create-mithaq 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 drhomet
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/LICENSES/payload.txt

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2018-2026 Payload CMS, LLC <info@payloadcms.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/LICENSES/ponytail.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DietrichGebert
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/index.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// `bun create mithaq my-app`: lays a new project down from the template this
+// package carries, at the version of `@drhomet/mithaq` this package was
+// published with. Plain JavaScript on Node's standard library, so `bunx` and
+// `npx` run it with nothing to install first.
+import { spawnSync } from 'node:child_process'
+import { randomBytes } from 'node:crypto'
+import { cpSync, existsSync, readdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+import { createInterface } from 'node:readline/promises'
+import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
+
+const readJson = (file) => JSON.parse(readFileSync(file, 'utf8'))
+const writeJson = (file, value) => writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`)
+
+const generateSecret = () => randomBytes(32).toString('hex')
+
+/**
+ * Pins the template's manifests to what a published project installs. It edits
+ * `devDependencies` too, where the template keeps `mithaq-admin`. `mithaq`
+ * becomes the published package under the name every import uses, and
+ * `mithaq-admin`, which only the framework's own repository has, goes, since a
+ * project reads the registry through `@mithaq`; `asas` and `@asas/auth` stay
+ * `"*"`, the project's own workspaces. Any other `workspace:`, `link:` or
+ * `file:` spec is an error rather than a pin, because nothing published stands
+ * behind it.
+ */
+export function updatePackageJSONDependencies({ mithaq, packageJson }) {
+  for (const dependencies of [packageJson.dependencies, packageJson.devDependencies]) {
+    if (!dependencies) continue
+    if ('mithaq' in dependencies) dependencies.mithaq = mithaq
+    delete dependencies['mithaq-admin']
+    for (const [name, spec] of Object.entries(dependencies)) {
+      if (spec !== mithaq && /^(workspace|link|file):/.test(spec)) {
+        throw new Error(`The template's dependency ${name} is ${spec}, which only resolves inside the mithaq repository.`)
+      }
+    }
+  }
+}
+
+/**
+ * Writes the project `name` under `cwd` from `template`, and answers its
+ * folder. `version` is the `@drhomet/mithaq` the project installs and whose
+ * registry it reads, pinned exactly so the two cannot drift apart and an
+ * upgrade is a change the project makes; `mithaq` replaces the dependency
+ * itself, which only the release check does.
+ */
+export function create({ name, cwd, template, version, mithaq = `npm:@drhomet/mithaq@${version}` }) {
+  // A package name npm accepts, so it is also one folder, inside `cwd`.
+  if (!/^[a-z0-9][a-z0-9._-]*$/.test(name) || name.length > 214) {
+    throw new Error(`"${name}" is not a valid project name: use lowercase letters, digits, "-", "." and "_", starting with a letter or digit.`)
+  }
+  const project = join(cwd, name)
+  if (existsSync(project) && readdirSync(project).length > 0) {
+    throw new Error(`${project} already exists and is not empty. Pick another name.`)
+  }
+  cpSync(template, project, { recursive: true })
+  const files = readdirSync(project, { recursive: true })
+  // npm drops every `.gitignore` from a published package, so the stage keeps
+  // each as `gitignore`.
+  for (const file of files.filter((file) => basename(file) === 'gitignore')) {
+    renameSync(join(project, file), join(project, dirname(file), '.gitignore'))
+  }
+  for (const file of files.filter((file) => basename(file) === 'package.json')) {
