@protobase/server 0.15.5 → 0.16.0

package/dist/better-auth/sign-in-mail.js

@@ -1,45 +1,18 @@
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
 const codeLifetimeMinutes = 5;
 const codeLifetime = "5 minutes";
-/** The email with a code to sign in with instead of a password. */
-const signInCodeEmail = ({ to, code }) => ({
-	to,
-	subject: "Your sign-in code",
-	text: [
-		"Use this code to sign in:",
-		"",
-		code,
-		"",
-		`It works for ${codeLifetime}, once.`,
-		"If you did not try to sign in, ignore this email: nobody can sign in without the code.",
-		""
-	].join("\n")
-});
-/** The email with the second step of a sign-in, for an account with two-factor authentication by email. */
-const twoFactorCodeEmail = ({ to, code }) => ({
-	to,
-	subject: "Your verification code",
-	text: [
-		"Use this code to finish signing in:",
-		"",
-		code,
-		"",
-		`It works for ${codeLifetime}, once.`,
-		"If you did not just sign in, someone else may know your password or have your sign-in code: change your password.",
-		""
-	].join("\n")
-});
 /**
-* Better Auth's email OTP plugin as sign-in only: never a sign-up, codes stored hashed, sent with `mailer`. The
+* Better Auth's email OTP plugin as sign-in only: never a sign-up, codes stored hashed, sent with `mail`. The
 * plugin's other uses (email verification, its own password reset, changing the address) are not offered.
 */
-const emailCodeOptions = (mailer) => ({
+const emailCodeOptions = (mail) => ({
 	disableSignUp: true,
 	expiresIn: 300,
 	storeOTP: "hashed",
-	sendVerificationOTP: ({ email, otp }) => mailer.send(signInCodeEmail({
-		to: email,
-		code: otp
-	}))
+	sendVerificationOTP: ({ email, otp }, ctx) => sendAuthEmail(mail, "signInCodeEmail", email, {
+		code: otp,
+		lifetime: codeLifetime
+	}, ctx?.context.baseURL)
 });
 /** The email OTP plugin's endpoints Protobase does not use; `createAuth` turns them off. */
 const unusedEmailCodePaths = [
@@ -51,28 +24,14 @@ const unusedEmailCodePaths = [
 	"/email-otp/request-email-change",
 	"/email-otp/change-email"
 ];
-/** The two-factor plugin's emailed code, sent with `mailer`; stored hashed. */
-const twoFactorCodeOptions = (mailer) => ({
+/** The two-factor plugin's emailed code, sent with `mail`; stored hashed. */
+const twoFactorCodeOptions = (mail) => ({
 	period: codeLifetimeMinutes,
 	storeOTP: "hashed",
-	sendOTP: ({ user, otp }) => mailer.send(twoFactorCodeEmail({
-		to: user.email,
-		code: otp
-	}))
-});
-/** The email to someone whose app lets staff sign in as people only when they are told: who, why, and until when. */
-const staffSignInEmail = ({ to, staff, reason, expiresAt }) => ({
-	to,
-	subject: "Staff signed in as you",
-	text: [
-		`${staff}, of the team that runs this app, signed in as you to help. The reason they gave:`,
-		"",
-		reason,
-		"",
-		`Their session ends by ${expiresAt.toUTCString()}. The app's admins see it in the app's log of staff sign-ins.`,
-		"If you did not expect this, tell your admin.",
-		""
-	].join("\n")
+	sendOTP: ({ user, otp }, ctx) => sendAuthEmail(mail, "twoFactorCodeEmail", user.email, {
+		code: otp,
+		lifetime: codeLifetime
+	}, ctx?.context.baseURL)
 });
 //#endregion
-export { emailCodeOptions, signInCodeEmail, staffSignInEmail, twoFactorCodeEmail, twoFactorCodeOptions, unusedEmailCodePaths };
+export { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths };

