hazo_auth 5.1.40 → 5.2.0

package/dist/lib/auth/ensure_anon_id.server.d.ts

@@ -0,0 +1,21 @@
+import "server-only";
+import { NextRequest } from "next/server";
+/**
+ * Returns a stable opaque anonymous visitor ID for the caller, reading an
+ * existing httpOnly cookie or issuing a fresh UUID v4 if absent.
+ *
+ * - Cookie name: `hazo_auth_anon_id` (prefixed via `[hazo_auth__cookies] cookie_prefix`)
+ * - Cookie attributes: httpOnly, sameSite=lax, path=/, secure in production,
+ *   maxAge = 2 years.
+ * - Idempotent per-request: calling twice with the same NextRequest returns
+ *   the same id and only queues one Set-Cookie.
+ *
+ * Independent from authenticated identity: an authenticated user can still
+ * have an anon id cookie. Whether to consult it for a logged-in caller is up
+ * to the caller (hazo_feedback, for example, doesn't bother).
+ *
+ * @param request - The incoming NextRequest.
+ * @returns The existing or freshly-issued anonymous visitor id (UUID v4 string).
+ */
+export declare function ensure_anon_id(request: NextRequest): Promise<string>;
+//# sourceMappingURL=ensure_anon_id.server.d.ts.map

package/dist/lib/auth/ensure_anon_id.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure_anon_id.server.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/ensure_anon_id.server.ts"],"names":[],"mappings":"AAqBA,OAAO,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgB1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B1E"}

package/dist/lib/auth/ensure_anon_id.server.js

@@ -0,0 +1,73 @@
+// file_description: server-only helper to issue/read a stable opaque anonymous visitor ID via httpOnly cookie
+//
+// Used by hazo_feedback (and any future caller) to group submissions from the
+// same anonymous visitor across page loads / weeks without requiring login.
+//
+// Signature choice (v5.2.0): async, request-only — Option A in the design doc.
+// - Reads the existing cookie from the incoming `request.cookies`.
+// - Writes a freshly-issued cookie via the async `cookies()` API from
+//   `next/headers`, which is the supported write surface in Server Components,
+//   Server Actions, and Route Handlers in Next.js 15+.
+// - Tradeoff: NOT valid in Edge middleware (where `next/headers` throws). If a
+//   middleware caller ever needs this, add a sibling `ensure_anon_id_edge`
+//   that takes (request, response) and writes via `response.cookies.set`.
+//
+// Idempotent per-request: a per-request WeakMap remembers which id was issued
+// for a given NextRequest instance, so calling `ensure_anon_id(request)` twice
+// in the same request returns the same id and queues only one Set-Cookie. This
+// matters because `request.cookies` reflects the *incoming* state and won't
+// see an id that the same request just issued.
+// section: server-only-guard
+import "server-only";
+import { cookies } from "next/headers";
+import { BASE_COOKIE_NAMES, get_cookie_name, get_cookie_options, } from "../cookies_config.server.js";
+// section: constants
+const TWO_YEARS_SECONDS = 60 * 60 * 24 * 365 * 2;
+// section: state
+// WeakMap keyed by NextRequest so entries are GC'd with the request.
+const issued_per_request = new WeakMap();
+// section: main_function
+/**
+ * Returns a stable opaque anonymous visitor ID for the caller, reading an
+ * existing httpOnly cookie or issuing a fresh UUID v4 if absent.
+ *
+ * - Cookie name: `hazo_auth_anon_id` (prefixed via `[hazo_auth__cookies] cookie_prefix`)
+ * - Cookie attributes: httpOnly, sameSite=lax, path=/, secure in production,
+ *   maxAge = 2 years.
+ * - Idempotent per-request: calling twice with the same NextRequest returns
+ *   the same id and only queues one Set-Cookie.
+ *
+ * Independent from authenticated identity: an authenticated user can still
+ * have an anon id cookie. Whether to consult it for a logged-in caller is up
+ * to the caller (hazo_feedback, for example, doesn't bother).
+ *
+ * @param request - The incoming NextRequest.
+ * @returns The existing or freshly-issued anonymous visitor id (UUID v4 string).
+ */
+export async function ensure_anon_id(request) {
+    var _a;
+    const cookie_name = get_cookie_name(BASE_COOKIE_NAMES.ANON_ID);
+    // Per-request idempotency: if we already issued for this NextRequest, reuse it.
+    const already_issued = issued_per_request.get(request);
+    if (already_issued) {
+        return already_issued;
+    }
+    // Read the existing cookie from the incoming request.
+    const existing = (_a = request.cookies.get(cookie_name)) === null || _a === void 0 ? void 0 : _a.value;
+    if (existing) {
+        return existing;
+    }
+    // Issue a new id and queue the Set-Cookie via the next/headers cookie store.
+    const new_id = crypto.randomUUID();
+    const cookie_options = get_cookie_options({
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        path: "/",
+        maxAge: TWO_YEARS_SECONDS,
+    });
+    const cookie_store = await cookies();
+    cookie_store.set(cookie_name, new_id, cookie_options);
+    issued_per_request.set(request, new_id);
+    return new_id;
+}