+    const packageJson = readJson(join(project, file))
+    updatePackageJSONDependencies({ mithaq, packageJson })
+    writeJson(join(project, file), file === 'package.json' ? { name, ...packageJson } : packageJson)
+  }
+  // shadcn reads `@mithaq/<item>` from this URL with `{name}` replaced, at the
+  // version installed.
+  for (const file of files.filter((file) => basename(file) === 'components.json')) {
+    const components = readJson(join(project, file))
+    writeJson(join(project, file), { ...components, registries: { ...components.registries, '@mithaq': `https://cdn.jsdelivr.net/npm/@drhomet/mithaq@${version}/r/{name}.json` } })
+  }
+  // One `.env` for the template's commands and one for each app's dev server,
+  // the same secrets in each: the tenant app and the platform console sign
+  // and read each other's sessions under one `BETTER_AUTH_SECRET`.
+  const env = readFileSync(join(project, 'templates/asas/.env.example'), 'utf8').replace(/^([A-Z_]*SECRET)=$/gm, (_, key) => `${key}=${generateSecret()}`)
+  for (const folder of ['templates/asas', 'apps/asas-tanstack', 'apps/asas-platform']) writeFileSync(join(project, folder, '.env'), env, { mode: 0o600 })
+  // The screens find their files by globs under `node_modules/asas/`, which
+  // only Bun's isolated installer lays out.
+  writeFileSync(join(project, 'bunfig.toml'), '[install]\nlinker = "isolated"\n')
+  writeFileSync(join(project, '.gitignore'), ['node_modules', '.env', 'dist', '.storage/', ''].join('\n'))
+  writeJson(join(project, 'tsconfig.json'), {
+    compilerOptions: { target: 'es2024', module: 'nodenext', moduleResolution: 'nodenext', strict: true, noUncheckedIndexedAccess: true, noEmit: true, skipLibCheck: true, erasableSyntaxOnly: true, allowImportingTsExtensions: true, types: ['node'] },
+    include: ['templates/*/src/**/*.ts', 'apps/*/src/**/*.ts'],
+  })
+  return project
+}
+
+const main = async () => {
+  const { values, positionals } = parseArgs({ allowPositionals: true, options: { mithaq: { type: 'string' } } })
+  let [name] = positionals
+  if (!name) {
+    const prompt = createInterface({ input: process.stdin, output: process.stdout })
+    name = (await prompt.question('Project name: ')).trim()
+    prompt.close()
+  }
+  const { version } = readJson(new URL('package.json', import.meta.url))
+  const project = create({ name, cwd: process.cwd(), template: fileURLToPath(new URL('template/', import.meta.url)), version, mithaq: values.mithaq })
+  console.log(`Created ${project}.`)
+  // `bunx` and `bun create` name Bun here (`bun/1.3.14 npm/? node/…`).
+  const installed = process.env.npm_config_user_agent?.startsWith('bun/') && spawnSync('bun', ['install'], { cwd: project, stdio: 'inherit' }).status === 0
+  if (!installed) {
+    console.warn(`\nNot installed. Install with Bun: the project is a Bun workspace whose screens need Bun's isolated installer (bunfig.toml), and npm, pnpm and yarn lay node_modules out where they find nothing.`)
+  }
+  console.log(`
+Next, with PostgreSQL 15 or later serving the database DATABASE_URL names in templates/asas/.env:
+
+  cd ${name}${installed ? '' : '\n  bun install'}
+  cd templates/asas
+  # push the schema once, development only
+  bun -e "const { asas } = await import('./src/asas.ts'); await asas.connect(); await asas.destroy()"
+  cd ../..
+  bun run --cwd apps/asas-tanstack dev   # the tenant app, http://localhost:5173
+  bun run --cwd apps/asas-platform dev   # in a second terminal: the platform console, http://localhost:5174
+
+Sign up admin@admin.com with the organization "Admin org", then run bun run seed in templates/asas.`)
+}
+
+if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  await main().catch((error) => {
+    console.error(error.message)
+    process.exitCode = 1
+  })
+}

