@opensaas/stack-auth 0.31.0 → 0.32.0

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @opensaas/stack-auth@0.31.0 build /home/runner/work/stack/stack/packages/auth
+> @opensaas/stack-auth@0.32.0 build /home/runner/work/stack/stack/packages/auth
 > tsc
 

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # @opensaas/stack-auth
 
+## 0.32.0
+
+### Minor Changes
+
+- [#813](https://github.com/OpenSaasAU/stack/pull/813) [`5a6198c`](https://github.com/OpenSaasAU/stack/commit/5a6198c9489641e4b1ad542a3181c15e750f7d85) Thanks [@borisno2](https://github.com/borisno2)! - Auth forms now submit through app-owned server actions instead of the browser `authClient`
+
+  The pre-built auth forms (`SignInForm`, `SignUpForm`, `ForgotPasswordForm`, and the new
+  `ResetPasswordForm`) no longer take an `authClient` prop that calls `/api/auth/*` from the
+  browser. Instead each form takes **server action** props — `'use server'` functions the app
+  defines against its own `auth` instance. This keeps the auth network surface server-side and
+  matches the app's existing `lib/actions/*` convention. `createAuth` now auto-adds
+  better-auth's `nextCookies` plugin, so the session cookie set inside a server action persists.
+  See ADR-0020.
+
+  The package exports the action contract types (`AuthActionResult`, `SignInInput`,
+  `SignUpInput`, `RequestPasswordResetInput`, `ResetPasswordInput`, and the action aliases).
+  `createClient` is unchanged for client-side session reading (`useSession`).
+
+  Migration — define the actions in your app and pass them to the forms:
+
+  ```typescript
+  // lib/actions/auth.ts
+  'use server'
+  import { headers } from 'next/headers'
+  import { auth } from '@/lib/auth'
+  import type { AuthActionResult, SignInInput } from '@opensaas/stack-auth/ui'
+
+  export async function signInAction(input: SignInInput): Promise<AuthActionResult> {
+    try {
+      await auth.api.signInEmail({
+        body: { email: input.email, password: input.password },
+        headers: await headers(),
+      })
+      return { success: true }
+    } catch (err) {
+      return { success: false, error: err instanceof Error ? err.message : 'Sign in failed' }
+    }
+  }
+  ```
+
+  ```tsx
+  // Before
+  <SignInForm authClient={authClient} redirectTo="/admin" />
+
+  // After
+  <SignInForm signInAction={signInAction} redirectTo="/admin" />
+  ```
+
+  Social sign-in becomes a redirecting server action passed as `signInSocialAction`. The CLI
+  feature-generator now scaffolds `lib/actions/auth.ts` and a `reset-password` page, and no
+  longer emits `lib/auth-client.ts`.
+
+## 0.31.1
+
 ## 0.31.0
 
 ### Patch Changes

package/CLAUDE.md

@@ -38,11 +38,13 @@ Auto-generated lists:
 
 ### UI (`src/ui/index.ts`)
 
-Pre-built forms (client components):
+Pre-built forms (client components). Each takes **server action** props (not an
+`authClient`) — see "Auth forms submit through server actions" below and ADR-0020:
 
 - `SignInForm` - Email/password + OAuth sign in
 - `SignUpForm` - Create account with password confirmation
 - `ForgotPasswordForm` - Request password reset email
+- `ResetPasswordForm` - Set a new password from a reset-email token
 
 ### Plugins (`src/plugins/index.ts`)
 
@@ -334,18 +336,47 @@ export default config({
 })
 
 // 2. Server (lib/auth.ts)
-export const auth = createAuth(config)
+export const auth = createAuth(config, rawOpensaasContext)
 
 // 3. Route (app/api/auth/[...all]/route.ts)
 export { GET, POST } from '@/lib/auth'
 
-// 4. Client (lib/auth-client.ts)
-export const authClient = createClient({ baseURL: process.env.NEXT_PUBLIC_APP_URL })
+// 4. Server actions (lib/actions/auth.ts) — the forms submit through these
+'use server'
+import { auth } from '@/lib/auth'
+import type { AuthActionResult, SignInInput } from '@opensaas/stack-auth/ui'
+export async function signInAction(input: SignInInput): Promise<AuthActionResult> {
+  try {
+    await auth.api.signInEmail({ body: input, headers: await headers() })
+    return { success: true }
+  } catch (err) {
+    return { success: false, error: err instanceof Error ? err.message : 'Sign in failed' }
+  }
+}
 