package/dist/better-auth/sign-up/sign-up-code.js

@@ -2,6 +2,7 @@ import { APIError } from "better-auth/api";
 const signUpCodeLifetime = "5 minutes";
 const allowedAttempts = 3;
 const identifierOf = (email) => `sign-up-otp-${email}`;
+/** The SHA-256 of `secret`, base64: what the store keeps of a code or a ticket. */
 const hashOf = async (code) => {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(code));
 	return btoa(String.fromCharCode(...new Uint8Array(digest)));
@@ -49,4 +50,4 @@ const consumeSignUpCode = async (context, email, code) => {
 	throw invalidCode();
 };
 //#endregion
-export { consumeSignUpCode, issueSignUpCode, signUpCodeLifetime };
+export { consumeSignUpCode, hashOf, issueSignUpCode, signUpCodeLifetime };

package/dist/better-auth/sign-up/sign-up-plugin.d.ts

@@ -1,8 +1,10 @@
+import "../auth-mail/send-auth-email.js";
 import "zod";
 //#region src/better-auth/sign-up/sign-up-plugin.d.ts
 /** The paths of the sign-up endpoints, as `ctx.path` and the rate limits name them. */
 export declare const signUpPaths: {
   sendCode: string;
+  verifyCode: string;
   create: string;
 };
 //#endregion

package/dist/better-auth/sign-up/sign-up-plugin.js

@@ -1,8 +1,9 @@
+import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
 import { checkNewAccountPassword } from "../new-account-password.js";
 import { effectiveSignInPolicy } from "../sign-in-policy.js";
 import { readSignInPolicy } from "../policy-store.js";
-import { consumeSignUpCode, issueSignUpCode } from "./sign-up-code.js";
-import { accountExistsEmail, signUpCodeEmail } from "./sign-up-mail.js";
+import { consumeSignUpCode, issueSignUpCode, signUpCodeLifetime } from "./sign-up-code.js";
+import { consumeSignUpTicket, issueSignUpTicket } from "./sign-up-ticket.js";
 import { APIError, createAuthEndpoint } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
 import * as z$1 from "zod";
@@ -11,6 +12,7 @@ const address = z$1.string().trim().toLowerCase().pipe(z$1.email());
 /** The paths of the sign-up endpoints, as `ctx.path` and the rate limits name them. */
 const signUpPaths = {
 	sendCode: "/sign-up/send-code",
+	verifyCode: "/sign-up/verify-code",
 	create: "/sign-up/create"
 };
 const noAdminYet = () => new APIError("FORBIDDEN", {
@@ -18,12 +20,13 @@ const noAdminYet = () => new APIError("FORBIDDEN", {
 	message: "This app has no admin yet; accounts are created on the host until it has one."
 });
 /**
-* Open sign-up: anyone makes their own account, with `role`. The address comes first, and a code mailed to it, so an
-* account exists only for an address its owner reads, verified from the start, and nobody can claim an address before
-* its owner does. Asking for a code answers the same whether the address has an account or not; one that has gets a
-* mail saying so instead of a code. While the store has no user, nobody signs up: the first admin is made on the host.
+* Open sign-up: anyone makes their own account, with `role`. The address comes first, then the code mailed to it on its
+* own, and only then the name and password, so an account exists only for an address its owner reads, verified from the
+* start, and nobody can claim an address before its owner does. Asking for a code answers the same whether the address
+* has an account or not; one that has gets a mail saying so, with a link to sign in, instead of a code. While the store
+* has no user, nobody signs up: the first admin is made on the host.
 */
-const signUpPlugin = ({ role, mailer, appName }) => ({
+const signUpPlugin = ({ role, mail }) => ({
 	id: "protobase-sign-up",
 	endpoints: {
 		/** `POST /sign-up/send-code` with `{ email }`: mails a code for making an account with the address. */
@@ -34,36 +37,48 @@ const signUpPlugin = ({ role, mailer, appName }) => ({
 			const { email } = ctx.body;
 			const { internalAdapter, adapter } = ctx.context;
 			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
-			const message = await internalAdapter.findUserByEmail(email) ? accountExistsEmail({
-				to: email,
-				appName
-			}) : signUpCodeEmail({
-				to: email,
+			const sending = await internalAdapter.findUserByEmail(email) ? sendAuthEmail(mail, "accountExistsEmail", email, {}, ctx.context.baseURL) : sendAuthEmail(mail, "signUpCodeEmail", email, {
 				code: await issueSignUpCode(ctx.context, email),
-				appName
-			});
-			await ctx.context.runInBackgroundOrAwait(mailer.send(message));
+				lifetime: signUpCodeLifetime
+			}, ctx.context.baseURL);
+			await ctx.context.runInBackgroundOrAwait(sending);
 			return ctx.json({ sent: true });
 		}),
 		/**
-		* `POST /sign-up/create` with `{ email, code, name, password? }`: makes the account with the mailed code, verified
-		* and with the sign-up role, and signs the person in. A password is needed unless the sign-in policy offers emailed
-		* codes; the policy's required methods are then set up as after any sign-in.
+		* `POST /sign-up/verify-code` with `{ email, code }`: takes the mailed code on its own, before anything else is asked,
+		* and answers `{ ticket }`, which makes the account for the address with the step after.
 		*/
-		createSignUpAccount: createAuthEndpoint(signUpPaths.create, {
+		verifySignUpCode: createAuthEndpoint(signUpPaths.verifyCode, {
 			method: "POST",
 			body: z$1.object({
 				email: address,
-				code: z$1.string().trim().min(1),
+				code: z$1.string().trim().min(1)
+			})
+		}, async (ctx) => {
+			const { email, code } = ctx.body;
+			if (await ctx.context.adapter.count({ model: "user" }) === 0) throw noAdminYet();
+			await consumeSignUpCode(ctx.context, email, code);
+			return ctx.json({ ticket: await issueSignUpTicket(ctx.context, email) });
+		}),
+		/**
+		* `POST /sign-up/create` with `{ ticket, name, password? }`: makes the account for the address the ticket's code was
+		* right for, verified and with the sign-up role, and signs the person in. A password is needed unless the sign-in
+		* policy offers emailed codes; the policy's required methods are then set up as after any sign-in. A refused
+		* password leaves the ticket for another try.
+		*/
+		createSignUpAccount: createAuthEndpoint(signUpPaths.create, {
+			method: "POST",
+			body: z$1.object({
+				ticket: z$1.string().min(1),
 				name: z$1.string().trim().min(1).max(200),
 				password: z$1.string().optional()
 			})
 		}, async (ctx) => {
-			const { email, code, name, password } = ctx.body;
+			const { ticket, name, password } = ctx.body;
 			const { internalAdapter, adapter } = ctx.context;
 			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
 			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(adapter)).policy, { mail: true }), password);
-			await consumeSignUpCode(ctx.context, email, code);
+			const email = await consumeSignUpTicket(ctx.context, ticket);
 			if (await internalAdapter.findUserByEmail(email)) throw new APIError("BAD_REQUEST", {
 				code: "ACCOUNT_EXISTS",
 				message: "This address has an account already: sign in instead."