package/package.json

@@ -1,6 +1,21 @@
 {
   "name": "create-mithaq",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "create-mithaq": "index.js"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/drhomet/mithaq.git",
+    "directory": "packages/create-mithaq"
+  },
+  "homepage": "https://github.com/drhomet/mithaq#readme",
+  "bugs": {
+    "url": "https://github.com/drhomet/mithaq/issues"
+  }
+}

package/template/apps/asas-platform/components.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "base-sera",
+  "rsc": false,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "src/styles.css",
+    "baseColor": "mauve",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "iconLibrary": "lucide",
+  "rtl": true,
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  },
+  "menuColor": "default",
+  "menuAccent": "subtle",
+  "registries": {}
+}

package/template/apps/asas-platform/gitignore

@@ -0,0 +1,3 @@
+.tanstack
+dist
+node_modules

package/template/apps/asas-platform/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "asas-platform",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "(cd ../../templates/asas && mithaq lock --check) && vite build",
+    "dev": "(cd ../../templates/asas && mithaq lock --check) && vite dev --port 5174",
+    "preview": "(cd ../../templates/asas && mithaq lock --check) && vite preview --port 4174"
+  },
+  "dependencies": {
+    "@base-ui/react": "^1.5.0",
+    "@fontsource-variable/figtree": "^5.3.0",
+    "@fontsource-variable/noto-sans": "^5.3.0",
+    "@fontsource/ibm-plex-sans-arabic": "^5.2.8",
+    "@hugeicons/core-free-icons": "^4.1.4",
+    "@hugeicons/react": "^1.1.6",
+    "@lexical/extension": "0.52.0",
+    "@lexical/link": "0.52.0",
+    "@lexical/list": "0.52.0",
+    "@lexical/react": "0.52.0",
+    "@lexical/rich-text": "0.52.0",
+    "@lexical/selection": "0.52.0",
+    "@lexical/utils": "0.52.0",
+    "@tanstack/react-form": "^1.33.5",
+    "@tanstack/react-query": "^5.104.0",
+    "@tanstack/react-router": "^1.170.29",
+    "@tanstack/react-start": "^1.168.56",
+    "asas": "*",
+    "class-variance-authority": "^0.7.1",
+    "cn": "^0.2.6",
+    "date-fns": "^4.4.0",
+    "input-otp": "^1.5.0",
+    "lexical": "0.52.0",
+    "lucide-react": "^1.16.0",
+    "mithaq": "*",
+    "react": "^19.3.0",
+    "react-day-picker": "^10.0.1",
+    "react-dom": "^19.3.0",
+    "react-resizable-panels": "^4.14.1",
+    "recharts": "3.8.0",
+    "tw-animate-css": "^1.4.0"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.3.0",
+    "@tanstack/start-client-core": "^1.170.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.0.2",
+    "mithaq-admin": "*",
+    "shadcn": "4.18.0",
+    "tailwindcss": "^4.3.0",
+    "vite": "^8.0.13"
+  }
+}

package/template/apps/asas-platform/public/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" fill="#5b21b6"/><path d="M16 5l9 4v6c0 6-4 10-9 12-5-2-9-6-9-12V9z" fill="none" stroke="#f5f3ff" stroke-width="2.5" stroke-linejoin="round"/><path d="M12 16l3 3 5-6" fill="none" stroke="#f5f3ff" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/></svg>