 // 5. UI (app/sign-in/page.tsx)
-<SignInForm authClient={authClient} redirectTo="/admin" />
+<SignInForm signInAction={signInAction} redirectTo="/admin" />
 ```
 
+### Auth forms submit through server actions
+
+The pre-built forms take app-owned `'use server'` action props instead of a browser
+`authClient`, so the auth network surface stays server-side (no `/api/auth/*` call from
+the browser). `createAuth` auto-adds better-auth's `nextCookies` plugin (as the last
+plugin) so a session cookie set inside a server action persists. The action props are:
+
+- `SignInForm`: `signInAction`, optional `signInSocialAction`
+- `SignUpForm`: `signUpAction`, optional `signInSocialAction`
+- `ForgotPasswordForm`: `requestPasswordResetAction`
+- `ResetPasswordForm`: `resetPasswordAction` + a `token` prop (the page reads it from
+  `searchParams.token`)
+
+Email actions return `AuthActionResult` and the form redirects client-side; social
+sign-in redirects server-side to the provider. The package exports the contract types
+(`AuthActionResult`, `SignInInput`, `SignUpInput`, `RequestPasswordResetInput`,
+`ResetPasswordInput`, and the action aliases). `createClient` is unchanged for
+client-side session reading (`useSession`). See ADR-0020 and `examples/starter-auth`.
+
 ### Access Control with Session
 
 ```typescript
@@ -376,8 +407,12 @@ authPlugin({
   }
 })
 
-// UI
-<SignInForm socialProviders={['github', 'google']} />
+// UI — pass the redirecting social action to enable the provider buttons
+<SignInForm
+  signInAction={signInAction}
+  signInSocialAction={signInSocialAction}
+  socialProviders={['github', 'google']}
+/>
 ```
 
 ## Type Safety

package/README.md

@@ -77,17 +77,30 @@ export const POST = auth.handler
 export { GET, POST } from '@/lib/auth'
 ```
 
-### 5. Create Auth Client
+### 5. Create Auth Server Actions
 
-```typescript
-// lib/auth-client.ts
-'use client'
-
-import { createClient } from '@opensaas/stack-auth/client'
+The pre-built forms submit through app-owned server actions (calling better-auth's
+server API directly) instead of a browser client. `createAuth` auto-adds better-auth's
+`nextCookies` plugin, so the session cookie set inside these actions persists.
 
-export const authClient = createClient({
-  baseURL: process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000',
-})
+```typescript
+// lib/actions/auth.ts
+'use server'
+
+import { headers } from 'next/headers'
+import { auth } from '@/lib/auth'
+import type { AuthActionResult, SignInInput } from '@opensaas/stack-auth/ui'
+
+export async function signInAction(input: SignInInput): Promise<AuthActionResult> {
+  try {
+    await auth.api.signInEmail({ body: input, headers: await headers() })
+    return { success: true }
+  } catch (err) {
+    return { success: false, error: err instanceof Error ? err.message : 'Sign in failed' }
+  }
+}
+// ...and signUpAction / requestPasswordResetAction / resetPasswordAction — see
+// examples/starter-auth/lib/actions/auth.ts for the full set.
 ```
 
 ### 6. Add Sign In Page
@@ -95,12 +108,12 @@ export const authClient = createClient({
 ```typescript
 // app/sign-in/page.tsx
 import { SignInForm } from '@opensaas/stack-auth/ui'
-import { authClient } from '@/lib/auth-client'
+import { signInAction } from '@/lib/actions/auth'
 
 export default function SignInPage() {
   return (
     <div className="min-h-screen flex items-center justify-center">
-      <SignInForm authClient={authClient} redirectTo="/admin" />
+      <SignInForm signInAction={signInAction} redirectTo="/admin" />
     </div>
   )
 }
@@ -238,14 +251,18 @@ the full migrator walkthrough and a Schema-parity (clean-diff) check.
 
 ## UI Components
 
+Each form takes app-owned server action props (defined in `lib/actions/auth.ts`),
+not an `authClient`. See ADR-0020 and `examples/starter-auth`.
+
 ### SignInForm
 
 ```typescript
 import { SignInForm } from '@opensaas/stack-auth/ui'
-import { authClient } from '@/lib/auth-client'
+import { signInAction, signInSocialAction } from '@/lib/actions/auth'
 
 <SignInForm
-  authClient={authClient}
+  signInAction={signInAction}
+  signInSocialAction={signInSocialAction}
   redirectTo="/dashboard"
   showSocialProviders={true}
   socialProviders={['github', 'google']}
@@ -258,10 +275,10 @@ import { authClient } from '@/lib/auth-client'
 
 ```typescript
 import { SignUpForm } from '@opensaas/stack-auth/ui'
-import { authClient } from '@/lib/auth-client'
+import { signUpAction } from '@/lib/actions/auth'
 
 <SignUpForm
-  authClient={authClient}
+  signUpAction={signUpAction}
   redirectTo="/dashboard"
   requirePasswordConfirmation={true}
   onSuccess={() => console.log('Account created!')}
@@ -272,14 +289,31 @@ import { authClient } from '@/lib/auth-client'
 
 ```typescript
 import { ForgotPasswordForm } from '@opensaas/stack-auth/ui'
-import { authClient } from '@/lib/auth-client'
+import { requestPasswordResetAction } from '@/lib/actions/auth'
 
 <ForgotPasswordForm
-  authClient={authClient}
+  requestPasswordResetAction={requestPasswordResetAction}
   onSuccess={() => console.log('Reset email sent!')}
 />
 ```
 
