@remit/web-client 0.0.325 → 0.0.327

package/dist/spellcheck/worker-stub.js

@@ -0,0 +1,33 @@
+/**
+ * Keeps the spellchecking worker out of a build that staged no dictionaries.
+ *
+ * Vite emits a worker bundle for whatever module graph reaches a `new
+ * Worker(new URL(...))`, and it emits it while transforming that module —
+ * before tree-shaking, and whether or not anything in the output still imports
+ * it. So a dead branch around the dynamic import is not enough on its own: the
+ * bundle is already a file by the time the branch is dropped. The only way the
+ * worker never becomes an asset is for the specifier never to resolve to it.
+ *
+ * The decision is `resolveLanguages`, the same function the staging plugin
+ * asks, so there is no second answer to what this build carries.
+ */
+import { resolveLanguages } from "./languages.js";
+const WORKER_MODULE = "@remit/ui/spellcheck-worker";
+const STUB = "\0remit-spellcheck-absent";
+export const spellcheckWorkerStub = () => ({
+    name: "remit-spellcheck-worker-stub",
+    enforce: "pre",
+    resolveId(source) {
+        if (source !== WORKER_MODULE)
+            return null;
+        const staged = resolveLanguages(process.env.REMIT_SPELLCHECK_LANGUAGES);
+        return staged.length === 0 ? STUB : null;
+    },
+    load(id) {
+        // The provider's own contract for a language it cannot check: answer null,
+        // start no worker, and leave the browser's checking switched on.
+        return id === STUB
+            ? "export const openSpellcheckWorker = async () => null;\n"
+            : null;
+    },
+});

package/dist/src/auth/AccountMenu.d.ts

@@ -0,0 +1 @@
+export declare const AccountMenu: () => import("react").JSX.Element;

package/dist/src/auth/AccountMenu.js

@@ -0,0 +1,4 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { AccountMenu as AccountMenuView } from "@remit/ui";
+import { AccountSession } from "./AccountSession";
+export const AccountMenu = () => (_jsx(AccountSession, { children: ({ email, signOut }) => (_jsx(AccountMenuView, { email: email, onSignOut: signOut })) }));

package/dist/src/auth/AccountSession.d.ts

@@ -0,0 +1,14 @@
+import type { ReactNode } from "react";
+import { type AuthAccount } from "./provider";
+export type AccountSessionValue = AuthAccount;
+interface AccountSessionProps {
+    children: (session: AccountSessionValue) => ReactNode;
+}
+/**
+ * Hands the signed-in account's email and a `signOut` action to its children,
+ * sourced from whichever identity provider the app was composed with. Renders
+ * nothing when no session is active, so the same account affordances mount in
+ * every auth mode without a surface knowing which provider is in play.
+ */
+export declare const AccountSession: ({ children }: AccountSessionProps) => import("react").JSX.Element;
+export {};

package/dist/src/auth/AccountSession.js

@@ -0,0 +1,12 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useAuthProvider } from "./provider";
+/**
+ * Hands the signed-in account's email and a `signOut` action to its children,
+ * sourced from whichever identity provider the app was composed with. Renders
+ * nothing when no session is active, so the same account affordances mount in
+ * every auth mode without a surface knowing which provider is in play.
+ */
+export const AccountSession = ({ children }) => {
+    const { Account } = useAuthProvider();
+    return _jsx(Account, { children: children });
+};

package/dist/src/auth/BetterAuthShell.d.ts

@@ -0,0 +1,18 @@
+import { type ReactNode } from "react";
+import { type SessionQuery } from "./session-state";
+interface BetterAuthShellProps {
+    children: ReactNode;
+}
+export declare const SignInForm: () => import("react").JSX.Element;
+interface SessionGateProps {
+    session: SessionQuery;
+    onRetry: () => void;
+    children: ReactNode;
+}
+/**
+ * What the app shows for each state the session lookup can be in, separated
+ * from the hook that feeds it so every state can be driven directly.
+ */
+export declare const SessionGate: ({ session, onRetry, children, }: SessionGateProps) => import("react").JSX.Element;
+export declare const BetterAuthShell: ({ children }: BetterAuthShellProps) => import("react").JSX.Element;
+export {};