package/dist/lib/auth/index.d.ts

@@ -2,6 +2,7 @@ export * from "./auth_types.js";
 export { hazo_get_auth } from "./hazo_get_auth.server.js";
 export { get_authenticated_user, require_auth, is_authenticated, } from "./auth_utils.server.js";
 export type { AuthResult, AuthUser } from "./auth_utils.server";
+export { ensure_anon_id } from "./ensure_anon_id.server.js";
 export { hazo_get_tenant_auth, require_tenant_auth, extract_scope_id_from_request, } from "./hazo_get_tenant_auth.server.js";
 export type { ScopeDetails, TenantOrganization, TenantAuthOptions, TenantAuthResult, RequiredTenantAuthResult, } from "./auth_types";
 export { HazoAuthError, AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedError, } from "./auth_types.js";

package/dist/lib/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAC;AAG7B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGhE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,uBAAuB,EACvB,8BAA8B,EAC9B,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAC;AAG7B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGhE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,uBAAuB,EACvB,8BAA8B,EAC9B,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/lib/auth/index.js

@@ -4,6 +4,8 @@ export * from "./auth_types.js";
 // section: server_exports
 export { hazo_get_auth } from "./hazo_get_auth.server.js";
 export { get_authenticated_user, require_auth, is_authenticated, } from "./auth_utils.server.js";
+// section: anon_id_exports (v5.2)
+export { ensure_anon_id } from "./ensure_anon_id.server.js";
 // section: tenant_auth_exports
 export { hazo_get_tenant_auth, require_tenant_auth, extract_scope_id_from_request, } from "./hazo_get_tenant_auth.server.js";
 export { HazoAuthError, AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedError, } from "./auth_types.js";

package/dist/lib/cookies_config.edge.d.ts

@@ -3,6 +3,7 @@ export declare const BASE_COOKIE_NAMES: {
     readonly USER_EMAIL: "hazo_auth_user_email";
     readonly SESSION: "hazo_auth_session";
     readonly DEV_LOCK: "hazo_auth_dev_lock";
+    readonly ANON_ID: "hazo_auth_anon_id";
 };
 /**
  * Gets the cookie prefix from environment variable

package/dist/lib/cookies_config.edge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies_config.edge.d.ts","sourceRoot":"","sources":["../../src/lib/cookies_config.edge.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAGX;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAc/C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAQ9G"}
+{"version":3,"file":"cookies_config.edge.d.ts","sourceRoot":"","sources":["../../src/lib/cookies_config.edge.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAGX;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAc/C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAQ9G"}

package/dist/lib/cookies_config.edge.js

@@ -7,6 +7,7 @@ export const BASE_COOKIE_NAMES = {
     USER_EMAIL: "hazo_auth_user_email",
     SESSION: "hazo_auth_session",
     DEV_LOCK: "hazo_auth_dev_lock",
+    ANON_ID: "hazo_auth_anon_id", // v5.2: Stable opaque per-visitor ID for anonymous flows (e.g. hazo_feedback). Kept in sync with the server constant.
 };
 // section: main_functions
 /**

package/dist/lib/cookies_config.server.d.ts

@@ -11,6 +11,7 @@ export declare const BASE_COOKIE_NAMES: {
     readonly SESSION: "hazo_auth_session";
     readonly DEV_LOCK: "hazo_auth_dev_lock";
     readonly SCOPE_ID: "hazo_auth_scope_id";
+    readonly ANON_ID: "hazo_auth_anon_id";
 };
 /**
  * Reads cookie configuration from hazo_auth_config.ini file

package/dist/lib/cookies_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/cookies_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAMrB,MAAM,MAAM,aAAa,GAAG;IAC1B,6FAA6F;IAC7F,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAYF,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAGX;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,CAoBlD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAQzG;AAKD;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,aAAa,CAKzD;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}
+{"version":3,"file":"cookies_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/cookies_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAMrB,MAAM,MAAM,aAAa,GAAG;IAC1B,6FAA6F;IAC7F,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAYF,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAC;AAGX;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,CAoBlD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAQzG;AAKD;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,aAAa,CAKzD;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}

package/dist/lib/cookies_config.server.js

@@ -16,6 +16,7 @@ export const BASE_COOKIE_NAMES = {
     SESSION: "hazo_auth_session",
     DEV_LOCK: "hazo_auth_dev_lock",
     SCOPE_ID: "hazo_auth_scope_id", // v5.2: Tenant context cookie for multi-tenancy
+    ANON_ID: "hazo_auth_anon_id", // v5.2: Stable opaque per-visitor ID for anonymous flows (e.g. hazo_feedback)
 };
 // section: main_function
 /**

