yaxa-svelte 1.5.0 → 1.5.2

package/dist/auth/index.d.ts

@@ -0,0 +1,3 @@
+export { default as AuthCard } from '../components/saas/AuthCard.svelte';
+export { useAuth } from '../composables/useAuth.svelte';
+export type { UseAuthOptions, SocialProvider } from '../composables/useAuth.svelte';

package/dist/auth/index.js

@@ -0,0 +1,3 @@
+// Yaxa SaaS Auth Suite (Better-Auth integration for Svelte 5 & SvelteKit)
+export { default as AuthCard } from '../components/saas/AuthCard.svelte';
+export { useAuth } from '../composables/useAuth.svelte';

package/dist/components/elements/CodeBlock.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/components/elements/CodeBlock.test.js

@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest';
+import { tokenizeCode } from './CodeBlock.svelte';
+describe('tokenizeCode', () => {
+    it('tokenizes markdown headings correctly', () => {
+        const tokens = tokenizeCode('# Hello World', 'markdown');
+        expect(tokens).toHaveLength(1);
+        expect(tokens[0]).toEqual([
+            { text: '# ', type: 'punctuation' },
+            { text: 'Hello World', type: 'heading' }
+        ]);
+    });
+    it('tokenizes typescript keywords and identifiers', () => {
+        const tokens = tokenizeCode('const x = 42;', 'typescript');
+        expect(tokens).toHaveLength(1);
+        const texts = tokens[0].map((t) => t.text);
+        expect(texts).toContain('const');
+        expect(texts).toContain('x');
+        expect(texts).toContain('42');
+    });
+    it('handles multiline code and empty lines', () => {
+        const code = 'line 1\n\nline 3';
+        const tokens = tokenizeCode(code, 'plain');
+        expect(tokens).toHaveLength(3);
+        expect(tokens[1]).toEqual([{ text: '', type: 'plain' }]);
+    });
+});

package/dist/components/forms/Form.svelte

@@ -3,8 +3,15 @@
 	import type { ZodSchema } from 'zod';
 	import Alert from '../overlays/Alert.svelte';
 
+	export interface FormSchema<T = any> {
+		parse?: (data: unknown) => T;
+		safeParse?: (data: unknown) => { success: boolean; data?: T; error?: any };
+		validate?: (data: unknown) => T;
+		[key: string]: any;
+	}
+
 	interface Props {
-		schema?: ZodSchema;
+		schema?: FormSchema | ZodSchema | any;
 		values?: Record<string, any>;
 		loading?: boolean;
 		errorSummary?: boolean;
@@ -30,8 +37,27 @@
 	function validate() {
 		if (!schema) return true;
 		try {
-			schema.parse(values);
-			errors = {};
+			if (typeof schema.safeParse === 'function') {
+				const res = schema.safeParse(values);
+				if (!res.success) {
+					const fieldErrors: Record<string, string> = {};
+					const issues = res.error?.issues || res.error?.errors || [];
+					for (const e of issues) {
+						const field = Array.isArray(e.path) ? e.path.join('.') : String(e.path || 'form');
+						if (!fieldErrors[field]) {
+							fieldErrors[field] = e.message;
+						}
+					}
+					errors = fieldErrors;
+					return false;
+				}
+				errors = {};
+				return true;
+			} else if (typeof schema.parse === 'function') {
+				schema.parse(values);
+				errors = {};
+				return true;
+			}
 			return true;
 		} catch (err: any) {
 			const fieldErrors: Record<string, string> = {};

package/dist/components/forms/Form.svelte.d.ts

@@ -1,7 +1,17 @@
 import type { Snippet } from 'svelte';
 import type { ZodSchema } from 'zod';
+export interface FormSchema<T = any> {
+    parse?: (data: unknown) => T;
+    safeParse?: (data: unknown) => {
+        success: boolean;
+        data?: T;
+        error?: any;
+    };
+    validate?: (data: unknown) => T;
+    [key: string]: any;
+}
 interface Props {
-    schema?: ZodSchema;
+    schema?: FormSchema | ZodSchema | any;
     values?: Record<string, any>;
     loading?: boolean;
     errorSummary?: boolean;

package/dist/components/saas/UserMenu.svelte

@@ -3,24 +3,16 @@
 	import Badge from '../elements/Badge.svelte';
 	import Icon from '../elements/Icon.svelte';
 	import DropdownMenu, { type MenuItem } from '../navigation/DropdownMenu.svelte';
-	import { useAuth } from '../../composables/useAuth.svelte';
-
-	interface UserInfo {
-		name?: string | null;
-		email?: string | null;
-		image?: string | null;
-		role?: string | null;
-		tier?: string | null;
-	}
+	import { getAuthUserContext, type AuthUserContext } from '../../site/context';
 
 	interface Props {
-		user?: UserInfo | null;
+		user?: AuthUserContext | null;
 		tier?: string;
 		dashboardUrl?: string;
 		settingsUrl?: string;
 		billingUrl?: string;
 		class?: string;
-		onsignout?: () => void;
+		onsignout?: () => void | Promise<void>;
 	}
 
 	let {
@@ -33,16 +25,17 @@
 		onsignout
 	}: Props = $props();
 
