ -117,7 +122,6 @@ export function LoginForm({ onSuccess, onError, registerUrl = '/register', forgo
         submittingButton: labels.submittingButton ?? 'Signing in…',
         noAccountText: labels.noAccountText ?? "Don't have an account?",
         signUpText: labels.signUpText ?? 'Sign up',
-        orText: labels.orText ?? 'or',
         ssoButton: labels.ssoButton ?? 'Sign in with SSO',
         usePasswordText: labels.usePasswordText ?? 'Use a password instead',
         backToSsoText: labels.backToSsoText ?? 'Back to single sign-on',
@@ -130,6 +134,8 @@ export function LoginForm({ onSuccess, onError, registerUrl = '/register', forgo
         resendOtpCountdownText: labels.resendOtpCountdownText ?? 'Resend in {seconds}s',
         usePhoneOtpText: labels.usePhoneOtpText ?? 'Sign in with verification code',
         usePasswordSignInText: labels.usePasswordSignInText ?? 'Sign in with password instead',
+        showPasswordText: labels.showPasswordText ?? 'Show password',
+        hidePasswordText: labels.hidePasswordText ?? 'Hide password',
     };
     // Tick the resend cooldown down once per second while it's armed.
     useEffect(() => {
@@ -234,10 +240,16 @@ export function LoginForm({ onSuccess, onError, registerUrl = '/register', forgo
             setSsoSubmitting(false);
         }
     };
-    return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: hideIcon ? undefined : (icon ?? _jsx(DefaultLockIcon, {})), title: title, description: ssoEnforced && !showPasswordFallback ? l.ssoOnlyDescription : description }), _jsx("div", { className: "space-y-5", children: configPending ? (_jsx("div", { className: "flex justify-center py-10", role: "status", "aria-live": "polite", "data-testid": "login-config-loading", children: _jsx(AuthSpinner, {}) })) : (_jsxs(_Fragment, { children: [_jsx(SocialSignInButtons, { mode: "sign-in", onProvidersResolved: (hasProviders) => setHasSocialProviders(hasProviders) }), passwordFormVisible ? (mode === 'phone-otp' ? (_jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-phone", className: AUTH_FIELD_LABEL_CLASS, children: l.phoneLabel }), _jsx("input", { id: "login-phone", type: "tel", placeholder: l.phonePlaceholder, value: phone, onChange: (e) => setPhone(e.target.value), required: true, autoComplete: "tel", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-otp", className: AUTH_FIELD_LABEL_CLASS, children: l.otpCodeLabel }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { id: "login-otp", type: "text", inputMode: "numeric", placeholder: l.otpCodePlaceholder, value: otpCode, onChange: (e) => setOtpCode(e.target.value), required: true, autoComplete: "one-time-code", disabled: isLoading, className: AUTH_INPUT_CLASS }), _jsxs("button", { type: "button", onClick: handleSendOtp, disabled: otpSending || otpCooldown > 0 || !phone.trim() || isLoading, className: "shrink-0 rounded-md border border-input bg-background px-3 py-2 text-sm font-medium transition-colors hover:bg-accent disabled:opacity-50", children: [otpSending && _jsx(AuthSpinner, {}), otpCooldown > 0
+    // The SSO-only view: enforced mode with the break-glass form still closed.
+    const ssoOnlyView = ssoEnforced && !showPasswordFallback;
+    return (_jsxs("div", { className: `mx-auto flex w-full flex-col justify-center sm:max-w-[400px] ${hideHeader ? 'space-y-4' : 'space-y-7'}`, children: [hideHeader ? (ssoOnlyView ? (_jsx("p", { className: "text-[13px] leading-relaxed text-muted-foreground", children: l.ssoOnlyDescription })) : null) : (_jsx(AuthFormHeader, { icon: hideIcon ? undefined : (icon ?? _jsx(DefaultLockIcon, {})), title: title, 
+                // No description while the config resolves: `ssoEnforced` is not
+                // known yet, and the password form's copy would greet an SSO-only
+                // deployment (objectui#12682).