package/dist/lib/hazo_connect_setup.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hazo_connect_setup.server.d.ts","sourceRoot":"","sources":["../../src/lib/hazo_connect_setup.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AA8JrB;;;;GAIG;AACH,wBAAgB,iCAAiC,8CAuBhD;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,IAAI;IACjD,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAsBA"}
+{"version":3,"file":"hazo_connect_setup.server.d.ts","sourceRoot":"","sources":["../../src/lib/hazo_connect_setup.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAsJrB;;;;GAIG;AACH,wBAAgB,iCAAiC,8CAuBhD;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,IAAI;IACjD,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAsBA"}

package/dist/lib/hazo_connect_setup.server.js

@@ -78,14 +78,6 @@ function get_hazo_connect_config() {
                 }
             }
         }
-        // Log the resolved path so consumers can see which DB file is being used
-        logger.info("hazo_connect_sqlite_path_resolved", {
-            filename: "hazo_connect_setup.server.ts",
-            line_number: 0,
-            sqlite_path,
-            process_cwd: process.cwd(),
-            config_source: hazo_connect_section ? "hazo_auth_config.ini" : "environment variables",
-        });
         return {
             type: "sqlite",
             sqlitePath: sqlite_path,

package/dist/lib/services/session_token_service.js

@@ -59,7 +59,7 @@ export async function create_session_token(user_id, email, managed_by_user_id) {
             .setIssuedAt(now)
             .setExpirationTime(exp)
             .sign(secret);
-        logger.info("session_token_created", {
+        logger.debug("session_token_created", {
             filename: get_filename(),
             line_number: get_line_number(),
             user_id,
@@ -107,7 +107,7 @@ export async function validate_session_token(token) {
             });
             return { valid: false };
         }
-        logger.info("session_token_validated", {
+        logger.debug("session_token_validated", {
             filename: get_filename(),
             line_number: get_line_number(),
             user_id,

package/dist/lib/ui_shell_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui_shell_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/ui_shell_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAIrB,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG9E,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,YAAY,CAAC;AAE9D,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,CAAC;IACjC,wBAAwB,EAAE,MAAM,CAAC;IACjC,uBAAuB,EAAE,OAAO,CAAC;IACjC,2BAA2B,EAAE,OAAO,CAAC;IACrC,+CAA+C;IAC/C,MAAM,EAAE,YAAY,CAAC;IACrB,mDAAmD;IACnD,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,CAyDnD"}
+{"version":3,"file":"ui_shell_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/ui_shell_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAIrB,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG9E,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,YAAY,CAAC;AAE9D,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,CAAC;IACjC,wBAAwB,EAAE,MAAM,CAAC;IACjC,uBAAuB,EAAE,OAAO,CAAC;IACjC,2BAA2B,EAAE,OAAO,CAAC;IACrC,+CAA+C;IAC/C,MAAM,EAAE,YAAY,CAAC;IACrB,mDAAmD;IACnD,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,CA6DnD"}

package/dist/lib/ui_shell_config.server.js

@@ -17,8 +17,12 @@ export function get_ui_shell_config() {
     const standalone_description = get_config_value(section, "standalone_description", "Reuse the packaged authentication flows while inheriting your existing app shell styles.");
     const standalone_wrapper_class = get_config_value(section, "standalone_wrapper_class", "cls_standalone_shell flex min-h-screen w-full items-center justify-center bg-background px-4 py-10");
     const standalone_content_class = get_config_value(section, "standalone_content_class", "cls_standalone_shell_content w-full max-w-5xl shadow-xl rounded-2xl border bg-card");
-    const standalone_show_heading = get_config_value(section, "standalone_show_heading", "true").toLowerCase() === "true";
-    const standalone_show_description = get_config_value(section, "standalone_show_description", "true").toLowerCase() === "true";
+    // Default to false: the package-default copy ("Welcome to hazo auth" /
+    // "Reuse the packaged authentication flows...") is dev/test placeholder
+    // text, not production-suitable. Consumers who want their own heading set
+    // standalone_heading + standalone_show_heading=true explicitly.
+    const standalone_show_heading = get_config_value(section, "standalone_show_heading", "false").toLowerCase() === "true";
+    const standalone_show_description = get_config_value(section, "standalone_show_description", "false").toLowerCase() === "true";
     const vertical_center = get_config_value(section, "vertical_center", "true").toLowerCase() === "true";
     const navbar = get_navbar_config();
     return {

package/dist/server/routes/oauth_google_callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth_google_callback.d.ts","sourceRoot":"","sources":["../../../src/server/routes/oauth_google_callback.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwBxD;;;;GAIG;AACH,wBAAsB,GAAG,CAAC,gBAAgB,EAAE,WAAW,kCA6JtD"}
+{"version":3,"file":"oauth_google_callback.d.ts","sourceRoot":"","sources":["../../../src/server/routes/oauth_google_callback.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwBxD;;;;GAIG;AACH,wBAAsB,GAAG,CAAC,gBAAgB,EAAE,WAAW,kCA2LtD"}