package/dist/better-auth/sign-up/sign-up-ticket.js

@@ -0,0 +1,34 @@
+import { hashOf } from "./sign-up-code.js";
+import { APIError } from "better-auth/api";
+//#region src/better-auth/sign-up/sign-up-ticket.ts
+/** How long a ticket from a right code makes the account, in seconds. */
+const signUpTicketLifetimeSeconds = 1800;
+const identifierOf = async (ticket) => `sign-up-ticket-${await hashOf(ticket)}`;
+const randomTicket = () => {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+	return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+};
+/** A new ticket for `email`, whose code was right; the store keeps only its hash. */
+const issueSignUpTicket = async (context, email) => {
+	const ticket = randomTicket();
+	await context.internalAdapter.createVerificationValue({
+		identifier: await identifierOf(ticket),
+		value: email,
+		expiresAt: new Date(Date.now() + signUpTicketLifetimeSeconds * 1e3)
+	});
+	return ticket;
+};
+/**
+* Takes `ticket`, so it works once, and answers the address its code was right for. Taking it is atomic, so of two
+* requests with it only one gets through. Throws `SIGN_UP_TICKET_INVALID` for a ticket that is unknown, used or expired.
+*/
+const consumeSignUpTicket = async (context, ticket) => {
+	const consumed = await context.internalAdapter.consumeVerificationValue(await identifierOf(ticket));
+	if (!consumed || new Date(consumed.expiresAt) < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
+		code: "SIGN_UP_TICKET_INVALID",
+		message: "This sign-up took too long. Start again with your email address."
+	});
+	return consumed.value;
+};
+//#endregion
+export { consumeSignUpTicket, issueSignUpTicket, signUpTicketLifetimeSeconds };