package/dist/src/auth/BetterAuthShell.js

@@ -0,0 +1,88 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { AuthCard, AuthFooter, AuthHero, Banner, Button, Input, PasswordInput, } from "@remit/ui";
+import { useState } from "react";
+import { AppShellSkeleton } from "../components/layout/AppShellSkeleton";
+import { FatalErrorOverlay } from "../components/ui/FatalErrorOverlay";
+import { openBugReport } from "../lib/bug-report";
+import { authFooterNote } from "./account-menu-mode";
+import { authInlineMessage, classifyAuthError, reportFatalAuthError, } from "./auth-error";
+import { authClient, isBetterAuthEnabled, isSignUpDisabledError, } from "./better-auth-config";
+import { SessionRateLimited } from "./SessionRateLimited";
+import { classifySessionQuery } from "./session-state";
+const SIGN_UP_REQUEST = {
+    method: "POST",
+    path: "/api/auth/sign-up/email",
+};
+const SIGN_IN_REQUEST = {
+    method: "POST",
+    path: "/api/auth/sign-in/email",
+};
+export const SignInForm = () => {
+    const [mode, setMode] = useState("signIn");
+    const [name, setName] = useState("");
+    const [email, setEmail] = useState("");
+    const [password, setPassword] = useState("");
+    const [error, setError] = useState(null);
+    const [submitting, setSubmitting] = useState(false);
+    // Learned from the server's rejection, never a client-side flag — the UI
+    // cannot disagree with better-auth's `disableSignUp`.
+    const [signUpClosed, setSignUpClosed] = useState(false);
+    const activeMode = signUpClosed ? "signIn" : mode;
+    const handleFailure = (failure, request) => {
+        if (isSignUpDisabledError(failure)) {
+            setSignUpClosed(true);
+            setMode("signIn");
+            return;
+        }
+        const kind = classifyAuthError(failure);
+        if (kind === "fatal") {
+            reportFatalAuthError(failure, request);
+            return;
+        }
+        setError(authInlineMessage(failure, kind));
+    };
+    const submit = async (event) => {
+        event.preventDefault();
+        if (submitting)
+            return;
+        setError(null);
+        setSubmitting(true);
+        const request = activeMode === "signUp" ? SIGN_UP_REQUEST : SIGN_IN_REQUEST;
+        // better-auth returns `{ error }` for a server rejection, but a network
+        // failure rejects the promise — fold both into one failure value so a
+        // broken route or contract never vanishes as an unhandled rejection.
+        const failure = await (activeMode === "signUp"
+            ? authClient.signUp.email({ email, password, name })
+            : authClient.signIn.email({ email, password })).then((result) => result.error ?? null, (thrown) => thrown);
+        setSubmitting(false);
+        // On success `failure` is null; better-auth's session store updates and
+        // useSession re-renders the gate into the app.
+        if (failure)
+            handleFailure(failure, request);
+    };
+    return (_jsxs(_Fragment, { children: [_jsx(FatalErrorOverlay, {}), _jsxs(AuthCard, { children: [_jsx(AuthHero, {}), _jsxs("form", { onSubmit: submit, className: "mt-6 flex flex-col gap-4 rounded-lg border border-line bg-surface p-7 shadow-lg", children: [signUpClosed ? (_jsx(Banner, { tone: "info", children: "New signups are currently closed. Sign in with an existing account, or contact your administrator for access." })) : (_jsxs("div", { className: "flex gap-1", children: [_jsx(Button, { size: "sm", variant: activeMode === "signIn" ? "secondary" : "ghost", "aria-pressed": activeMode === "signIn", onClick: () => setMode("signIn"), children: "Sign in" }), _jsx(Button, { size: "sm", variant: activeMode === "signUp" ? "secondary" : "ghost", "aria-pressed": activeMode === "signUp", onClick: () => setMode("signUp"), children: "Create account" })] })), error && _jsx(Banner, { tone: "danger", children: error }), activeMode === "signUp" && (_jsxs("div", { className: "flex flex-col gap-1 text-sm", children: [_jsx("label", { htmlFor: "ba-name", className: "text-fg-muted", children: "Name" }), _jsx(Input, { id: "ba-name", type: "text", autoComplete: "name", value: name, onChange: (e) => setName(e.target.value), placeholder: "Your name", required: true })] })), _jsxs("div", { className: "flex flex-col gap-1 text-sm", children: [_jsx("label", { htmlFor: "ba-email", className: "text-fg-muted", children: "Email" }), _jsx(Input, { id: "ba-email", type: "email", autoComplete: "email", value: email, onChange: (e) => setEmail(e.target.value), placeholder: "you@example.com", required: true })] }), _jsxs("div", { className: "flex flex-col gap-1 text-sm", children: [_jsx("label", { htmlFor: "ba-password", className: "text-fg-muted", children: "Password" }), _jsx(PasswordInput, { id: "ba-password", autoComplete: activeMode === "signUp" ? "new-password" : "current-password", value: password, onChange: (e) => setPassword(e.target.value), placeholder: "Your password", required: true })] }), _jsx(Button, { type: "submit", children: activeMode === "signUp" ? "Create account" : "Sign in" })] }), _jsx(AuthFooter, { note: authFooterNote({
+                            betterAuthEnabled: isBetterAuthEnabled(),
+                            cognitoConfigured: false,
+                        }) })] })] }));
+};
+/**
+ * What the app shows for each state the session lookup can be in, separated
+ * from the hook that feeds it so every state can be driven directly.
+ */
+export const SessionGate = ({ session, onRetry, children, }) => {
+    const state = classifySessionQuery(session);
+    if (state.kind === "active")
+        return _jsx(_Fragment, { children: children });
+    if (state.kind === "pending")
+        return _jsx(AppShellSkeleton, {});
+    if (state.kind === "rateLimited") {
+        return _jsx(SessionRateLimited, { onRetry: onRetry, onReport: openBugReport });
+    }
+    return _jsx(SignInForm, {});
+};
+export const BetterAuthShell = ({ children }) => {
+    const { data, isPending, error, refetch } = authClient.useSession();
+    return (_jsx(SessionGate, { session: { data, isPending, error }, onRetry: () => {
+            void refetch();
+        }, children: children }));
+};