+                description: configPending ? undefined : ssoOnlyView ? l.ssoOnlyDescription : description })), _jsx("div", { className: "space-y-5", children: configPending ? (_jsx("div", { className: "flex justify-center py-10", role: "status", "aria-live": "polite", "data-testid": "login-config-loading", children: _jsx(AuthSpinner, {}) })) : (_jsxs(_Fragment, { children: [_jsx(SocialSignInButtons, { mode: "sign-in", dividerText: labels.orText, hideDivider: !passwordFormVisible, buttonText: labels.socialButton, onProvidersResolved: (hasProviders) => setHasSocialProviders(hasProviders) }), passwordFormVisible ? (mode === 'phone-otp' ? (_jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-phone", className: AUTH_FIELD_LABEL_CLASS, children: l.phoneLabel }), _jsx("input", { id: "login-phone", type: "tel", placeholder: l.phonePlaceholder, value: phone, onChange: (e) => setPhone(e.target.value), required: true, autoComplete: "tel", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-otp", className: AUTH_FIELD_LABEL_CLASS, children: l.otpCodeLabel }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { id: "login-otp", type: "text", inputMode: "numeric", placeholder: l.otpCodePlaceholder, value: otpCode, onChange: (e) => setOtpCode(e.target.value), required: true, autoComplete: "one-time-code", disabled: isLoading, className: AUTH_INPUT_CLASS }), _jsxs("button", { type: "button", onClick: handleSendOtp, disabled: otpSending || otpCooldown > 0 || !phone.trim() || isLoading, className: "shrink-0 rounded-md border border-input bg-background px-3 py-2 text-sm font-medium transition-colors hover:bg-accent disabled:opacity-50", children: [otpSending && _jsx(AuthSpinner, {}), otpCooldown > 0
                                                             ? l.resendOtpCountdownText.replace('{seconds}', String(otpCooldown))
                                                             : l.sendOtpButton] })] })] }), _jsxs("button", { type: "submit", disabled: isLoading || !otpSent, className: AUTH_PRIMARY_BUTTON_CLASS, children: [isLoading && _jsx(AuthSpinner, {}), isLoading ? l.submittingButton : l.submitButton] }), _jsx("button", { type: "button", onClick: () => switchMode('password'), className: "w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.usePasswordSignInText })] })) : (_jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "login-email", className: AUTH_FIELD_LABEL_CLASS, children: phonePasswordEnabled ? l.emailOrPhoneLabel : l.emailLabel }), _jsx("input", { id: "login-email", 
                                             // `text` (not `email`) when a phone number is also accepted, so the
                                             // browser doesn't reject a phone-shaped value on native validation.
-                                            type: phonePasswordEnabled ? 'text' : 'email', inputMode: phonePasswordEnabled ? 'text' : 'email', placeholder: phonePasswordEnabled ? l.emailOrPhonePlaceholder : l.emailPlaceholder, value: email, onChange: (e) => setEmail(e.target.value), required: true, autoComplete: "username", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("label", { htmlFor: "login-password", className: AUTH_FIELD_LABEL_CLASS, children: l.passwordLabel }), forgotPasswordUrl && (_jsx(LinkComp, { href: forgotPasswordUrl, className: "text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.forgotPasswordText }))] }), _jsx("input", { id: "login-password", type: "password", placeholder: l.passwordPlaceholder, value: password, onChange: (e) => setPassword(e.target.value), required: true, autoComplete: "current-password", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("button", { type: "submit", disabled: isLoading, className: AUTH_PRIMARY_BUTTON_CLASS, children: [isLoading && _jsx(AuthSpinner, {}), isLoading ? l.submittingButton : l.submitButton] }), ssoEnabled && (_jsxs("button", { type: "button", onClick: handleSso, disabled: isLoading || ssoSubmitting, "aria-busy": ssoSubmitting, className: "flex w-full items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium transition-colors hover:bg-accent disabled:opacity-50", children: [ssoSubmitting && _jsx(AuthSpinner, {}), l.ssoButton] })), phoneOtpEnabled && (_jsx("button", { type: "button", onClick: () => switchMode('phone-otp'), className: "w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.usePhoneOtpText })), ssoEnforced && showPasswordFallback && (_jsx("button", { type: "button", onClick: () => setShowPasswordFallback(false), className: "w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.backToSsoText }))] }))) : (_jsxs("div", { className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsx("button", { type: "button", onClick: () => setShowPasswordFallback(true), className: "w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.usePasswordText })] }))] })) }), registerUrl && !ssoEnforced && (_jsxs("p", { className: "px-8 text-center text-sm text-muted-foreground", children: [l.noAccountText, ' ', _jsx(LinkComp, { href: registerUrl, className: AUTH_LINK_CLASS, children: l.signUpText })] }))] }));