package/dist/server/routes/oauth_google_callback.js

@@ -25,10 +25,18 @@ export async function GET(original_request) {
     // Detect if request came through HTTPS proxy (Cloudflare tunnel, etc.)
     const is_secure = original_request.headers.get("x-forwarded-proto") === "https" ||
         request.url.startsWith("https://");
+    // Resolve the configured sign-in page up-front so the early error redirects
+    // (no token / missing data) honour [hazo_auth__oauth] sign_in_page just like
+    // the success path. Defaults to `/hazo_auth/login` for back-compat.
+    const sign_in_page = get_oauth_config().sign_in_page;
     try {
         // Get the NextAuth token from the session
         // When behind HTTPS proxy, next-auth uses __Secure- cookie prefix
         const token = (await getToken({
+            // next-auth@4 was typed against an older next/server NextRequest that
+            // still carried `geo`, `ip`, and the `[INTERNALS]` symbol. Next 16
+            // dropped those, leaving the two NextRequest types structurally
+            // incompatible at the type level even though the runtime shape is fine.
             req: request,
             secureCookie: is_secure,
         }));
@@ -47,7 +55,7 @@ export async function GET(original_request) {
                 note: "No NextAuth token found - user may not have completed Google sign-in",
             });
             // Redirect to login with error — use .toString() to ensure absolute URL
-            const login_url = new URL("/hazo_auth/login", request.url);
+            const login_url = new URL(sign_in_page, request.url);
             login_url.searchParams.set("error", "oauth_failed");
             return NextResponse.redirect(login_url.toString());
         }
@@ -60,13 +68,13 @@ export async function GET(original_request) {
                 has_hazo_user_id: !!token.hazo_user_id,
                 has_google_id: !!token.google_id,
             });
-            const login_url = new URL("/hazo_auth/login", request.url);
+            const login_url = new URL(sign_in_page, request.url);
             login_url.searchParams.set("error", "oauth_incomplete");
             return NextResponse.redirect(login_url.toString());
         }
         const user_id = token.hazo_user_id;
         const email = token.email;
-        logger.info("google_callback_success", {
+        logger.debug("google_callback_success", {
             filename: get_filename(),
             line_number: get_line_number(),
             user_id,
@@ -75,13 +83,32 @@ export async function GET(original_request) {
         // Get redirect URL based on user's scope/invitation status
         const loginConfig = get_login_config();
         const oauthConfig = get_oauth_config();
+        // Per-request override: the login/register layouts can encode a
+        // `?next=<path>` query param into the GoogleSignInButton callback URL,
+        // letting consumer flows (e.g. invite-link landings) keep the user on
+        // their original target after the OAuth round-trip rather than
+        // bouncing through the static `oauthConfig.default_redirect`.
+        //
+        // Validation: must be a same-origin path (starts with `/`, not `//`,
+        // no protocol). Anything else is dropped — prevents an open-redirect
+        // attack where a hostile referrer crafts a `next=//evil.com` URL.
+        const raw_next = request.nextUrl.searchParams.get("next");
+        const safe_next = raw_next &&
+            raw_next.startsWith("/") &&
+            !raw_next.startsWith("//") &&
+            !/^[a-z][a-z0-9+.\-]*:/i.test(raw_next)
+            ? raw_next
+            : null;
         // Check if user needs onboarding (no scope, no invitation = create firm)
         const hazoConnect = get_hazo_connect_instance();
         const { redirect_url: determined_redirect, needs_onboarding, invitation_check_skipped, invitation_table_error, } = await get_post_login_redirect(hazoConnect, user_id, email, {
-            default_redirect: oauthConfig.default_redirect || loginConfig.redirectRoute || "/",
+            default_redirect: safe_next || oauthConfig.default_redirect || loginConfig.redirectRoute || "/",
             create_firm_url: oauthConfig.create_firm_url,
             skip_invitation_check: oauthConfig.skip_invitation_check,
-            no_scope_redirect: oauthConfig.no_scope_redirect,
+            // When a per-request next= is set, override no_scope_redirect too.
+            // Otherwise an invite recipient (no scope yet) would still get
+            // bounced to /onboarding instead of back to the invite landing.
+            no_scope_redirect: safe_next || oauthConfig.no_scope_redirect,
         });
         // Log warning if invitation table is missing
         if (invitation_table_error) {
@@ -93,7 +120,7 @@ export async function GET(original_request) {
                 note: "hazo_invitations table does not exist - run migration or set skip_invitation_check=true in [hazo_auth__oauth]",
             });
         }
-        logger.info("google_callback_post_login_redirect", {
+        logger.debug("google_callback_post_login_redirect", {
             filename: get_filename(),
             line_number: get_line_number(),
             user_id,