+### ResetPasswordForm
+
+```typescript
+// app/reset-password/page.tsx
+import { ResetPasswordForm } from '@opensaas/stack-auth/ui'
+import { resetPasswordAction } from '@/lib/actions/auth'
+
+export default async function ResetPasswordPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ token?: string }>
+}) {
+  const { token } = await searchParams
+  return <ResetPasswordForm resetPasswordAction={resetPasswordAction} token={token ?? ''} />
+}
+```
+
 ## Auto-Generated Lists
 
 The following lists are automatically created when you use `authPlugin()`:
@@ -404,7 +438,19 @@ access: {
 
 ## Client-Side Hooks
 
-Use better-auth hooks in your React components:
+The auth forms no longer need a browser client (they use server actions). To read the
+session on the client, create a client yourself with `createClient` and use its hooks:
+
+```typescript
+// lib/auth-client.ts
+'use client'
+
+import { createClient } from '@opensaas/stack-auth/client'
+
+export const authClient = createClient({
+  baseURL: process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000',
+})
+```
 
 ```typescript
 'use client'

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAgCzE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CACxB,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,EACxD,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,iDAyIhD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,EACnC,aAAa,EAAE,MAAM,EAAE,2CA0BxB;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAgCzE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CACxB,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,EACxD,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,iDA8IhD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,EACnC,aAAa,EAAE,MAAM,EAAE,2CA0BxB;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/server/index.js

@@ -1,5 +1,6 @@
 import { betterAuth } from 'better-auth';
 import { prismaAdapter } from 'better-auth/adapters/prisma';
+import { nextCookies } from 'better-auth/next-js';
 /**
  * Get better-auth database configuration from OpenSaas config
  */
@@ -101,8 +102,13 @@ export function createAuth(opensaasConfig, context) {
                             max: authConfig.rateLimit.max,
                         }
                         : undefined,
-                    // Pass through any additional Better Auth plugins
-                    plugins: authConfig.betterAuthPlugins || [],
+                    // Pass through any additional Better Auth plugins, then append
+                    // nextCookies LAST so it can write the Set-Cookie headers produced by
+                    // any auth.api.* call made inside a Next.js server action into Next's
+                    // cookie store. This is what makes the server-action auth forms (which
+                    // call auth.api.signInEmail/signUpEmail/etc. server-side) actually
+                    // persist a session. It must be the final plugin in the array.
+                    plugins: [...(authConfig.betterAuthPlugins || []), nextCookies()],
                 };
                 authInstance = betterAuth(betterAuthConfig);
                 return authInstance;

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAM3D;;GAEG;AACH,SAAS,iBAAiB,CACxB,QAAwB,EACxB,OAAsB;IAEtB,OAAO,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,KAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,MAAM,OAAO,GAA4D,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACxD,IAAI,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACxB,cAAwD,EACxD,OAA+C;IAE/C,4CAA4C;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE/C,0CAA0C;IAC1C,IAAI,YAAY,GAAyC,IAAI,CAAA;IAC7D,IAAI,WAAW,GAAkD,IAAI,CAAA;IAErE,KAAK,UAAU,eAAe;QAC5B,IAAI,YAAY;YAAE,OAAO,YAAY,CAAA;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,cAAc,GAAG,MAAM,aAAa,CAAA;gBAC1C,MAAM,eAAe,GAAG,MAAM,cAAc,CAAA;gBAE5C,uCAAuC;gBACvC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,IAAwC,CAAA;gBAEvF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAA;gBACH,CAAC;gBAED,kCAAkC;gBAClC,MAAM,gBAAgB,GAAsB;oBAC1C,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,EAAE,EAAE,eAAe,CAAC;oBAE/D,sEAAsE;oBACtE,iEAAiE;oBACjE,4DAA4D;oBAC5D,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;oBACtD,OAAO,EAAE;wBACP,GAAG,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;wBACtD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM;wBACjD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS;4BACrC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE;4BAC/C,CAAC,CAAC,CAAC;qBACN;oBACD,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC5D,YAAY,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;oBAEtE,0CAA0C;oBAC1C,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO;wBACnD,CAAC,CAAC;4BACE,OAAO,EAAE,IAAI;4BACb,wBAAwB,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO;yBAC/D;wBACH,CAAC,CAAC,SAAS;oBAEb,uCAAuC;oBACvC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;oBAEzE,mBAAmB;oBACnB,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;yBACxD,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;yBAClD,MAAM,CACL,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;wBAC1B,IAAI,MAAM,EAAE,CAAC;4BACX,GAAG,CAAC,QAAQ,CAAC,GAAG;gCACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,YAAY,EAAE,MAAM,CAAC,YAAY;6BAClC,CAAA;wBACH,CAAC;wBACD,OAAO,GAAG,CAAA;oBACZ,CAAC,EACD,EAAgE,CACjE;oBAEH,8BAA8B;oBAC9B,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC7B,CAAC,CAAC;4BACE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;4BACrC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM;4BACnC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG;yBAC9B;wBACH,CAAC,CAAC,SAAS;oBAEb,kDAAkD;oBAClD,OAAO,EAAE,UAAU,CAAC,iBAAiB,IAAI,EAAE;iBAC5C,CAAA;gBAED,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;gBAC3C,OAAO,YAAY,CAAA;YACrB,CAAC,CAAC,EAAE,CAAA;QACN,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,2DAA2D;IAC3D,OAAO,IAAI,KAAK,CAAC,EAAmC,EAAE;QACpD,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,oCAAoC;gBACpC,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,iCAAiC;YACjC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;gBAC/C,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;gBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;gBACrD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;oBAChC,OAAQ,KAAyC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACzE,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAA;YAED,4EAA4E;YAC5E,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE;gBAC5B,GAAG,CAAC,MAAM,EAAE,OAAO;oBACjB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;wBACvB,qCAAqC;wBACrC,OAAO,SAAS,CAAA;oBAClB,CAAC;oBACD,4DAA4D;oBAC5D,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;wBAClC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;wBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;wBAC3D,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;4BACnD,MAAM,UAAU,GAAI,WAAuC,CAAC,OAAiB,CAAC,CAAA;4BAC9E,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gCACrC,OAAQ,UAA8C,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;4BACjF,CAAC;4BACD,OAAO,UAAU,CAAA;wBACnB,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,6BAA6B,CACzE,CAAA;oBACH,CAAC,CAAA;gBACH,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAmC,EACnC,aAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACxC,OAAO,EAAE,IAAI,OAAO,EAAE;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,6CAA6C;QAC7C,MAAM,MAAM,GAA4B,EAAE,CAAA;QAE1C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;YACjC,CAAC;iBAAM,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAMjD;;GAEG;AACH,SAAS,iBAAiB,CACxB,QAAwB,EACxB,OAAsB;IAEtB,OAAO,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,KAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,MAAM,OAAO,GAA4D,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACxD,IAAI,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACxB,cAAwD,EACxD,OAA+C;IAE/C,4CAA4C;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE/C,0CAA0C;IAC1C,IAAI,YAAY,GAAyC,IAAI,CAAA;IAC7D,IAAI,WAAW,GAAkD,IAAI,CAAA;IAErE,KAAK,UAAU,eAAe;QAC5B,IAAI,YAAY;YAAE,OAAO,YAAY,CAAA;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,cAAc,GAAG,MAAM,aAAa,CAAA;gBAC1C,MAAM,eAAe,GAAG,MAAM,cAAc,CAAA;gBAE5C,uCAAuC;gBACvC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,IAAwC,CAAA;gBAEvF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAA;gBACH,CAAC;gBAED,kCAAkC;gBAClC,MAAM,gBAAgB,GAAsB;oBAC1C,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,EAAE,EAAE,eAAe,CAAC;oBAE/D,sEAAsE;oBACtE,iEAAiE;oBACjE,4DAA4D;oBAC5D,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;oBACtD,OAAO,EAAE;wBACP,GAAG,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;wBACtD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM;wBACjD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS;4BACrC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE;4BAC/C,CAAC,CAAC,CAAC;qBACN;oBACD,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC5D,YAAY,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;oBAEtE,0CAA0C;oBAC1C,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO;wBACnD,CAAC,CAAC;4BACE,OAAO,EAAE,IAAI;4BACb,wBAAwB,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO;yBAC/D;wBACH,CAAC,CAAC,SAAS;oBAEb,uCAAuC;oBACvC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;oBAEzE,mBAAmB;oBACnB,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;yBACxD,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;yBAClD,MAAM,CACL,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;wBAC1B,IAAI,MAAM,EAAE,CAAC;4BACX,GAAG,CAAC,QAAQ,CAAC,GAAG;gCACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,YAAY,EAAE,MAAM,CAAC,YAAY;6BAClC,CAAA;wBACH,CAAC;wBACD,OAAO,GAAG,CAAA;oBACZ,CAAC,EACD,EAAgE,CACjE;oBAEH,8BAA8B;oBAC9B,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC7B,CAAC,CAAC;4BACE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;4BACrC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM;4BACnC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG;yBAC9B;wBACH,CAAC,CAAC,SAAS;oBAEb,+DAA+D;oBAC/D,sEAAsE;oBACtE,sEAAsE;oBACtE,uEAAuE;oBACvE,mEAAmE;oBACnE,+DAA+D;oBAC/D,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;iBAClE,CAAA;