+                                            type: phonePasswordEnabled ? 'text' : 'email', inputMode: phonePasswordEnabled ? 'text' : 'email', placeholder: phonePasswordEnabled ? l.emailOrPhonePlaceholder : l.emailPlaceholder, value: email, onChange: (e) => setEmail(e.target.value), required: true, autoComplete: "username", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("label", { htmlFor: "login-password", className: AUTH_FIELD_LABEL_CLASS, children: l.passwordLabel }), forgotPasswordUrl && (_jsx(LinkComp, { href: forgotPasswordUrl, className: "text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.forgotPasswordText }))] }), _jsxs("div", { className: "relative", children: [_jsx("input", { id: "login-password", type: passwordVisible ? 'text' : 'password', placeholder: l.passwordPlaceholder, value: password, onChange: (e) => setPassword(e.target.value), required: true, autoComplete: "current-password", disabled: isLoading, className: `${AUTH_INPUT_CLASS} pr-10` }), _jsx("button", { type: "button", "data-testid": "login-password-toggle", onClick: () => setPasswordVisible((v) => !v), "aria-label": passwordVisible ? l.hidePasswordText : l.showPasswordText, "aria-controls": "login-password", disabled: isLoading, className: "absolute right-1.5 top-1/2 inline-flex h-7 w-7 -translate-y-1/2 items-center justify-center rounded-md text-muted-foreground transition-colors hover:bg-muted hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary/30 disabled:pointer-events-none disabled:opacity-50", children: passwordVisible ? _jsx(EyeOffIcon, {}) : _jsx(EyeIcon, {}) })] })] }), _jsxs("button", { type: "submit", disabled: isLoading, className: AUTH_PRIMARY_BUTTON_CLASS, children: [isLoading && _jsx(AuthSpinner, {}), isLoading ? l.submittingButton : l.submitButton] }), ssoEnabled && (_jsxs("button", { type: "button", onClick: handleSso, disabled: isLoading || ssoSubmitting, "aria-busy": ssoSubmitting, className: "flex h-10 w-full items-center justify-center gap-2 rounded-lg border border-input bg-background px-4 py-2 text-sm font-medium transition-colors hover:bg-accent disabled:opacity-50", children: [ssoSubmitting && _jsx(AuthSpinner, {}), l.ssoButton] })), phoneOtpEnabled && (_jsx("button", { type: "button", onClick: () => switchMode('phone-otp'), className: "w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.usePhoneOtpText })), ssoEnforced && showPasswordFallback && (_jsx("button", { type: "button", onClick: () => setShowPasswordFallback(false), className: "w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.backToSsoText }))] }))) : (_jsxs("div", { className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsx("button", { type: "button", onClick: () => setShowPasswordFallback(true), className: "w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline", children: l.usePasswordText })] }))] })) }), registerUrl && !ssoEnforced && (_jsxs("p", { className: "px-8 text-center text-[13px] text-muted-foreground", children: [l.noAccountText, ' ', _jsx(LinkComp, { href: registerUrl, className: AUTH_LINK_CLASS, children: l.signUpText })] }))] }));
 }

package/dist/RegisterForm.d.ts

@@ -23,8 +23,17 @@ export interface RegisterFormLabels {
     submittingButton?: string;
     hasAccountText?: string;
     signInText?: string;
-    /** Divider label between social sign-up and email/password (defaults to "or") */
+    /**
+     * Divider label between the social provider buttons and the email/password
+     * form (defaults to "or continue with email"). Rendered only when the server
+     * reports at least one social provider.
+     */
     orText?: string;
+    /**
+     * Social provider button label (defaults to "Sign up with {provider}");
+     * `{provider}` is replaced with the provider's display name.