package/dist/server_pages/login.d.ts

@@ -16,6 +16,18 @@ export type LoginPageProps = {
      * Defaults to "#f1f5f9"
      */
     image_background_color?: string;
+    /**
+     * Layout mode (default: `"two_column"`).
+     * - `"two_column"` — full server-rendered page with the package's
+     *   TwoColumnAuthLayout (image on the left, form on the right) wrapped in
+     *   the standalone AuthPageShell. Backwards-compatible.
+     * - `"form_only"` — emits just the form content (no AuthPageShell, no
+     *   TwoColumnAuthLayout). Use when wrapping the form in your own brand
+     *   chrome (e.g. a custom split-panel layout or an existing app shell).
+     *   `image_src` / `image_alt` / `image_background_color` are ignored in
+     *   this mode.
+     */
+    layout?: "two_column" | "form_only";
 };
 /**
  * Zero-config LoginPage server component
@@ -40,6 +52,6 @@ export type LoginPageProps = {
  * @param props - Optional visual customization props
  * @returns Server-rendered login page
  */
-export default function LoginPage({ image_src, image_alt, image_background_color, }?: LoginPageProps): import("react/jsx-runtime").JSX.Element;
+export default function LoginPage({ image_src, image_alt, image_background_color, layout, }?: LoginPageProps): import("react/jsx-runtime").JSX.Element;
 export { LoginPage };
 //# sourceMappingURL=login.d.ts.map

package/dist/server_pages/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/server_pages/login.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAOrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,OAAO,UAAU,SAAS,CAAC,EAChC,SAAS,EACT,SAAS,EACT,sBAAsB,GACvB,GAAE,cAAmB,2CAqCrB;AAGD,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/server_pages/login.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AASrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACrC,CAAC;AAGF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,OAAO,UAAU,SAAS,CAAC,EAChC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,MAAqB,GACtB,GAAE,cAAmB,2CA2DrB;AAGD,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/server_pages/login.js

@@ -1,11 +1,13 @@
-import { jsx as _jsx } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 // file_description: Zero-config LoginPage server component - drop in and use with no configuration required
 // section: server-only-guard
 import "server-only";
 // section: imports
 import { get_login_config } from "../lib/login_config.server.js";
+import { get_navbar_config } from "../lib/navbar_config.server.js";
 import { LoginClientWrapper } from "./login_client_wrapper.js";
 import { AuthPageShell } from "../components/layouts/shared/components/auth_page_shell.js";
+import { FloatingHomeLink } from "../components/layouts/shared/components/floating_home_link.js";
 // section: component
 /**
  * Zero-config LoginPage server component
@@ -30,20 +32,34 @@ import { AuthPageShell } from "../components/layouts/shared/components/auth_page
  * @param props - Optional visual customization props
  * @returns Server-rendered login page
  */
-export default function LoginPage({ image_src, image_alt, image_background_color, } = {}) {
+export default function LoginPage({ image_src, image_alt, image_background_color, layout = "two_column", } = {}) {
     // Load configuration from INI file (with defaults including asset images)
     const config = get_login_config();
     // Use props if provided, otherwise fall back to config (which includes default asset image)
     const finalImageSrc = image_src || config.imageSrc;
     const finalImageAlt = image_alt || config.imageAlt;
     const finalImageBackgroundColor = image_background_color || config.imageBackgroundColor;
-    // Pass serializable config to client wrapper, wrapped in AuthPageShell for navbar support
-    return (_jsx(AuthPageShell, { children: _jsx(LoginClientWrapper, { image_src: finalImageSrc, image_alt: finalImageAlt, image_background_color: finalImageBackgroundColor, redirectRoute: config.redirectRoute, successMessage: config.successMessage, alreadyLoggedInMessage: config.alreadyLoggedInMessage, showLogoutButton: config.showLogoutButton, showReturnHomeButton: config.showReturnHomeButton, returnHomeButtonLabel: config.returnHomeButtonLabel, returnHomePath: config.returnHomePath, forgotPasswordPath: config.forgotPasswordPath, forgotPasswordLabel: config.forgotPasswordLabel, createAccountPath: config.createAccountPath, createAccountLabel: config.createAccountLabel, showCreateAccountLink: config.showCreateAccountLink, oauth: {
-                enable_google: config.oauth.enable_google,
-                enable_email_password: config.oauth.enable_email_password,
-                google_button_text: config.oauth.google_button_text,
-                oauth_divider_text: config.oauth.oauth_divider_text,
-            } }) }));
+    const wrapper = (_jsx(LoginClientWrapper, { image_src: finalImageSrc, image_alt: finalImageAlt, image_background_color: finalImageBackgroundColor, redirectRoute: config.redirectRoute, successMessage: config.successMessage, alreadyLoggedInMessage: config.alreadyLoggedInMessage, showLogoutButton: config.showLogoutButton, showReturnHomeButton: config.showReturnHomeButton, returnHomeButtonLabel: config.returnHomeButtonLabel, returnHomePath: config.returnHomePath, forgotPasswordPath: config.forgotPasswordPath, forgotPasswordLabel: config.forgotPasswordLabel, createAccountPath: config.createAccountPath, createAccountLabel: config.createAccountLabel, showCreateAccountLink: config.showCreateAccountLink, oauth: {
+            enable_google: config.oauth.enable_google,
+            enable_email_password: config.oauth.enable_email_password,
+            google_button_text: config.oauth.google_button_text,
+            oauth_divider_text: config.oauth.oauth_divider_text,
+        }, layout: layout }));
+    // form_only mode: skip AuthPageShell so the consumer's own page chrome
+    // (e.g. a split-panel AuthLayout) hosts the form without our standalone
+    // wrapper interfering. Two-column mode keeps the existing AuthPageShell
+    // wrap for navbar/centering support.
+    //
+    // The navbar config's home_link is also surfaced here in form_only mode
+    // so users mid-auth-flow always have a way out — without this, the only
+    // exit is the browser back button. Rendered as a fixed-position "Back to
+    // home" pill (top-left). Disabled by setting `[hazo_auth__navbar]
+    // show_home_link = false` or by hiding it CSS-side at the consumer.
+    if (layout === "form_only") {
+        const navbar = get_navbar_config();
+        return (_jsxs(_Fragment, { children: [navbar.show_home_link && (_jsx(FloatingHomeLink, { path: navbar.home_path, label: navbar.home_label })), wrapper] }));
+    }
+    return _jsx(AuthPageShell, { children: wrapper });
 }
 // Named export for direct imports
 export { LoginPage };