package/dist/better-auth/staff-plugin.js

@@ -11,13 +11,13 @@ import { deleteSessionCookie } from "better-auth/cookies";
 * staff sign-in is logged for the app's admins. The plugin is there without an operator provider too, so its table
 * exists from the first auth migration.
 */
-const staffSignInPlugin = ({ operator, mailer }) => ({
+const staffSignInPlugin = ({ operator, mail }) => ({
 	id: "protobase-staff-sign-in",
 	schema: staffSignInSchema,
 	endpoints: {
 		...operator && staffSignInEndpoints({
 			operator,
-			...mailer && { mailer }
+			...mail && { mail }
 		}),
 		/** `GET /staff/session`: for a staff session, who started it, as whom, why, and until when; otherwise `{ staff: null }`. */
 		getStaffSession: createAuthEndpoint("/staff/session", {

package/dist/better-auth/staff-sign-in-endpoints.js

@@ -1,9 +1,9 @@
 import { reasonProblem, staffClaimsRefusal, staffLabel } from "./staff-checks.js";
 import { operatorClient, randomValue } from "./operator-provider.js";
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
 import { effectiveSignInPolicy } from "./sign-in-policy.js";
 import { readSignInPolicy } from "./policy-store.js";
 import { policyRefusal, staffSignInPath } from "./sign-in-enforcement.js";
-import { staffSignInEmail } from "./sign-in-mail.js";
 import { logStaffSignIn } from "./staff-log.js";
 import { APIError, createAuthEndpoint } from "better-auth/api";
 import { expireCookie, setSessionCookie } from "better-auth/cookies";
@@ -35,7 +35,7 @@ const withError = (url, code) => {
 * permission and sign-in and starts a session as the person, of Better Auth's admin plugin (`impersonatedBy` names
 * them). The session is short and never extended, and the person's two-factor and passkey requirements do not stop it.
 */
-const staffSignInEndpoints = ({ operator, mailer }) => {
+const staffSignInEndpoints = ({ operator, mail }) => {
 	const clients = /* @__PURE__ */ new Map();
 	const clientOf = (context) => {
 		const callback = `${context.baseURL}/staff/callback`;
@@ -52,19 +52,18 @@ const staffSignInEndpoints = ({ operator, mailer }) => {
 			now: Math.floor(Date.now() / 1e3)
 		});
 		if (refusal) return refusal;
-		const policy = effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail: Boolean(mailer) });
+		const policy = effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail: Boolean(mail) });
 		const off = policyRefusal(policy, { path: staffSignInPath });
 		if (off) return off;
 		const found = await ctx.context.internalAdapter.findUserByEmail(started.email.toLowerCase());
 		if (!found || found.user.banned) return userUnavailable;
 		const staff = staffLabel(claims);
 		const expiresAt = new Date(Date.now() + operator.sessionMinutes * 60 * 1e3);
-		if (policy.staffAccess === "notify" && mailer) await mailer.send(staffSignInEmail({
-			to: found.user.email,
+		if (policy.staffAccess === "notify" && mail) await sendAuthEmail(mail, "staffSignInEmail", found.user.email, {
 			staff,
 			reason: started.reason,
 			expiresAt
-		}));
+		}, ctx.context.baseURL);
 		const session = await ctx.context.internalAdapter.createSession(found.user.id, true, {
 			impersonatedBy: staff,
 			expiresAt