package/dist/src/auth/SessionRateLimited.d.ts

@@ -0,0 +1,12 @@
+export interface SessionRateLimitedProps {
+    onRetry: () => void;
+    onReport: () => void;
+}
+/**
+ * The session could not be checked because the server is throttling this
+ * address. Shown instead of the sign-in screen, which would claim a sign-out
+ * that never happened (#441). The limits are keyed by IP, so a household, an
+ * office, a VPN exit or a handful of open tabs all spend one budget — the copy
+ * says so, because otherwise a single user cannot explain what they did wrong.
+ */
+export declare const SessionRateLimited: ({ onRetry, onReport, }: SessionRateLimitedProps) => import("react").JSX.Element;

package/dist/src/auth/SessionRateLimited.js

@@ -0,0 +1,10 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { AuthCard, AuthHero, Banner, Button } from "@remit/ui";
+/**
+ * The session could not be checked because the server is throttling this
+ * address. Shown instead of the sign-in screen, which would claim a sign-out
+ * that never happened (#441). The limits are keyed by IP, so a household, an
+ * office, a VPN exit or a handful of open tabs all spend one budget — the copy
+ * says so, because otherwise a single user cannot explain what they did wrong.
+ */
+export const SessionRateLimited = ({ onRetry, onReport, }) => (_jsxs(AuthCard, { children: [_jsx(AuthHero, {}), _jsxs("div", { className: "flex flex-col gap-4 rounded-lg border border-line bg-surface p-7 shadow-lg", children: [_jsxs(Banner, { tone: "warning", children: [_jsx("p", { className: "font-medium", children: "Too many requests from this address" }), _jsx("p", { className: "mt-1", children: "The server is limiting requests from your network address, so it could not check whether you are signed in. You have not been signed out." })] }), _jsx("p", { className: "text-sm text-fg-muted", children: "Wait a minute and try again. Everyone behind the same address \u2014 other people on this network, and every tab you have open \u2014 shares one limit." }), _jsx(Button, { onClick: onRetry, children: "Try again" }), _jsx(Button, { variant: "ghost", size: "sm", onClick: onReport, children: "Report an issue" })] })] }));