package/dist/server_pages/login_client_wrapper.d.ts

@@ -2,17 +2,19 @@ import type { LoginConfig } from "../lib/login_config.server";
 import type { OAuthLayoutConfig } from "../components/layouts/login/index";
 import type { StaticImageData } from "next/image";
 export type LoginClientWrapperProps = Omit<LoginConfig, 'imageSrc' | 'imageAlt' | 'imageBackgroundColor' | 'oauth' | 'showCreateAccountLink'> & {
-    image_src: string | StaticImageData;
-    image_alt: string;
-    image_background_color: string;
+    image_src?: string | StaticImageData;
+    image_alt?: string;
+    image_background_color?: string;
     /** Show/hide "Create account" link (default: true) */
     showCreateAccountLink?: boolean;
     /** OAuth configuration */
     oauth?: OAuthLayoutConfig;
+    /** Layout mode — see LoginLayoutProps.layout. Default `"two_column"`. */
+    layout?: "two_column" | "form_only";
 };
 /**
  * Client wrapper for LoginLayout
  * Initializes hazo_connect data client on client side and passes config from server
  */
-export declare function LoginClientWrapper({ image_src, image_alt, image_background_color, redirectRoute, successMessage, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, forgotPasswordPath, forgotPasswordLabel, createAccountPath, createAccountLabel, showCreateAccountLink, oauth, }: LoginClientWrapperProps): import("react/jsx-runtime").JSX.Element;
+export declare function LoginClientWrapper({ image_src, image_alt, image_background_color, redirectRoute, successMessage, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, forgotPasswordPath, forgotPasswordLabel, createAccountPath, createAccountLabel, showCreateAccountLink, oauth, layout, }: LoginClientWrapperProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=login_client_wrapper.d.ts.map

package/dist/server_pages/login_client_wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_client_wrapper.d.ts","sourceRoot":"","sources":["../../src/server_pages/login_client_wrapper.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAG3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,UAAU,GAAG,sBAAsB,GAAG,OAAO,GAAG,uBAAuB,CAAC,GAAG;IAC9I,SAAS,EAAE,MAAM,GAAG,eAAe,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sDAAsD;IACtD,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,0BAA0B;IAC1B,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAGF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,qBAA4B,EAC5B,KAAK,GACN,EAAE,uBAAuB,2CAyCzB"}
+{"version":3,"file":"login_client_wrapper.d.ts","sourceRoot":"","sources":["../../src/server_pages/login_client_wrapper.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAG3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,UAAU,GAAG,sBAAsB,GAAG,OAAO,GAAG,uBAAuB,CAAC,GAAG;IAC9I,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sDAAsD;IACtD,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,0BAA0B;IAC1B,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,yEAAyE;IACzE,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACrC,CAAC;AAGF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,qBAA4B,EAC5B,KAAK,EACL,MAAqB,GACtB,EAAE,uBAAuB,2CA0CzB"}