gBAED,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;gBAC3C,OAAO,YAAY,CAAA;YACrB,CAAC,CAAC,EAAE,CAAA;QACN,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,2DAA2D;IAC3D,OAAO,IAAI,KAAK,CAAC,EAAmC,EAAE;QACpD,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,oCAAoC;gBACpC,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,iCAAiC;YACjC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;gBAC/C,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;gBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;gBACrD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;oBAChC,OAAQ,KAAyC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACzE,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAA;YAED,4EAA4E;YAC5E,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE;gBAC5B,GAAG,CAAC,MAAM,EAAE,OAAO;oBACjB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;wBACvB,qCAAqC;wBACrC,OAAO,SAAS,CAAA;oBAClB,CAAC;oBACD,4DAA4D;oBAC5D,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;wBAClC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;wBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;wBAC3D,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;4BACnD,MAAM,UAAU,GAAI,WAAuC,CAAC,OAAiB,CAAC,CAAA;4BAC9E,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gCACrC,OAAQ,UAA8C,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;4BACjF,CAAC;4BACD,OAAO,UAAU,CAAA;wBACnB,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,6BAA6B,CACzE,CAAA;oBACH,CAAC,CAAA;gBACH,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAmC,EACnC,aAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACxC,OAAO,EAAE,IAAI,OAAO,EAAE;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,6CAA6C;QAC7C,MAAM,MAAM,GAA4B,EAAE,CAAA;QAE1C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;YACjC,CAAC;iBAAM,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/ui/components/ForgotPasswordForm.d.ts

@@ -1,10 +1,10 @@
-import type { createAuthClient } from 'better-auth/react';
+import type { RequestPasswordResetAction } from '../types.js';
 export type ForgotPasswordFormProps = {
     /**
-     * Better-auth client instance
-     * Created with createAuthClient from better-auth/react
+     * Server action that requests a password-reset email.
+     * Define it in your app (`'use server'`) against your own auth instance.
      */
-    authClient: ReturnType<typeof createAuthClient>;
+    requestPasswordResetAction: RequestPasswordResetAction;
     /**
      * Custom CSS class for the form container
      */
@@ -22,15 +22,18 @@ export type ForgotPasswordFormProps = {
  * Forgot password form component
  * Allows users to request a password reset email
  *
+ * Submits through an app-owned server action rather than calling the auth API
+ * from the browser. See the "Auth action" contract in `@opensaas/stack-auth/ui`.
+ *
  * @example
  * ```typescript
  * import { ForgotPasswordForm } from '@opensaas/stack-auth/ui'
- * import { authClient } from '@/lib/auth-client'
+ * import { requestPasswordResetAction } from '@/lib/actions/auth'
  *
  * export default function ForgotPasswordPage() {
- *   return <ForgotPasswordForm authClient={authClient} />
+ *   return <ForgotPasswordForm requestPasswordResetAction={requestPasswordResetAction} />
  * }
  * ```
  */
-export declare function ForgotPasswordForm({ authClient, className, onSuccess, onError, }: ForgotPasswordFormProps): import("react/jsx-runtime").JSX.Element;
+export declare function ForgotPasswordForm({ requestPasswordResetAction, className, onSuccess, onError, }: ForgotPasswordFormProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=ForgotPasswordForm.d.ts.map

package/dist/ui/components/ForgotPasswordForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ForgotPasswordForm.d.ts","sourceRoot":"","sources":["../../../src/ui/components/ForgotPasswordForm.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,UAAU,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;IAC/C;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;IACtB;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CACjC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,UAAU,EACV,SAAc,EACd,SAAS,EACT,OAAO,GACR,EAAE,uBAAuB,2CA2EzB"}
+{"version":3,"file":"ForgotPasswordForm.d.ts","sourceRoot":"","sources":["../../../src/ui/components/ForgotPasswordForm.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AAE7D,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,0BAA0B,EAAE,0BAA0B,CAAA;IACtD;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;IACtB;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CACjC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,0BAA0B,EAC1B,SAAc,EACd,SAAS,EACT,OAAO,GACR,EAAE,uBAAuB,2CA2EzB"}

package/dist/ui/components/ForgotPasswordForm.js

@@ -1,21 +1,25 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState } from 'react';
+import { cleanAuthErrorMessage } from '../lib/clean-error-message.js';
 /**
  * Forgot password form component
  * Allows users to request a password reset email
  *
+ * Submits through an app-owned server action rather than calling the auth API