package/template/apps/asas-platform/src/api.ts

@@ -0,0 +1,147 @@
+import { afterCommitHeader, type ClientKayan, type FetchClient } from 'mithaq/admin'
+
+/** What a write may ask beside its input on a kayan that keeps drafts: a draft save, and an autosave. The fetch plug reads them off the query string only. */
+export type DraftOptions = { readonly draft?: boolean; readonly autosave?: boolean }
+
+const queryOf = ({ draft, autosave }: DraftOptions = {}) => (draft ? `?draft=true${autosave ? '&autosave=true' : ''}` : '')
+
+const call = async ({ kayan, operation, input, ...options }: { kayan: string; operation: string; input: Record<string, unknown> } & DraftOptions) => {
+  const response = await fetch(`/api/${encodeURIComponent(kayan)}/${encodeURIComponent(operation)}${queryOf(options)}`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(input),
+  })
+  const answer = await response.json().catch(() => null)
+  if (!response.ok) {
+    const error = new Error(typeof answer?.message === 'string' ? answer.message : `HTTP ${response.status}`)
+    Object.assign(error, { status: response.status, code: answer?.code, data: answer?.data })
+    throw error
+  }
+  // A failed `afterCommit` raises the screens' banner and a committed write
+  // clears it. Only the server knows an operation's effect, so the plug sets
+  // the header on writes and never on reads.
+  const said = response.headers.get(afterCommitHeader)
+  if (typeof window !== 'undefined' && said) {
+    window.dispatchEvent(new CustomEvent('mithaq:after-commit', { detail: said === 'failed' }))
+  }
+  return answer
+}
+
+// Restated, not imported from the `.tsx` file that declares them: a `.ts` file
+// must not need the JSX compiler.
+type FoundPage = { docs: readonly Record<string, unknown>[]; hasNextPage: boolean; nextPage: number | null }
+type FindApi = Readonly<
+  Record<
+    string,
+    | {
+        find: (input: Record<string, unknown>) => Promise<FoundPage>
+        create?: (input: Record<string, unknown>) => Promise<unknown>
+        delete?: (input: Record<string, unknown>) => Promise<unknown>
+        update?: (input: Record<string, unknown>) => Promise<unknown>
+      }
+    | undefined
+  >
+>
+
+/**
+ * Every operation of every kayan, keyed by name strings. `arm[kayan][operation](input)`
+ * posts to `POST /api/<kayan>/<operation>`; the proxy never answers `undefined`,
+ * and a name no kayan has is the server's not-found.
+ */
+export type Arm = Readonly<Record<string, Readonly<Record<string, (input: Record<string, unknown>, options?: DraftOptions) => Promise<unknown>>>>>
+export const arm = new Proxy(Object.create(null) as Arm, {
+  get: (_target, kayan: string) => new Proxy(Object.create(null) as Record<string, (input: Record<string, unknown>, options?: DraftOptions) => Promise<unknown>>, {
+    get: (_operations, operation: string) => (input: Record<string, unknown>, options?: DraftOptions) => call({ kayan, operation, input, ...options }),
+  }),
+})
+
+/**
+ * Whether an operation's input names a key: probes the schema with a value no
+ * browser-written schema accepts and looks for an issue at that key. A schema
+ * that answers asynchronously, or throws, reads as naming nothing.
+ */
+export const takesKey = (input: { '~standard': { validate: (value: unknown) => unknown } }, key: string) => {
+  let answer: { issues?: readonly { path?: readonly unknown[] }[] }
+  try {
+    answer = input['~standard'].validate({ [key]: Symbol(key) }) as typeof answer
+  } catch {
+    return false
+  }
+  if (answer instanceof Promise) {
+    answer.catch(() => {})
+    return false
+  }
+  return answer.issues?.some(({ path }) => {
+    const segment = path?.[0]
+    return String(typeof segment === 'object' && segment ? (segment as { key: unknown }).key : segment) === key
+  }) ?? false
+}
+
+/** What a screen's `client` is over an arm; the draft words ride along with the input. */
+export const clientOf = (through: Arm): FetchClient => ({ kayan, operation, input, draft, autosave }) => through[kayan]![operation]!(input, { draft, autosave })
+
+/**
+ * What the server's `client` is: each operation in process, as `actor`. Only the
+ * two draft words are read off the caller's options and the actor goes last, so
+ * a loader cannot run as someone else.
+ */
+export const actingAs = (
+  through: Readonly<Record<string, { operations: Record<string, (input: object, options: { actor?: unknown } & DraftOptions) => Promise<unknown>> }>>,
+  actor: unknown,
+): FetchClient => ({ kayan, operation, input, draft, autosave }) => through[kayan]!.operations[operation]!(input, { draft, autosave, actor })
+
+/**
+ * What a relationship control and cell read a second kayan through. Only the
+ * kayans the screen's loader already narrowed to what this actor may read are
+ * in the record, so a picker cannot page any other.
+ */
+export const readsOf = (kayans: readonly ClientKayan[]): FindApi =>
+  Object.fromEntries(
+    kayans.map((kayan) => [
+      kayan.name,
+      {
+        find: (input: Record<string, unknown>) => arm[kayan.name]!.find!(input) as Promise<FoundPage>,
+      },
+    ]),
+  )
+
+type FieldReads = {
+  readonly collections?: Readonly<
+    Record<string, { readonly fields?: Readonly<Record<string, Readonly<Record<string, boolean>> | undefined>> } | undefined>
+  >
+}
+
+/**
+ * One kayan of the projection with every field this actor may not read taken
+ * off it. A loader's result is serialized into the document, so an unreadable
+ * field's name, label or rule would otherwise reach the viewer.
+ */
+export const readable = (one: ClientKayan, report: FieldReads): ClientKayan => ({
+  ...one,
+  fields: one.fields.filter((field) => report.collections?.[one.name]?.fields?.[field.name]?.read === true),
+})
+
+/**
+ * Whether a thrown refusal is the caller's. Those carry an HTTP status; a store
+ * that is down or a hook bug carries none and must be rethrown, not reported
+ * as a missing row.
+ */
+export const caused = (thrown: unknown): boolean =>
+  typeof (thrown as { status?: unknown } | null | undefined)?.status === 'number'
+
+/**
+ * One POST at the auth arm (Better Auth's router under `/api/auth/user`) with the session cookie.
+ * Returns the answer instead of throwing: a refusal is a sentence for the viewer; no reply is status 0.
+ */
+export const authArm = async (path: string, body: unknown = {}) => {
+  const response = await fetch(`/api/auth/user/${path}`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  }).catch(() => null)
+  if (!response) return { ok: false, status: 0, message: undefined, body: null }
+  const answered = (await response.json().catch(() => null)) as ({ message?: string } & Record<string, unknown>) | null
+  // The status too, because a rate limit's refusal carries no code to read.
+  return { ok: response.ok, status: response.status, message: answered?.message, body: answered }
+}
+// mithaq-admin b06d8d335d306c07556f8f2b81fba20ba7ded198 94db2fc49ad4391c0d1c2183cb41001dd08d62017c76af86cc5f611488c22c68