package/dist/server_pages/login_client_wrapper.js

@@ -11,7 +11,7 @@ import { create_sqlite_hazo_connect } from "../lib/hazo_connect_setup.js";
  * Client wrapper for LoginLayout
  * Initializes hazo_connect data client on client side and passes config from server
  */
-export function LoginClientWrapper({ image_src, image_alt, image_background_color, redirectRoute, successMessage, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, forgotPasswordPath, forgotPasswordLabel, createAccountPath, createAccountLabel, showCreateAccountLink = true, oauth, }) {
+export function LoginClientWrapper({ image_src, image_alt, image_background_color, redirectRoute, successMessage, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, forgotPasswordPath, forgotPasswordLabel, createAccountPath, createAccountLabel, showCreateAccountLink = true, oauth, layout = "two_column", }) {
     const [dataClient, setDataClient] = useState(null);
     useEffect(() => {
         // Initialize hazo_connect on client side
@@ -23,5 +23,5 @@ export function LoginClientWrapper({ image_src, image_alt, image_background_colo
     if (!dataClient) {
         return (_jsx("div", { className: "cls_login_page_loading flex items-center justify-center min-h-screen", children: _jsx("div", { className: "text-slate-600 animate-pulse", children: "Loading..." }) }));
     }
-    return (_jsx(LoginLayout, { image_src: image_src, image_alt: image_alt, image_background_color: image_background_color, data_client: dataClient, redirectRoute: redirectRoute, successMessage: successMessage, alreadyLoggedInMessage: alreadyLoggedInMessage, showLogoutButton: showLogoutButton, showReturnHomeButton: showReturnHomeButton, returnHomeButtonLabel: returnHomeButtonLabel, returnHomePath: returnHomePath, forgot_password_path: forgotPasswordPath, forgot_password_label: forgotPasswordLabel, create_account_path: createAccountPath, create_account_label: createAccountLabel, show_create_account_link: showCreateAccountLink, oauth: oauth }));
+    return (_jsx(LoginLayout, { image_src: image_src, image_alt: image_alt, image_background_color: image_background_color, data_client: dataClient, redirectRoute: redirectRoute, successMessage: successMessage, alreadyLoggedInMessage: alreadyLoggedInMessage, showLogoutButton: showLogoutButton, showReturnHomeButton: showReturnHomeButton, returnHomeButtonLabel: returnHomeButtonLabel, returnHomePath: returnHomePath, forgot_password_path: forgotPasswordPath, forgot_password_label: forgotPasswordLabel, create_account_path: createAccountPath, create_account_label: createAccountLabel, show_create_account_link: showCreateAccountLink, oauth: oauth, layout: layout }));
 }

package/dist/server_pages/register.d.ts

@@ -16,6 +16,12 @@ export type RegisterPageProps = {
      * Defaults from hazo_auth_config.ini or "#e2e8f0"
      */
     image_background_color?: string;
+    /**
+     * Layout mode (default: `"two_column"`). See `LoginPageProps.layout` for the
+     * full description. `"form_only"` skips both AuthPageShell and
+     * TwoColumnAuthLayout so the consumer's brand chrome can wrap the form.
+     */
+    layout?: "two_column" | "form_only";
 };
 /**
  * Zero-config RegisterPage server component
@@ -42,6 +48,6 @@ export type RegisterPageProps = {
  * @param props - Optional visual customization props
  * @returns Server-rendered register page
  */
-export default function RegisterPage({ image_src, image_alt, image_background_color, }?: RegisterPageProps): import("react/jsx-runtime").JSX.Element;
+export default function RegisterPage({ image_src, image_alt, image_background_color, layout, }?: RegisterPageProps): import("react/jsx-runtime").JSX.Element;
 export { RegisterPage };
 //# sourceMappingURL=register.d.ts.map

package/dist/server_pages/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/server_pages/register.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAOrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,EACnC,SAAS,EACT,SAAS,EACT,sBAAsB,GACvB,GAAE,iBAAsB,2CAkCxB;AAGD,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/server_pages/register.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AASrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACrC,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,EACnC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,MAAqB,GACtB,GAAE,iBAAsB,2CAiDxB;AAGD,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/server_pages/register.js