package/dist/src/auth/SignInAgain.d.ts

@@ -0,0 +1 @@
+export declare function SignInAgain(): import("react").JSX.Element;

package/dist/src/auth/SignInAgain.js

@@ -0,0 +1,6 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useAuthProvider } from "./provider";
+export function SignInAgain() {
+    const { Account } = useAuthProvider();
+    return (_jsx(Account, { children: ({ signOut }) => (_jsx("button", { type: "button", onClick: () => signOut(), className: "rounded-md border border-line px-2.5 py-1 text-sm font-medium text-fg outline-none hover:bg-surface-sunken focus-visible:ring-2 focus-visible:ring-ring", children: "Sign in again" })) }));
+}

package/dist/src/auth/account-menu-mode.d.ts

@@ -0,0 +1,13 @@
+export type AccountMenuMode = "betterAuth" | "cognito" | "none";
+export interface AccountMenuModeInput {
+    betterAuthEnabled: boolean;
+    cognitoConfigured: boolean;
+}
+export declare const accountMenuMode: ({ betterAuthEnabled, cognitoConfigured, }: AccountMenuModeInput) => AccountMenuMode;
+/**
+ * The sign-in footer caption names Cognito only when Cognito is the active
+ * provider. Every other mode falls through to the kit's provider-neutral
+ * default, so the caption can never claim an identity provider the build does
+ * not use.
+ */
+export declare const authFooterNote: (input: AccountMenuModeInput) => string | undefined;

package/dist/src/auth/account-menu-mode.js

@@ -0,0 +1,15 @@
+import { COGNITO_FOOTER_NOTE } from "@remit/ui";
+export const accountMenuMode = ({ betterAuthEnabled, cognitoConfigured, }) => {
+    if (betterAuthEnabled)
+        return "betterAuth";
+    if (cognitoConfigured)
+        return "cognito";
+    return "none";
+};
+/**
+ * The sign-in footer caption names Cognito only when Cognito is the active
+ * provider. Every other mode falls through to the kit's provider-neutral
+ * default, so the caption can never claim an identity provider the build does
+ * not use.
+ */
+export const authFooterNote = (input) => accountMenuMode(input) === "cognito" ? COGNITO_FOOTER_NOTE : undefined;

package/dist/src/auth/amplify-config.d.ts

@@ -0,0 +1,9 @@
+export interface CognitoEnv {
+    userPoolId: string;
+    userPoolClientId: string;
+    domain: string;
+    region: string;
+    appOrigin: string;
+}
+export declare const isCognitoConfigured: () => boolean;
+export declare const configureAmplify: () => void;

package/dist/src/auth/amplify-config.js

@@ -0,0 +1,43 @@
+import { Amplify } from "aws-amplify";
+import { getRuntimeConfig } from "../runtime-config";
+const readCognitoEnv = () => {
+    const config = getRuntimeConfig();
+    const { userPoolId, clientId, domain, region } = config.cognito;
+    if (!userPoolId || !clientId)
+        return null;
+    return {
+        userPoolId,
+        userPoolClientId: clientId,
+        domain,
+        region,
+        appOrigin: config.appOrigin,
+    };
+};
+export const isCognitoConfigured = () => readCognitoEnv() !== null;
+export const configureAmplify = () => {
+    const cognitoEnv = readCognitoEnv();
+    if (!cognitoEnv) {
+        console.warn("[auth] Cognito user pool is not configured. Running in local dev mode without Cognito auth.");
+        return;
+    }
+    const { userPoolId, userPoolClientId, domain, appOrigin } = cognitoEnv;
+    Amplify.configure({
+        Auth: {
+            Cognito: {
+                userPoolId,
+                userPoolClientId,
+                loginWith: domain
+                    ? {
+                        oauth: {
+                            domain,
+                            scopes: ["openid", "email", "profile"],
+                            redirectSignIn: appOrigin ? [appOrigin] : [],
+                            redirectSignOut: appOrigin ? [appOrigin] : [],
+                            responseType: "code",
+                        },
+                    }
+                    : undefined,
+            },
+        },
+    });
+};