package/template/apps/asas-platform/src/auth-frame.tsx

@@ -0,0 +1,150 @@
+import { useState, type ComponentProps, type ReactNode } from 'react'
+import { redirect, useRouteContext } from '@tanstack/react-router'
+import { createServerFn } from '@tanstack/react-start'
+import { Eye, EyeOff } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
+import { Input } from '@/components/ui/input'
+import { InputGroup, InputGroupAddon, InputGroupButton, InputGroupInput } from '@/components/ui/input-group'
+import { authArm } from './api.ts'
+import { FieldShell, describedBy } from './components/mithaq/field-shell.tsx'
+import { refusalKey } from './copy.ts'
+import { LocaleSwitch } from './locale-switch.tsx'
+import { wanted } from './redirect.ts'
+import { useCopy } from './routes/__root.tsx'
+
+/** The one search key the auth pages read, off the raw search. */
+export const redirectSearch = (search: Record<string, unknown>): { redirect?: string } =>
+  typeof search.redirect === 'string' ? { redirect: search.redirect } : {}
+
+/** Whether a read of the actor names someone. A read that throws, or an actor with no email, names no one. */
+export const signedInAs = async (actor: Promise<unknown>) => Boolean(((await actor.catch(() => null)) as { email?: unknown } | null)?.email)
+
+/**
+ * Whether this request carries a session, where signing in lands for it, and the provider's password bounds.
+ * No auth page sends a referrer, since the reset page's address carries its token.
+ */
+export const authGate = createServerFn({ method: 'GET' }).handler(async () => {
+  // Imported inside the server half so no auth page ships the screen host to the browser.
+  const [{ getRequest, setResponseHeader }, { asas }, { loadEnterable }] = await Promise.all([import('@tanstack/react-start/server'), import('asas'), import('./screens.tsx')])
+  setResponseHeader('referrer-policy', 'no-referrer')
+  type Provider = { name: string; server: { $context: Promise<{ password: { config: { minPasswordLength: number; maxPasswordLength: number } } }> } }
+  const provider = (asas.auth.strategies as unknown as Provider[]).find((one) => one.name === 'user')!
+  const [signedIn, { password }] = await Promise.all([signedInAs(asas.auth.actor(getRequest().headers)), provider.server.$context])
+  const first = signedIn ? (await loadEnterable())?.screens[0] : undefined
+  const home: { path: string; name?: string } = first ?? { path: '/unauthorized' }
+  return { signedIn, home, password: { min: password.config.minPasswordLength, max: password.config.maxPasswordLength } }
+})
+
+/**
+ * Sign-in's and sign-up's `beforeLoad`. A signed-in person is sent where a
+ * successful sign-in sends them; everyone else gets the password bounds in the
+ * route context.
+ */
+export const gate = async ({ search }: { search: { redirect?: string } }) => {
+  const { signedIn, home, password } = await authGate()
+  if (signedIn) throw redirect({ href: wanted({ asked: search.redirect, home: home.path }) })
+  return { password }
+}
+
+/** What a link to `home` says: the screen it opens, or, where it opens none, the action of seeing the account's status. */
+export const useHomeLabel = () => {
+  const { t } = useCopy()
+  return (home: { name?: string }, sentence: 'auth.backTo' | 'marketing.openScreen') =>
+    home.name === undefined
+      ? t('auth.accountStatus', 'See your account status')
+      : t(sentence, sentence === 'auth.backTo' ? 'Back to {screen}' : 'Open {screen}')!.replace('{screen}', () => t(`screens.${home.name}`, home.name)!)
+}
+
+/** What the forgot and reset pages draw for someone already signed in: the way on, and a sign-out. */
+export function AlreadySignedIn({ redirect: asked, home }: { redirect?: string; home: { path: string; name?: string } }) {
+  const { t } = useCopy()
+  const label = useHomeLabel()
+  const to = wanted({ asked, home: home.path })
+  return (
+    <AuthFrame title={t('auth.alreadySignedIn', 'You are already signed in')}>
+      <div className="grid gap-4">
+        {/* An anchor: the path is the visitor's own, not a route the router knows. */}