@@ -1,11 +1,13 @@
-import { jsx as _jsx } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 // file_description: Zero-config RegisterPage server component - drop in and use with no configuration required
 // section: server-only-guard
 import "server-only";
 // section: imports
 import { get_register_config } from "../lib/register_config.server.js";
+import { get_navbar_config } from "../lib/navbar_config.server.js";
 import { RegisterClientWrapper } from "./register_client_wrapper.js";
 import { AuthPageShell } from "../components/layouts/shared/components/auth_page_shell.js";
+import { FloatingHomeLink } from "../components/layouts/shared/components/floating_home_link.js";
 // section: component
 /**
  * Zero-config RegisterPage server component
@@ -32,20 +34,27 @@ import { AuthPageShell } from "../components/layouts/shared/components/auth_page
  * @param props - Optional visual customization props
  * @returns Server-rendered register page
  */
-export default function RegisterPage({ image_src, image_alt, image_background_color, } = {}) {
+export default function RegisterPage({ image_src, image_alt, image_background_color, layout = "two_column", } = {}) {
     // Load configuration from INI file (with defaults including asset images)
     const config = get_register_config();
     // Use props if provided, otherwise fall back to config (which includes default asset image)
     const finalImageSrc = image_src || config.imageSrc;
     const finalImageAlt = image_alt || config.imageAlt;
     const finalImageBackgroundColor = image_background_color || config.imageBackgroundColor;
-    // Pass serializable config to client wrapper, wrapped in AuthPageShell for navbar support
-    return (_jsx(AuthPageShell, { children: _jsx(RegisterClientWrapper, { image_src: finalImageSrc, image_alt: finalImageAlt, image_background_color: finalImageBackgroundColor, showNameField: config.showNameField, passwordRequirements: config.passwordRequirements, alreadyLoggedInMessage: config.alreadyLoggedInMessage, showLogoutButton: config.showLogoutButton, showReturnHomeButton: config.showReturnHomeButton, returnHomeButtonLabel: config.returnHomeButtonLabel, returnHomePath: config.returnHomePath, signInPath: config.signInPath, signInLabel: config.signInLabel, oauth: {
-                enable_google: config.oauth.enable_google,
-                enable_email_password: config.oauth.enable_email_password,
-                google_button_text: config.oauth.google_button_text,
-                oauth_divider_text: config.oauth.oauth_divider_text,
-            } }) }));
+    const wrapper = (_jsx(RegisterClientWrapper, { image_src: finalImageSrc, image_alt: finalImageAlt, image_background_color: finalImageBackgroundColor, showNameField: config.showNameField, passwordRequirements: config.passwordRequirements, alreadyLoggedInMessage: config.alreadyLoggedInMessage, showLogoutButton: config.showLogoutButton, showReturnHomeButton: config.showReturnHomeButton, returnHomeButtonLabel: config.returnHomeButtonLabel, returnHomePath: config.returnHomePath, signInPath: config.signInPath, signInLabel: config.signInLabel, oauth: {
+            enable_google: config.oauth.enable_google,
+            enable_email_password: config.oauth.enable_email_password,
+            google_button_text: config.oauth.google_button_text,
+            oauth_divider_text: config.oauth.oauth_divider_text,
+        }, layout: layout }));
+    // form_only mode: skip AuthPageShell so the consumer's own page chrome
+    // hosts the form. See LoginPage for the full rationale, including the
+    // FloatingHomeLink rendering rule below.
+    if (layout === "form_only") {
+        const navbar = get_navbar_config();
+        return (_jsxs(_Fragment, { children: [navbar.show_home_link && (_jsx(FloatingHomeLink, { path: navbar.home_path, label: navbar.home_label })), wrapper] }));
+    }
+    return _jsx(AuthPageShell, { children: wrapper });
 }
 // Named export for direct imports
 export { RegisterPage };

package/dist/server_pages/register_client_wrapper.d.ts

@@ -2,15 +2,17 @@ import type { RegisterConfig } from "../lib/register_config.server";
 import type { OAuthLayoutConfig } from "../components/layouts/register/index";
 import type { StaticImageData } from "next/image";
 export type RegisterClientWrapperProps = Omit<RegisterConfig, 'imageSrc' | 'imageAlt' | 'imageBackgroundColor' | 'oauth'> & {
-    image_src: string | StaticImageData;
-    image_alt: string;
-    image_background_color: string;
+    image_src?: string | StaticImageData;
+    image_alt?: string;
+    image_background_color?: string;
     /** OAuth configuration */
     oauth?: OAuthLayoutConfig;
+    /** Layout mode — see RegisterLayoutProps.layout. Default `"two_column"`. */
+    layout?: "two_column" | "form_only";
 };
 /**
  * Client wrapper for RegisterLayout
  * Initializes hazo_connect data client on client side and passes config from server
  */
-export declare function RegisterClientWrapper({ image_src, image_alt, image_background_color, showNameField, passwordRequirements, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, signInPath, signInLabel, oauth, }: RegisterClientWrapperProps): import("react/jsx-runtime").JSX.Element;
+export declare function RegisterClientWrapper({ image_src, image_alt, image_background_color, showNameField, passwordRequirements, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, signInPath, signInLabel, oauth, layout, }: RegisterClientWrapperProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=register_client_wrapper.d.ts.map

package/dist/server_pages/register_client_wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_client_wrapper.d.ts","sourceRoot":"","sources":["../../src/server_pages/register_client_wrapper.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAG9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,UAAU,GAAG,sBAAsB,GAAG,OAAO,CAAC,GAAG;IAC1H,SAAS,EAAE,MAAM,GAAG,eAAe,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,0BAA0B;IAC1B,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAGF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,UAAU,EACV,WAAW,EACX,KAAK,GACN,EAAE,0BAA0B,2CAsC5B"}
+{"version":3,"file":"register_client_wrapper.d.ts","sourceRoot":"","sources":["../../src/server_pages/register_client_wrapper.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAG9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,UAAU,GAAG,sBAAsB,GAAG,OAAO,CAAC,GAAG;IAC1H,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B;IAC1B,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACrC,CAAC;AAGF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,UAAU,EACV,WAAW,EACX,KAAK,EACL,MAAqB,GACtB,EAAE,0BAA0B,2CAuC5B"}