+     */
+    socialButton?: string;
 }
 export interface RegisterFormProps {
     /** Callback on successful registration AND auto sign-in. Not called when the
@@ -34,6 +43,16 @@ export interface RegisterFormProps {
      *  sign-in on email verification. The page should swap the form for a
      *  "check your inbox" confirmation. */
     onVerificationRequired?: (email: string) => void;
+    /**
+     * Where the email-verification link should land once the address is
+     * verified — e.g. the invitation page the user registered from
+     * (objectui#10893). Forwarded to `signUp` as better-auth's sign-up
+     * `callbackURL`; see `SignUpData.callbackURL` for the only shapes the server
+     * accepts (a document-relative `./…` fails the whole sign-up). Omitted, the
+     * server default (`/`) applies. Only matters when the server requires email
+     * verification — an auto-signed-in registration calls `onSuccess` instead.
+     */
+    verificationCallbackURL?: string;
     /** Callback on registration error */
     onError?: (error: Error) => void;
     /** Link to login page */
@@ -70,5 +89,5 @@ export interface RegisterFormProps {
  * />
  * ```
  */
-export declare function RegisterForm({ onSuccess, onVerificationRequired, onError, loginUrl, title, description, icon, hideIcon, linkComponent: LinkComp, labels, errorMessages, }: RegisterFormProps): React.JSX.Element;
+export declare function RegisterForm({ onSuccess, onVerificationRequired, verificationCallbackURL, onError, loginUrl, title, description, icon, hideIcon, linkComponent: LinkComp, labels, errorMessages, }: RegisterFormProps): React.JSX.Element;
 //# sourceMappingURL=RegisterForm.d.ts.map

package/dist/RegisterForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RegisterForm.d.ts","sourceRoot":"","sources":["../src/RegisterForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAmB,MAAM,OAAO,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAWzD,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC;sFACkF;IAClF,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB;;2CAEuC;IACvC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,EAC3B,SAAS,EACT,sBAAsB,EACtB,OAAO,EACP,QAAmB,EACnB,KAA2B,EAC3B,WAAqD,EACrD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,iBAAiB,qBAuKnB"}
+{"version":3,"file":"RegisterForm.d.ts","sourceRoot":"","sources":["../src/RegisterForm.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAmB,MAAM,OAAO,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAWzD,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC;sFACkF;IAClF,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB;;2CAEuC;IACvC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,uCAAuC;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,EAC3B,SAAS,EACT,sBAAsB,EACtB,uBAAuB,EACvB,OAAO,EACP,QAAmB,EACnB,KAA2B,EAC3B,WAAqD,EACrD,IAAI,EACJ,QAAgB,EAChB,aAAa,EAAE,QAAsB,EACrC,MAAW,EACX,aAAa,GACd,EAAE,iBAAiB,qBA4KnB"}

package/dist/RegisterForm.js

@@ -25,7 +25,7 @@ const DefaultUserPlusIcon = () => (_jsxs("svg", { viewBox: "0 0 24 24", fill: "n
  * />
  * ```
  */
-export function RegisterForm({ onSuccess, onVerificationRequired, onError, loginUrl = '/login', title = 'Create an account', description = 'Enter your information to get started', icon, hideIcon = false, linkComponent: LinkComp = DefaultLink, labels = {}, errorMessages, }) {
+export function RegisterForm({ onSuccess, onVerificationRequired, verificationCallbackURL, onError, loginUrl = '/login', title = 'Create an account', description = 'Enter your information to get started', icon, hideIcon = false, linkComponent: LinkComp = DefaultLink, labels = {}, errorMessages, }) {
     const { signUp, isLoading } = useAuth();
     const [name, setName] = useState('');
     const [email, setEmail] = useState('');
@@ -47,7 +47,6 @@ export function RegisterForm({ onSuccess, onVerificationRequired, onError, login
         submittingButton: labels.submittingButton ?? 'Creating account…',
         hasAccountText: labels.hasAccountText ?? 'Already have an account?',
         signInText: labels.signInText ?? 'Sign in',
-        orText: labels.orText ?? 'or',
     };
     const handleSubmit = async (e) => {
         e.preventDefault();
@@ -64,7 +63,7 @@ export function RegisterForm({ onSuccess, onVerificationRequired, onError, login
         // that the server rejects as "Invalid email" (#3238) — trim before use.