package/dist/check-views.js

@@ -37,6 +37,10 @@ const valueColorErrors = (view, model) => Object.entries(view.fields).flatMap(([
 	if (field?.type !== "enum") return [`value colours of "${name}" need an enum field`];
 	return Object.keys(hints.valueColors).filter((value) => !field.enumValues?.includes(value)).map((value) => `value colour "${value}" is not a value of "${name}"`);
 });
+const multilineErrors = (view, model) => Object.entries(view.fields).flatMap(([name, hints]) => {
+	const field = model.fields[name];
+	return hints.multiline && field && field.type !== "text" ? [`multiline "${name}" needs a text field, not ${field.type}`] : [];
+});
 const linkErrors = (view, model, models, pages) => view.actions.flatMap(({ name, label, run }) => {
 	if (run?.kind !== "link") return [];
 	const error = linkActionError(label, run);
@@ -98,6 +102,7 @@ const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 			...unknownFieldErrors(view, model),
 			...valueLabelErrors(view, model),
 			...valueColorErrors(view, model),
+			...multilineErrors(view, model),
 			...widgetErrors(view, model, fieldTypes),
 			...related,
 			...photos,

package/dist/index.d.ts

@@ -6,6 +6,7 @@ import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-def
 import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
 import { OrganizationsOptions } from "./better-auth/organizations/options.js";
 import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
+import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { StandardSchema, readJson } from "./functions/read-json.js";
@@ -78,7 +79,6 @@ import { FileRef, formatUri, variantPath } from "./files/uri.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js";
 import { FatalJobError } from "./jobs/run-job.js";
-import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";

package/dist/mail/platform-mailer.js

@@ -1,10 +1,17 @@
+import { readAppName } from "../app-name.js";
 import { readMailSettings } from "./mail-settings.js";
 import { smtpMailer } from "./smtp-mailer.js";
 //#region src/mail/platform-mailer.ts
-/** The platform's SMTP server and sender from `PROTOBASE_SMTP_URL` and `PROTOBASE_MAIL_FROM`; `undefined` when mail is off. */
-const platformMailer = (env = globalThis.process?.env ?? {}) => {
+/**
+* The platform's SMTP server and sender from `PROTOBASE_SMTP_URL` and `PROTOBASE_MAIL_FROM`; `undefined` when mail is off.
+* The From header shows `name` as the sender's name, by default the app's name from `PROTOBASE_APP_NAME`, when set.
+*/
+const platformMailer = (env = globalThis.process?.env ?? {}, name = readAppName(env)) => {
 	const settings = readMailSettings(env);
-	return settings && smtpMailer(settings);
+	return settings && smtpMailer({
+		...settings,
+		...name && { name }
+	});
 };
 //#endregion
 export { platformMailer };

package/dist/mail/smtp-mailer.js

@@ -5,7 +5,7 @@
 *
 * The client greets the server (EHLO) with the sender's domain, the app's own mail name, instead of what the container
 * reports, which is often just `[127.0.0.1]` and makes receiving servers trust the mail less. A `name` query parameter
-* on the SMTP URL still overrides it.
+* on the SMTP URL still overrides it. With a `name`, the From header carries it as the sender's display name.
 */
 const smtpMailer = (settings) => {
 	let transport;
@@ -15,11 +15,15 @@ const smtpMailer = (settings) => {
 			name: senderDomain(settings.from)
 		}));
 		await (await transport).sendMail({
-			from: settings.from,
+			from: sender(settings),
 			...message
 		});
 	} };
 };
+const sender = ({ from, name }) => name ? {
+	name,
+	address: from
+} : from;
 /** The domain of a sender address `readMailSettings` accepted, so always a dotted hostname. */
 const senderDomain = (from) => from.slice(from.lastIndexOf("@") + 1);
 //#endregion

package/dist/view-access.js

@@ -52,7 +52,12 @@ const listShape = (resource, models, prompted) => shapes.object({
 			icon: shapes.data,
 			latitude: shapes.field,
 			longitude: shapes.field,
-			cards: shapes.data
+			cards: shapes.data,
+			approximate: shapes.field,
+			exact: shapes.field,
+			radius: shapes.field,
+			defaultRadius: shapes.data,
+			area: shapes.field
 		}, { requires: ["latitude", "longitude"] }),
 		custom: shapes.object({
 			kind: shapes.data,