package/dist/src/auth/auth-error.d.ts

@@ -0,0 +1,42 @@
+/**
+ * How an auth (better-auth) failure should surface.
+ *
+ *  - "network"    — the request never reached the server (offline / unreachable).
+ *                   Inline, correctable by the user: check the connection.
+ *  - "validation" — an expected, user-correctable rejection the server
+ *                   described (email already registered, weak password, wrong
+ *                   credentials). Inline, surfacing the server's own message.
+ *  - "rateLimited" — a 429. Nothing is wrong with the credentials or the
+ *                   deployment; the address has spent its budget and the same
+ *                   attempt works after a wait. Inline, and named as its own
+ *                   thing so it is never read as a rejection (#441).
+ *  - "fatal"      — a 404, or any other unexpected 4xx/5xx from our own API. The
+ *                   deployment or the client/server contract is broken and there
+ *                   is nothing the user can retry their way out of. Escalates to
+ *                   the full-screen fatal page with a bug-report link.
+ */
+export type AuthErrorClass = "network" | "validation" | "rateLimited" | "fatal";
+/** The request being attempted, for a fatal report that names method and path. */
+export interface AuthRequest {
+    method: string;
+    path: string;
+}
+/** The human message better-auth attaches to a known, expected rejection. */
+export declare const authServerMessage: (error: unknown) => string | undefined;
+/**
+ * Sort an auth failure into how it should surface. A 404 or any other
+ * unexpected 4xx/5xx from our own API is fatal — a broken deployment or
+ * contract, not something a retry fixes. Only a statusless connectivity failure
+ * or an expected, server-described rejection stays inline.
+ */
+export declare const classifyAuthError: (error: unknown) => AuthErrorClass;
+/** The inline banner text for a network, rate-limited or validation failure. */
+export declare const authInlineMessage: (error: unknown, kind: AuthErrorClass) => string;
+/** The message shown on the fatal page and prefilled into the bug report. */
+export declare const buildFatalAuthMessage: (error: unknown, request: AuthRequest) => string;
+/**
+ * Escalate an unexpected auth failure to the full-screen fatal page. The message
+ * names the method, path, and status; the overlay carries the bug-report link.
+ * Not recoverable — a broken route or contract does not resolve on retry.
+ */
+export declare const reportFatalAuthError: (error: unknown, request: AuthRequest) => void;