         const trimmedEmail = email.trim();
         try {
-            const result = await signUp(name, trimmedEmail, password);
+            const result = await signUp(name, trimmedEmail, password, verificationCallbackURL);
             if (result?.requiresVerification) {
                 onVerificationRequired?.(trimmedEmail);
                 return;
@@ -78,5 +77,5 @@ export function RegisterForm({ onSuccess, onVerificationRequired, onError, login
             onError?.(authError);
         }
     };
-    return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: hideIcon ? undefined : (icon ?? _jsx(DefaultUserPlusIcon, {})), title: title, description: description }), _jsxs("div", { className: "space-y-5", children: [_jsx(SocialSignInButtons, { mode: "sign-up" }), _jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-name", className: AUTH_FIELD_LABEL_CLASS, children: l.nameLabel }), _jsx("input", { id: "register-name", type: "text", placeholder: l.namePlaceholder, value: name, onChange: (e) => setName(e.target.value), required: true, autoComplete: "name", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-email", className: AUTH_FIELD_LABEL_CLASS, children: l.emailLabel }), _jsx("input", { id: "register-email", type: "email", placeholder: l.emailPlaceholder, value: email, onChange: (e) => setEmail(e.target.value), required: true, autoComplete: "email", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-password", className: AUTH_FIELD_LABEL_CLASS, children: l.passwordLabel }), _jsx("input", { id: "register-password", type: "password", placeholder: l.passwordPlaceholder, value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 8, autoComplete: "new-password", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-confirm-password", className: AUTH_FIELD_LABEL_CLASS, children: l.confirmPasswordLabel }), _jsx("input", { id: "register-confirm-password", type: "password", placeholder: l.confirmPasswordPlaceholder, value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 8, autoComplete: "new-password", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("button", { type: "submit", disabled: isLoading, className: AUTH_PRIMARY_BUTTON_CLASS, children: [isLoading && _jsx(AuthSpinner, {}), isLoading ? l.submittingButton : l.submitButton] })] })] }), loginUrl && (_jsxs("p", { className: "px-8 text-center text-sm text-muted-foreground", children: [l.hasAccountText, ' ', _jsx(LinkComp, { href: loginUrl, className: AUTH_LINK_CLASS, children: l.signInText })] }))] }));
+    return (_jsxs("div", { className: "mx-auto flex w-full flex-col justify-center space-y-7 sm:w-[400px]", children: [_jsx(AuthFormHeader, { icon: hideIcon ? undefined : (icon ?? _jsx(DefaultUserPlusIcon, {})), title: title, description: description }), _jsxs("div", { className: "space-y-5", children: [_jsx(SocialSignInButtons, { mode: "sign-up", dividerText: labels.orText, buttonText: labels.socialButton }), _jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [error && _jsx(AuthErrorBanner, { message: error }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-name", className: AUTH_FIELD_LABEL_CLASS, children: l.nameLabel }), _jsx("input", { id: "register-name", type: "text", placeholder: l.namePlaceholder, value: name, onChange: (e) => setName(e.target.value), required: true, autoComplete: "name", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-email", className: AUTH_FIELD_LABEL_CLASS, children: l.emailLabel }), _jsx("input", { id: "register-email", type: "email", placeholder: l.emailPlaceholder, value: email, onChange: (e) => setEmail(e.target.value), required: true, autoComplete: "email", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-password", className: AUTH_FIELD_LABEL_CLASS, children: l.passwordLabel }), _jsx("input", { id: "register-password", type: "password", placeholder: l.passwordPlaceholder, value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 8, autoComplete: "new-password", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("div", { className: "space-y-2", children: [_jsx("label", { htmlFor: "register-confirm-password", className: AUTH_FIELD_LABEL_CLASS, children: l.confirmPasswordLabel }), _jsx("input", { id: "register-confirm-password", type: "password", placeholder: l.confirmPasswordPlaceholder, value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, minLength: 8, autoComplete: "new-password", disabled: isLoading, className: AUTH_INPUT_CLASS })] }), _jsxs("button", { type: "submit", disabled: isLoading, className: AUTH_PRIMARY_BUTTON_CLASS, children: [isLoading && _jsx(AuthSpinner, {}), isLoading ? l.submittingButton : l.submitButton] })] })] }), loginUrl && (_jsxs("p", { className: "px-8 text-center text-sm text-muted-foreground", children: [l.hasAccountText, ' ', _jsx(LinkComp, { href: loginUrl, className: AUTH_LINK_CLASS, children: l.signInText })] }))] }));
 }

package/dist/SocialSignInButtons.d.ts

@@ -13,8 +13,21 @@ export interface SocialSignInButtonsProps {
     callbackURL?: string;
     /** Where the provider should redirect on error. Defaults to current page. */
     errorCallbackURL?: string;
-    /** Divider text shown between social buttons and the email form */
+    /** Divider text shown between social buttons and the email form (defaults to "or continue with email") */
     dividerText?: string;
+    /**
+     * Omit the divider under the buttons. For a host that draws no email form
+     * beneath them at that moment, e.g. `LoginForm` under SSO-only mode until
+     * the password form is revealed. Defaults to false: the divider renders.