package/dist/view-map.js

@@ -18,12 +18,22 @@ const mapErrors = (item, model) => [
 	...item.zoom === void 0 || Number.isFinite(item.zoom) && item.zoom >= 0 && item.zoom <= maxZoom ? [] : [`zoom ${item.zoom} is not between 0 and ${maxZoom}`]
 ];
 const filterableErrors = (model, name) => Object.hasOwn(model.fields, name) && !model.fields[name].filterable ? [`"${name}" on ${model.name} is not filterable, and the map display filters by position`] : [];
-/** What makes a map display unable to show the records: a field that is no number, or one it cannot filter by. */
+const typeErrors = (model, name, types, what) => {
+	if (name === void 0) return [];
+	const field = Object.hasOwn(model.fields, name) ? model.fields[name] : void 0;
+	if (!field) return [`unknown field "${name}" on ${model.name}`];
+	return types.includes(field.type) ? [] : [`"${name}" on ${model.name} is ${field.type}, not ${what}`];
+};
+/** What makes a map display unable to show the records: a field that is no number, one it cannot filter by, or one of the wrong type for how exact a position is. */
 const mapDisplayErrors = (display, model) => [
 	...coordinateErrors(model, display.latitude),
 	...coordinateErrors(model, display.longitude),
 	...filterableErrors(model, display.latitude),
-	...filterableErrors(model, display.longitude)
+	...filterableErrors(model, display.longitude),
+	...typeErrors(model, display.approximate, ["boolean"], "a boolean"),
+	...typeErrors(model, display.exact, ["boolean"], "a boolean"),
+	...typeErrors(model, display.radius, [...coordinateTypes], "a number of metres"),
+	...typeErrors(model, display.area, ["json", "text"], "GeoJSON as json or text")
 ];
 //#endregion
 export { mapDisplayErrors, mapErrors };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.15.5",
+  "version": "0.16.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.15.5",
-    "@protobase/query": "0.15.5",
-    "@protobase/schema": "0.15.5",
+    "@protobase/layout": "0.16.0",
+    "@protobase/query": "0.16.0",
+    "@protobase/schema": "0.16.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",
@@ -48,6 +48,7 @@
     "pg-boss": "12.37.1",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
+    "react-email": "^6.11.1",
     "thumbhash": "^0.1.1",
     "zod": "^4.6.5"
   },

package/dist/better-auth/organizations/invitation-mail.js

@@ -1,17 +0,0 @@
-//#region src/better-auth/organizations/invitation-mail.ts
-/** The invitation email: who invites whom to which organization, the link, and until when it works. */
-const invitationEmail = ({ to, inviter, organization, url, expiresAt }) => ({
-	to,
-	subject: `Join ${organization}`,
-	text: [
-		`${inviter} invites you to join ${organization}. To accept, open this link:`,
-		"",
-		url,
-		"",
-		`The link works until ${new Date(expiresAt).toUTCString()}.`,
-		"If you do not want to join, ignore this email: nothing happens without you.",
-		""
-	].join("\n")
-});
-//#endregion
-export { invitationEmail };

package/dist/better-auth/sign-up/sign-up-mail.js

@@ -1,29 +0,0 @@
-import { signUpCodeLifetime } from "./sign-up-code.js";
-//#region src/better-auth/sign-up/sign-up-mail.ts
-/** The email with the code that makes an account for the address. */
-const signUpCodeEmail = ({ to, code, appName }) => ({
-	to,
-	subject: "Your code to create an account",
-	text: [
-		`Use this code to create your account for ${appName}:`,
-		"",
-		code,
-		"",
-		`It works for ${signUpCodeLifetime}, once.`,
-		"If you did not try to create an account, ignore this email: nobody can create one for your address without the code.",
-		""
-	].join("\n")
-});
-/** The email to an address that asked for a sign-up code while it has an account already: no code, a pointer to sign in instead. */
-const accountExistsEmail = ({ to, appName }) => ({
-	to,
-	subject: "You already have an account",
-	text: [
-		`Someone asked to create an account for ${appName} with this address, which has one already, so no new account was made.`,
-		"",
-		"Sign in with it instead. If this was not you, ignore this email.",
-		""
-	].join("\n")
-});
-//#endregion
-export { accountExistsEmail, signUpCodeEmail };