package/dist/src/auth/auth-error.js

@@ -0,0 +1,81 @@
+import { getErrorStatus, isAbortError } from "../lib/error-classifier";
+import { reportFatalError } from "../lib/fatal-error";
+/** better-auth's client sentinel for a fetch that never got an HTTP response. */
+const FETCH_ERROR_STATUS_TEXT = "Fetch Error";
+const TOO_MANY_REQUESTS = 429;
+const readString = (error, key) => {
+    if (error && typeof error === "object" && key in error) {
+        const value = error[key];
+        if (typeof value === "string" && value.trim().length > 0)
+            return value;
+    }
+    return undefined;
+};
+/** The human message better-auth attaches to a known, expected rejection. */
+export const authServerMessage = (error) => readString(error, "message");
+const isNetworkFailure = (error) => {
+    if (isAbortError(error))
+        return false;
+    if (readString(error, "statusText") === FETCH_ERROR_STATUS_TEXT)
+        return true;
+    return getErrorStatus(error) === undefined;
+};
+/**
+ * Sort an auth failure into how it should surface. A 404 or any other
+ * unexpected 4xx/5xx from our own API is fatal — a broken deployment or
+ * contract, not something a retry fixes. Only a statusless connectivity failure
+ * or an expected, server-described rejection stays inline.
+ */
+export const classifyAuthError = (error) => {
+    if (isNetworkFailure(error))
+        return "network";
+    const status = getErrorStatus(error);
+    if (status === undefined)
+        return "fatal";
+    if (status === TOO_MANY_REQUESTS)
+        return "rateLimited";
+    if (status === 404 || status >= 500)
+        return "fatal";
+    if (authServerMessage(error))
+        return "validation";
+    return "fatal";
+};
+const NETWORK_MESSAGE = "Can't reach the server. You may be offline — check your connection and try again.";
+// The server's own 429 body says only "Too many requests"; it cannot say what
+// the budget is shared with, and that is the part a single user needs to hear.
+const RATE_LIMITED_MESSAGE = "Too many requests from this address. Everyone behind the same address — other people on this network, and every tab you have open — shares one limit. Wait a minute and try again.";
+/** The inline banner text for a network, rate-limited or validation failure. */
+export const authInlineMessage = (error, kind) => {
+    if (kind === "network")
+        return NETWORK_MESSAGE;
+    if (kind === "rateLimited")
+        return RATE_LIMITED_MESSAGE;
+    return authServerMessage(error) ?? "Please check your details and try again.";
+};
+const statusSummary = (error) => {
+    const status = getErrorStatus(error);
+    if (status === undefined)
+        return "no response";
+    const statusText = readString(error, "statusText");
+    return statusText ? `${status} ${statusText}` : String(status);
+};
+/** The message shown on the fatal page and prefilled into the bug report. */
+export const buildFatalAuthMessage = (error, request) => {
+    const summary = statusSummary(error);
+    const guidance = getErrorStatus(error) === 404
+        ? "The endpoint did not respond as expected — check that the backend is running and up to date (see the deployment guide's troubleshooting section)."
+        : "The server returned an unexpected response.";
+    const server = authServerMessage(error);
+    const serverLine = server ? ` Server said: ${server}.` : "";
+    return `${request.method} ${request.path} failed: ${summary}. ${guidance}${serverLine}`;
+};
+/**
+ * Escalate an unexpected auth failure to the full-screen fatal page. The message
+ * names the method, path, and status; the overlay carries the bug-report link.
+ * Not recoverable — a broken route or contract does not resolve on retry.
+ */
+export const reportFatalAuthError = (error, request) => {
+    reportFatalError(new Error(buildFatalAuthMessage(error, request)), {
+        recoverable: false,
+    });
+};

package/dist/src/auth/auth-interceptor.d.ts

@@ -0,0 +1,12 @@
+import type { AuthProvider } from "./provider";
+/**
+ * Attach the composed provider's bearer token to every API request. Called once
+ * from `mountApp` with the app's chosen provider, so the token source is the
+ * same `AuthProvider` the shell and screens read — no separate seam.
+ *
+ * A provider that cannot produce a token throws, and that throw is left to
+ * propagate: the request is abandoned rather than sent without an Authorization
+ * header. Only the deployments that present no identity at all resolve to null,
+ * and for those an unauthenticated request is the intended one.
+ */
+export declare const installAuthInterceptor: (authProvider: AuthProvider) => void;

package/dist/src/auth/auth-interceptor.js

@@ -0,0 +1,24 @@
+import { client } from "@remit/api-http-client/client.gen.ts";
+let installed = false;
+/**
+ * Attach the composed provider's bearer token to every API request. Called once
+ * from `mountApp` with the app's chosen provider, so the token source is the
+ * same `AuthProvider` the shell and screens read — no separate seam.
+ *
+ * A provider that cannot produce a token throws, and that throw is left to
+ * propagate: the request is abandoned rather than sent without an Authorization
+ * header. Only the deployments that present no identity at all resolve to null,
+ * and for those an unauthenticated request is the intended one.
+ */
+export const installAuthInterceptor = (authProvider) => {
+    if (installed)
+        return;
+    client.interceptors.request.use(async (request) => {
+        const token = await authProvider.getToken();
+        if (token) {
+            request.headers.set("Authorization", `Bearer ${token}`);
+        }
+        return request;
+    });
+    installed = true;
+};