+     */
+    hideDivider?: boolean;
+    /**
+     * Provider button label, for i18n. `{provider}` is replaced with the
+     * provider's display name, so a translation places the name where its
+     * grammar needs it. Defaults to "Continue with {provider}" in `sign-in`
+     * mode and "Sign up with {provider}" in `sign-up` mode.
+     */
+    buttonText?: string;
     /** Called once after config resolves with whether any social providers are available. */
     onProvidersResolved?: (hasProviders: boolean) => void;
 }
@@ -25,5 +38,5 @@ export interface SocialSignInButtonsProps {
  *
  * Returns `null` while loading or when the server reports no providers.
  */
-export declare function SocialSignInButtons({ mode, callbackURL, errorCallbackURL, dividerText, onProvidersResolved, }: SocialSignInButtonsProps): React.JSX.Element | null;
+export declare function SocialSignInButtons({ mode, callbackURL, errorCallbackURL, dividerText, hideDivider, buttonText, onProvidersResolved, }: SocialSignInButtonsProps): React.JSX.Element | null;
 //# sourceMappingURL=SocialSignInButtons.d.ts.map

package/dist/SocialSignInButtons.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SocialSignInButtons.d.ts","sourceRoot":"","sources":["../src/SocialSignInButtons.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAkFnD,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC7B,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,IAAI,CAAC;CACvD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,IAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,WAAsC,EACtC,mBAAmB,GACpB,EAAE,wBAAwB,4BAyF1B"}
+{"version":3,"file":"SocialSignInButtons.d.ts","sourceRoot":"","sources":["../src/SocialSignInButtons.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAA8B,MAAM,OAAO,CAAC;AAkFnD,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC7B,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0GAA0G;IAC1G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,IAAI,CAAC;CACvD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,IAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,WAAsC,EACtC,WAAmB,EACnB,UAAU,EACV,mBAAmB,GACpB,EAAE,wBAAwB,4BA6F1B"}

package/dist/SocialSignInButtons.js

@@ -48,7 +48,7 @@ function ProviderIcon({ id }) {
  *
  * Returns `null` while loading or when the server reports no providers.
  */
-export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallbackURL, dividerText = 'or continue with email', onProvidersResolved, }) {
+export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallbackURL, dividerText = 'or continue with email', hideDivider = false, buttonText, onProvidersResolved, }) {
     const { getAuthConfig, signInWithProvider } = useAuth();
     const [providers, setProviders] = useState([]);
     const [loading, setLoading] = useState(true);
@@ -86,7 +86,7 @@ export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallba
     }, [getAuthConfig]);
     if (loading || providers.length === 0)
         return null;
-    const label = mode === 'sign-in' ? 'Continue with' : 'Sign up with';
+    const labelTemplate = buttonText ?? (mode === 'sign-in' ? 'Continue with {provider}' : 'Sign up with {provider}');
     const defaultCallback = typeof window !== 'undefined' ? window.location.href : undefined;
     const onClick = async (provider) => {
         if (pendingId)
@@ -107,5 +107,5 @@ export function SocialSignInButtons({ mode = 'sign-in', callbackURL, errorCallba
             setPendingId(null);
         }
     };