+ * from the browser. See the "Auth action" contract in `@opensaas/stack-auth/ui`.
+ *
  * @example
  * ```typescript
  * import { ForgotPasswordForm } from '@opensaas/stack-auth/ui'
- * import { authClient } from '@/lib/auth-client'
+ * import { requestPasswordResetAction } from '@/lib/actions/auth'
  *
  * export default function ForgotPasswordPage() {
- *   return <ForgotPasswordForm authClient={authClient} />
+ *   return <ForgotPasswordForm requestPasswordResetAction={requestPasswordResetAction} />
  * }
  * ```
  */
-export function ForgotPasswordForm({ authClient, className = '', onSuccess, onError, }) {
+export function ForgotPasswordForm({ requestPasswordResetAction, className = '', onSuccess, onError, }) {
     const [email, setEmail] = useState('');
     const [error, setError] = useState('');
     const [success, setSuccess] = useState(false);
@@ -26,18 +30,15 @@ export function ForgotPasswordForm({ authClient, className = '', onSuccess, onEr
         setSuccess(false);
         setLoading(true);
         try {
-            const result = await authClient.requestPasswordReset({
-                email,
-                redirectTo: '/reset-password',
-            });
-            if (result.error) {
-                throw new Error(result.error.message);
+            const result = await requestPasswordResetAction({ email });
+            if (!result.success) {
+                throw new Error(cleanAuthErrorMessage(result.error, 'Failed to send reset email'));
             }
             setSuccess(true);
             onSuccess?.();
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : 'Failed to send reset email';
+            const message = cleanAuthErrorMessage(err instanceof Error ? err.message : undefined, 'Failed to send reset email');
             setError(message);
             onError?.(err instanceof Error ? err : new Error(message));
         }

package/dist/ui/components/ForgotPasswordForm.js.map

@@ -1 +1 @@
-{"version":3,"file":"ForgotPasswordForm.js","sourceRoot":"","sources":["../../../src/ui/components/ForgotPasswordForm.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAuBvC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,UAAU,EACV,SAAS,GAAG,EAAE,EACd,SAAS,EACT,OAAO,GACiB;IACxB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE7C,MAAM,YAAY,GAAG,KAAK,EAAE,CAAkB,EAAE,EAAE;QAChD,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,QAAQ,CAAC,EAAE,CAAC,CAAA;QACZ,UAAU,CAAC,KAAK,CAAC,CAAA;QACjB,UAAU,CAAC,IAAI,CAAC,CAAA;QAEhB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,oBAAoB,CAAC;gBACnD,KAAK;gBACL,UAAU,EAAE,iBAAiB;aAC9B,CAAC,CAAA;YAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,CAAA;YAChB,SAAS,EAAE,EAAE,CAAA;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAA;YACjF,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjB,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5D,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,CAAA;IAED,OAAO,CACL,eAAK,SAAS,EAAE,+BAA+B,SAAS,EAAE,aACxD,aAAI,SAAS,EAAC,yBAAyB,gCAAqB,EAE3D,KAAK,IAAI,CACR,cAAK,SAAS,EAAC,qEAAqE,YACjF,KAAK,GACF,CACP,EAEA,OAAO,IAAI,CACV,cAAK,SAAS,EAAC,2EAA2E,8EAEpF,CACP,EAED,gBAAM,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAC,WAAW,aACjD,0BACE,gBAAO,OAAO,EAAC,OAAO,EAAC,SAAS,EAAC,gCAAgC,sBAEzD,EACR,gBACE,EAAE,EAAC,OAAO,EACV,IAAI,EAAC,OAAO,EACZ,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAE,CAAC,CAAC,MAA2B,CAAC,KAAK,CAAC,EAC/D,QAAQ,QACR,SAAS,EAAC,wGAAwG,EAClH,QAAQ,EAAE,OAAO,IAAI,OAAO,GAC5B,IACE,EAEN,iBACE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,OAAO,IAAI,OAAO,EAC5B,SAAS,EAAC,uHAAuH,YAEhI,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,GAC7D,IACJ,IACH,CACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"ForgotPasswordForm.js","sourceRoot":"","sources":["../../../src/ui/components/ForgotPasswordForm.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAuBrE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,0BAA0B,EAC1B,SAAS,GAAG,EAAE,EACd,SAAS,EACT,OAAO,GACiB;IACxB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE7C,MAAM,YAAY,GAAG,KAAK,EAAE,CAAkB,EAAE,EAAE;QAChD,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,QAAQ,CAAC,EAAE,CAAC,CAAA;QACZ,UAAU,CAAC,KAAK,CAAC,CAAA;QACjB,UAAU,CAAC,IAAI,CAAC,CAAA;QAEhB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAE1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC,CAAA;YACpF,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,CAAA;YAChB,SAAS,EAAE,EAAE,CAAA;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,qBAAqB,CACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAC9C,4BAA4B,CAC7B,CAAA;YACD,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjB,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5D,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,CAAA;IAED,OAAO,CACL,eAAK,SAAS,EAAE,+BAA+B,SAAS,EAAE,aACxD,aAAI,SAAS,EAAC,yBAAyB,gCAAqB,EAE3D,KAAK,IAAI,CACR,cAAK,SAAS,EAAC,qEAAqE,YACjF,KAAK,GACF,CACP,EAEA,OAAO,IAAI,CACV,cAAK,SAAS,EAAC,2EAA2E,8EAEpF,CACP,EAED,gBAAM,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAC,WAAW,aACjD,0BACE,gBAAO,OAAO,EAAC,OAAO,EAAC,SAAS,EAAC,gCAAgC,sBAEzD,EACR,gBACE,EAAE,EAAC,OAAO,EACV,IAAI,EAAC,OAAO,EACZ,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAE,CAAC,CAAC,MAA2B,CAAC,KAAK,CAAC,EAC/D,QAAQ,QACR,SAAS,EAAC,wGAAwG,EAClH,QAAQ,EAAE,OAAO,IAAI,OAAO,GAC5B,IACE,EAEN,iBACE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,OAAO,IAAI,OAAO,EAC5B,SAAS,EAAC,uHAAuH,YAEhI,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,GAC7D,IACJ,IACH,CACP,CAAA;AACH,CAAC"}