package/dist/src/auth/better-auth/BetterAuthAccount.d.ts

@@ -0,0 +1,7 @@
+import type { AuthAccountProps } from "../provider";
+/**
+ * better-auth identity for the account affordances. Reads the active session
+ * from its session hook; signing out also clears the cached bearer token so a
+ * stale token never rides a post-sign-out request.
+ */
+export declare const BetterAuthAccount: ({ children, fallback, }: AuthAccountProps) => import("react").JSX.Element;

package/dist/src/auth/better-auth/BetterAuthAccount.js

@@ -0,0 +1,18 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { authClient, resetBetterAuthTokenCache } from "../better-auth-config";
+/**
+ * better-auth identity for the account affordances. Reads the active session
+ * from its session hook; signing out also clears the cached bearer token so a
+ * stale token never rides a post-sign-out request.
+ */
+export const BetterAuthAccount = ({ children, fallback = null, }) => {
+    const { data: session } = authClient.useSession();
+    if (!session) {
+        return _jsx(_Fragment, { children: fallback });
+    }
+    const signOut = async () => {
+        await authClient.signOut();
+        resetBetterAuthTokenCache();
+    };
+    return _jsx(_Fragment, { children: children({ email: session.user.email ?? null, signOut }) });
+};

package/dist/src/auth/better-auth-config.d.ts

@@ -0,0 +1,43 @@
+/**
+ * better-auth owns identity in the Postgres-parity / local mode. It is gated
+ * behind an explicit flag so the Cognito path and the existing no-auth e2e
+ * bypass are untouched unless a deployment opts in.
+ */
+export declare const isBetterAuthEnabled: () => boolean;
+/**
+ * Error code better-auth returns from `/sign-up/email` when signup is closed
+ * server-side (`disableSignUp`, driven by `SELF_SIGN_UP_ENABLED`). The client
+ * uses it as the single source of truth for the closed state, so the UI can
+ * never drift from the server.
+ */
+export declare const SIGN_UP_DISABLED_CODE = "EMAIL_PASSWORD_SIGN_UP_DISABLED";
+export declare const isSignUpDisabledError: (error: unknown) => boolean;
+export declare const authClient: import("better-auth/react").ReactAuthClient<import("@better-auth/core").BetterAuthClientOptions>;
+/**
+ * A session exists but no bearer token could be produced for it. Distinct from
+ * "signed out": there is nothing to fall back to, so the request that needed the
+ * token must not be sent. Carries the mint's HTTP status where there was one, so
+ * the shared classifier reads it like any other API failure.
+ */
+export declare class AuthTokenError extends Error {
+    readonly status: number | undefined;
+    constructor(message: string, status?: number);
+}
+/**
+ * Return a valid RS256 JWT for the current session, minting a fresh one only
+ * when the cached token is missing or within the skew window of expiry. The API
+ * interceptor attaches it as a Bearer token; the backend verifies it against the
+ * JWKS.
+ *
+ * A throttled, faulted, or unreachable refresh never discards a token that is
+ * still usable: the request keeps the session it already holds and the endpoint
+ * is left alone until the backoff clears. A revocation (401/403) is the opposite
+ * — the session behind the held token is gone, so it is cleared and the failure
+ * propagates to re-authentication rather than serving a dead token until expiry.
+ * Only a mint with nothing usable to fall back to throws otherwise — returning
+ * null would put the request on the wire without an Authorization header, and the
+ * backend answers that with a 401 that names a missing token rather than the mint
+ * that failed.
+ */
+export declare const fetchBetterAuthToken: () => Promise<string>;
+export declare const resetBetterAuthTokenCache: () => void;