-    return (_jsxs("div", { className: "flex flex-col gap-2", children: [error && (_jsx("div", { className: "rounded-md bg-destructive/15 p-3 text-sm text-destructive", role: "alert", children: error })), providers.map((p) => (_jsxs("button", { type: "button", onClick: () => onClick(p), disabled: pendingId !== null, "aria-busy": pendingId === p.id, className: "inline-flex h-10 w-full items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium ring-offset-background transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50", children: [pendingId === p.id ? _jsx(AuthSpinner, {}) : _jsx(ProviderIcon, { id: p.id }), label, " ", PROVIDER_LABEL[p.id] ?? p.name] }, p.id))), _jsxs("div", { className: "relative my-1", children: [_jsx("div", { className: "absolute inset-0 flex items-center", children: _jsx("span", { className: "w-full border-t" }) }), _jsx("div", { className: "relative flex justify-center text-xs uppercase", children: _jsx("span", { className: "bg-background px-2 text-muted-foreground", children: dividerText }) })] })] }));
+    return (_jsxs("div", { className: "flex flex-col gap-2", children: [error && (_jsx("div", { className: "rounded-md bg-destructive/15 p-3 text-sm text-destructive", role: "alert", children: error })), providers.map((p) => (_jsxs("button", { type: "button", onClick: () => onClick(p), disabled: pendingId !== null, "aria-busy": pendingId === p.id, className: "inline-flex h-10 w-full items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium ring-offset-background transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50", children: [pendingId === p.id ? _jsx(AuthSpinner, {}) : _jsx(ProviderIcon, { id: p.id }), labelTemplate.replace('{provider}', () => PROVIDER_LABEL[p.id] ?? p.name)] }, p.id))), hideDivider ? null : (_jsxs("div", { className: "relative my-1", children: [_jsx("div", { className: "absolute inset-0 flex items-center", children: _jsx("span", { className: "w-full border-t" }) }), _jsx("div", { className: "relative flex justify-center text-xs uppercase", children: _jsx("span", { className: "bg-background px-2 text-muted-foreground", children: dividerText }) })] }))] }));
 }

package/dist/UserMenu.d.ts

@@ -21,7 +21,7 @@ export interface UserMenuProps {
  * Shows avatar, name, email, and common actions (profile, settings, sign out).
  *
  * This is a headless component that provides the user data and actions.
- * The actual dropdown rendering is handled by the consumer (e.g., AppSidebar).
+ * The actual dropdown rendering is handled by the consumer.
  *
  * @example
  * ```tsx

package/dist/UserMenu.js

@@ -6,7 +6,7 @@ import { getUserInitials } from './types.js';
  * Shows avatar, name, email, and common actions (profile, settings, sign out).
  *
  * This is a headless component that provides the user data and actions.
- * The actual dropdown rendering is handled by the consumer (e.g., AppSidebar).
+ * The actual dropdown rendering is handled by the consumer.
  *
  * @example
  * ```tsx

package/dist/auth-gate-events.d.ts

@@ -9,16 +9,18 @@
  * ADR-0069 — client side of the authentication-policy session gate.
  *
  * The ObjectStack backend returns `403 { error: { code: 'MFA_REQUIRED' |
- * 'PASSWORD_EXPIRED', message } }` from protected endpoints when a logged-in
- * user must remediate. The authenticated fetch wrapper detects this on EVERY
+ * 'PASSWORD_EXPIRED' | 'PASSWORD_RESET_REQUIRED', message } }` from protected
+ * endpoints when a logged-in user must remediate. `PASSWORD_RESET_REQUIRED` is
+ * an administrator-forced password change, distinct on the wire from natural
+ * expiry (objectstack#23287 ruling C′). The authenticated fetch wrapper detects this on EVERY
  * API response and emits it here; `AuthProvider` subscribes and raises a
  * full-screen remediation overlay. Decoupling via a tiny module-level emitter
  * keeps the plain fetch wrapper free of React.
  */
 /** A triggered auth-policy gate the user must clear before continuing. */
 export interface AuthGateInfo {
-    /** Stable machine code, e.g. `MFA_REQUIRED` / `PASSWORD_EXPIRED`. */
-    code: 'MFA_REQUIRED' | 'PASSWORD_EXPIRED' | string;
+    /** Stable machine code: one of the codes `detectAuthGate` recognises. */
+    code: 'MFA_REQUIRED' | 'PASSWORD_EXPIRED' | 'PASSWORD_RESET_REQUIRED' | string;
     /** Human-facing message from the server (may be empty). */
     message: string;
 }