package/dist/ui/components/ResetPasswordForm.d.ts

@@ -0,0 +1,60 @@
+import type { ResetPasswordAction } from '../types.js';
+export type ResetPasswordFormProps = {
+    /**
+     * Server action that completes the password reset.
+     * Define it in your app (`'use server'`) against your own auth instance.
+     */
+    resetPasswordAction: ResetPasswordAction;
+    /**
+     * The reset token from the email link. The page reads it from
+     * `searchParams.token` and passes it in. When empty, the form renders an
+     * "invalid or expired link" state instead of a password form.
+     */
+    token: string;
+    /**
+     * URL to redirect to after a successful reset
+     * @default '/sign-in'
+     */
+    redirectTo?: string;
+    /**
+     * Require password confirmation
+     * @default true
+     */
+    requirePasswordConfirmation?: boolean;
+    /**
+     * Custom CSS class for the form container
+     */
+    className?: string;
+    /**
+     * Callback when the reset succeeds
+     */
+    onSuccess?: () => void;
+    /**
+     * Callback when the reset fails
+     */
+    onError?: (error: Error) => void;
+};
+/**
+ * Reset password form component
+ * Completes a password reset using the token from the reset email.
+ *
+ * Submits through an app-owned server action rather than calling the auth API
+ * from the browser. See the "Auth action" contract in `@opensaas/stack-auth/ui`.
+ *
+ * @example
+ * ```typescript
+ * import { ResetPasswordForm } from '@opensaas/stack-auth/ui'
+ * import { resetPasswordAction } from '@/lib/actions/auth'
+ *
+ * export default async function ResetPasswordPage({
+ *   searchParams,
+ * }: {
+ *   searchParams: Promise<{ token?: string }>
+ * }) {
+ *   const { token } = await searchParams
+ *   return <ResetPasswordForm resetPasswordAction={resetPasswordAction} token={token ?? ''} />
+ * }
+ * ```
+ */
+export declare function ResetPasswordForm({ resetPasswordAction, token, redirectTo, requirePasswordConfirmation, className, onSuccess, onError, }: ResetPasswordFormProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=ResetPasswordForm.d.ts.map

package/dist/ui/components/ResetPasswordForm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResetPasswordForm.d.ts","sourceRoot":"","sources":["../../../src/ui/components/ResetPasswordForm.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD,MAAM,MAAM,sBAAsB,GAAG;IACnC;;;OAGG;IACH,mBAAmB,EAAE,mBAAmB,CAAA;IACxC;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IACrC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;IACtB;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CACjC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,mBAAmB,EACnB,KAAK,EACL,UAAuB,EACvB,2BAAkC,EAClC,SAAc,EACd,SAAS,EACT,OAAO,GACR,EAAE,sBAAsB,2CA4GxB"}

package/dist/ui/components/ResetPasswordForm.js

@@ -0,0 +1,70 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { useRouter } from 'next/navigation.js';
+import { cleanAuthErrorMessage } from '../lib/clean-error-message.js';
+/**
+ * Reset password form component
+ * Completes a password reset using the token from the reset email.
+ *
+ * Submits through an app-owned server action rather than calling the auth API
+ * from the browser. See the "Auth action" contract in `@opensaas/stack-auth/ui`.
+ *
+ * @example
+ * ```typescript
+ * import { ResetPasswordForm } from '@opensaas/stack-auth/ui'
+ * import { resetPasswordAction } from '@/lib/actions/auth'
+ *
+ * export default async function ResetPasswordPage({
+ *   searchParams,
+ * }: {
+ *   searchParams: Promise<{ token?: string }>
+ * }) {
+ *   const { token } = await searchParams
+ *   return <ResetPasswordForm resetPasswordAction={resetPasswordAction} token={token ?? ''} />
+ * }
+ * ```
+ */
+export function ResetPasswordForm({ resetPasswordAction, token, redirectTo = '/sign-in', requirePasswordConfirmation = true, className = '', onSuccess, onError, }) {
+    const router = useRouter();
+    const [password, setPassword] = useState('');
+    const [confirmPassword, setConfirmPassword] = useState('');
+    const [error, setError] = useState('');
+    const [loading, setLoading] = useState(false);
+    // Guard: no token means the user hit this page directly or followed a
+    // malformed/expired link. Don't render a form that can't succeed.
+    if (!token) {
+        return (_jsxs("div", { className: `w-full max-w-md mx-auto p-6 ${className}`, children: [_jsx("h2", { className: "text-2xl font-bold mb-6", children: "Reset Password" }), _jsx("div", { className: "bg-red-50 border border-red-200 text-red-700 px-4 py-3 rounded", children: "This password reset link is invalid or has expired. Please request a new one." })] }));