+        <a className="text-primary text-center text-sm underline underline-offset-4" href={to}>
+          {to === home.path ? label(home, 'auth.backTo') : t('auth.continue', 'Continue')}
+        </a>
+        <Button type="button" variant="outline" onClick={() => void authArm('sign-out').then(() => window.location.reload())}>
+          {t('admin.signOut', 'Sign out')}
+        </Button>
+      </div>
+    </AuthFrame>
+  )
+}
+
+/** The sentence for a refusal of the provider: this app's own words for the status or code, then `fallback`. Never the provider's `message`, which is English in any locale. */
+export const useRefusal = () => {
+  const { t } = useCopy()
+  return (answered: { status: number; body: Record<string, unknown> | null }, fallback: string | undefined) => {
+    const key = refusalKey(answered.status, answered.body?.code)
+    return (key && t(key)) || fallback || ''
+  }
+}
+
+/** Whether the browser's own `type="email"` refuses this text. */
+export const notAnEmail = (value: string) => Object.assign(document.createElement('input'), { type: 'email', value }).validity.typeMismatch
+
+/** The frame every auth page is drawn in: the app's name linking home, the language switch, and the page's card. */
+export function AuthFrame({ title, description, children }: { title: string | undefined; description?: ReactNode; children: ReactNode }) {
+  const { t, locale } = useCopy()
+  const { app } = useRouteContext({ from: '__root__' })
+  return (
+    <div className="flex min-h-screen flex-col">
+      <header className="mx-auto flex h-16 w-full max-w-6xl items-center justify-between gap-2 px-4 sm:px-6">
+        {/* An anchor: `/` is not a router route in an app whose start entry answers its home. */}
+        <a className="text-lg font-semibold" href="/">
+          {t(app, 'Asas')}
+        </a>
+        <LocaleSwitch locale={locale} />
+      </header>
+      <main className="flex flex-1 items-center justify-center px-4 pb-16">
+        <Card className="w-full max-w-sm">
+          <CardHeader>
+            <CardTitle><h1>{title}</h1></CardTitle>
+            {description ? <CardDescription>{description}</CardDescription> : null}
+          </CardHeader>
+          {/* Descriptions follow the text direction; the shared primitive aligns them left. */}
+          <CardContent className="[&_[data-slot=field-description]]:text-start">{children}</CardContent>
+        </Card>
+      </main>
+    </div>
+  )
+}
+
+function PasswordInput(props: ComponentProps<'input'>) {
+  const { t } = useCopy()
+  const [shown, setShown] = useState(false)
+  return (
+    // Focus moving to the box's own toggle has not left the box.
+    <InputGroup onBlur={(event) => event.currentTarget.contains(event.relatedTarget) && event.stopPropagation()}>
+      <InputGroupInput {...props} dir="ltr" type={shown ? 'text' : 'password'} />
+      <InputGroupAddon align="inline-end">
+        <InputGroupButton aria-label={t('auth.showPassword', 'Show password')} aria-pressed={shown} size="icon-xs" onClick={() => setShown((was) => !was)}>
+          {shown ? <EyeOff /> : <Eye />}
+        </InputGroupButton>
+      </InputGroupAddon>
+    </InputGroup>
+  )
+}
+
+/** One labelled box, which says what is wrong with it once it has been left. An email or password reads left to right in any locale. */
+export function AuthBox({
+  id,
+  label,
+  error,
+  description,
+  onLeave,
+  ...props
+}: { id: string; label: string | undefined; error?: string; description?: string; onLeave: () => void } & ComponentProps<'input'>) {
+  const control = { 'aria-describedby': describedBy({ id, description, error }), 'aria-invalid': error ? true : undefined, id, name: id, required: true, ...props }
+  return (
+    <FieldShell id={id} label={label ?? id} description={description} error={error} onBlur={onLeave}>
+      {props.type === 'password' ? <PasswordInput {...control} /> : <Input dir={props.type === 'email' ? 'ltr' : 'auto'} {...control} />}
+    </FieldShell>
+  )
+}
+// mithaq-admin b06d8d335d306c07556f8f2b81fba20ba7ded198 ab822afe361dfc5f82c504570fd5d0ea13ec4572e60adb679a3f9532ccf67803