+    }
+    const handleSubmit = async (e) => {
+        e.preventDefault();
+        setError('');
+        if (requirePasswordConfirmation && password !== confirmPassword) {
+            setError('Passwords do not match');
+            return;
+        }
+        setLoading(true);
+        try {
+            const result = await resetPasswordAction({ token, password });
+            if (!result.success) {
+                throw new Error(cleanAuthErrorMessage(result.error, 'Failed to reset password'));
+            }
+            if (onSuccess) {
+                onSuccess();
+            }
+            else {
+                router.push(redirectTo);
+            }
+        }
+        catch (err) {
+            const message = cleanAuthErrorMessage(err instanceof Error ? err.message : undefined, 'Failed to reset password');
+            setError(message);
+            onError?.(err instanceof Error ? err : new Error(message));
+        }
+        finally {
+            setLoading(false);
+        }
+    };
+    return (_jsxs("div", { className: `w-full max-w-md mx-auto p-6 ${className}`, children: [_jsx("h2", { className: "text-2xl font-bold mb-6", children: "Reset Password" }), error && (_jsx("div", { className: "bg-red-50 border border-red-200 text-red-700 px-4 py-3 rounded mb-4", children: error })), _jsxs("form", { onSubmit: handleSubmit, className: "space-y-4", children: [_jsxs("div", { children: [_jsx("label", { htmlFor: "password", className: "block text-sm font-medium mb-2", children: "New Password" }), _jsx("input", { id: "password", type: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, className: "w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-blue-500", disabled: loading })] }), requirePasswordConfirmation && (_jsxs("div", { children: [_jsx("label", { htmlFor: "confirmPassword", className: "block text-sm font-medium mb-2", children: "Confirm New Password" }), _jsx("input", { id: "confirmPassword", type: "password", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, className: "w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-blue-500", disabled: loading })] })), _jsx("button", { type: "submit", disabled: loading, className: "w-full bg-blue-600 text-white py-2 px-4 rounded-md hover:bg-blue-700 disabled:bg-gray-400 disabled:cursor-not-allowed", children: loading ? 'Resetting...' : 'Reset Password' })] })] }));
+}
+//# sourceMappingURL=ResetPasswordForm.js.map

package/dist/ui/components/ResetPasswordForm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResetPasswordForm.js","sourceRoot":"","sources":["../../../src/ui/components/ResetPasswordForm.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAuCrE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,mBAAmB,EACnB,KAAK,EACL,UAAU,GAAG,UAAU,EACvB,2BAA2B,GAAG,IAAI,EAClC,SAAS,GAAG,EAAE,EACd,SAAS,EACT,OAAO,GACgB;IACvB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAC1B,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC5C,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC1D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE7C,sEAAsE;IACtE,kEAAkE;IAClE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CACL,eAAK,SAAS,EAAE,+BAA+B,SAAS,EAAE,aACxD,aAAI,SAAS,EAAC,yBAAyB,+BAAoB,EAC3D,cAAK,SAAS,EAAC,gEAAgE,8FAEzE,IACF,CACP,CAAA;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,EAAE,CAAkB,EAAE,EAAE;QAChD,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,QAAQ,CAAC,EAAE,CAAC,CAAA;QAEZ,IAAI,2BAA2B,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YAChE,QAAQ,CAAC,wBAAwB,CAAC,CAAA;YAClC,OAAM;QACR,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,CAAA;QAEhB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;YAE7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC,CAAA;YAClF,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,EAAE,CAAA;YACb,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,qBAAqB,CACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAC9C,0BAA0B,CAC3B,CAAA;YACD,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjB,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5D,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,CAAA;IAED,OAAO,CACL,eAAK,SAAS,EAAE,+BAA+B,SAAS,EAAE,aACxD,aAAI,SAAS,EAAC,yBAAyB,+BAAoB,EAE1D,KAAK,IAAI,CACR,cAAK,SAAS,EAAC,qEAAqE,YACjF,KAAK,GACF,CACP,EAED,gBAAM,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAC,WAAW,aACjD,0BACE,gBAAO,OAAO,EAAC,UAAU,EAAC,SAAS,EAAC,gCAAgC,6BAE5D,EACR,gBACE,EAAE,EAAC,UAAU,EACb,IAAI,EAAC,UAAU,EACf,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAE,CAAC,CAAC,MAA2B,CAAC,KAAK,CAAC,EAClE,QAAQ,QACR,SAAS,EAAC,wGAAwG,EAClH,QAAQ,EAAE,OAAO,GACjB,IACE,EAEL,2BAA2B,IAAI,CAC9B,0BACE,gBAAO,OAAO,EAAC,iBAAiB,EAAC,SAAS,EAAC,gCAAgC,qCAEnE,EACR,gBACE,EAAE,EAAC,iBAAiB,EACpB,IAAI,EAAC,UAAU,EACf,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAE,CAAC,CAAC,MAA2B,CAAC,KAAK,CAAC,EACzE,QAAQ,QACR,SAAS,EAAC,wGAAwG,EAClH,QAAQ,EAAE,OAAO,GACjB,IACE,CACP,EAED,iBACE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAC,uHAAuH,YAEhI,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,GACrC,IACJ,IACH,CACP,CAAA;AACH,CAAC"}