-	const auth = useAuth();
+	const contextUser = $derived(getAuthUserContext());
 
 	const currentUser = $derived(
-		propUser ||
-			auth.user || {
-				name: 'Solo Developer',
-				email: 'dev@yaxa.dev',
-				image: null,
-				tier
-			}
+		propUser !== undefined
+			? propUser
+			: contextUser || {
+					name: 'Solo Developer',
+					email: 'dev@yaxa.dev',
+					image: null,
+					tier
+				}
 	);
 
 	const initials = $derived.by(() => {
@@ -91,9 +84,11 @@
 			icon: 'log-out',
 			destructive: true,
 			onSelect: async () => {
-				await auth.signOut();
-				if (onsignout) onsignout();
-				if (typeof window !== 'undefined') window.location.href = '/login';
+				if (onsignout) {
+					await onsignout();
+				} else if (typeof window !== 'undefined') {
+					window.location.href = '/login';
+				}
 			}
 		}
 	]);

package/dist/components/saas/UserMenu.svelte.d.ts

@@ -1,18 +1,12 @@
-interface UserInfo {
-    name?: string | null;
-    email?: string | null;
-    image?: string | null;
-    role?: string | null;
-    tier?: string | null;
-}
+import { type AuthUserContext } from '../../site/context';
 interface Props {
-    user?: UserInfo | null;
+    user?: AuthUserContext | null;
     tier?: string;
     dashboardUrl?: string;
     settingsUrl?: string;
     billingUrl?: string;
     class?: string;
-    onsignout?: () => void;
+    onsignout?: () => void | Promise<void>;
 }
 declare const UserMenu: import("svelte").Component<Props, {}, "">;
 type UserMenu = ReturnType<typeof UserMenu>;

package/dist/composables/useGate.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/composables/useGate.test.js

@@ -0,0 +1,58 @@
+import { describe, it, expect } from 'vitest';
+import { useGate } from './useGate.svelte';
+describe('useGate', () => {
+    it('evaluates plan hierarchy correctly', () => {
+        const gateStarter = useGate({
+            user: { id: '1', role: 'user', plan: 'starter' }
+        });
+        expect(gateStarter.allowsPlan('free')).toBe(true);
+        expect(gateStarter.allowsPlan('starter')).toBe(true);
+        expect(gateStarter.allowsPlan('pro')).toBe(false);
+        expect(gateStarter.allowsPlan('enterprise')).toBe(false);
+        const gatePro = useGate({
+            user: { id: '2', role: 'user', plan: 'pro' }
+        });
+        expect(gatePro.allowsPlan('starter')).toBe(true);
+        expect(gatePro.allowsPlan('pro')).toBe(true);
+        expect(gatePro.allowsPlan('enterprise')).toBe(false);
+    });
+    it('allows plan arrays (exact match within allowed array)', () => {
+        const gate = useGate({
+            user: { id: '1', role: 'user', plan: 'pro' }
+        });
+        expect(gate.allowsPlan(['starter', 'pro'])).toBe(true);
+        expect(gate.allowsPlan(['starter', 'enterprise'])).toBe(false);
+    });
+    it('checks user roles correctly', () => {
+        const gateUser = useGate({
+            user: { id: '1', role: 'member', plan: 'free' }
+        });
+        expect(gateUser.hasRole('member')).toBe(true);
+        expect(gateUser.hasRole('editor')).toBe(false);
+        expect(gateUser.hasRole(['editor', 'member'])).toBe(true);
+    });
+    it('allows admin bypass by default', () => {
+        const gateAdmin = useGate({
+            user: { id: 'admin-1', role: 'admin', plan: 'free' }
+        });
+        expect(gateAdmin.isAdmin).toBe(true);
+        expect(gateAdmin.allowsPlan('enterprise')).toBe(true);
+        expect(gateAdmin.hasRole('billing_manager')).toBe(true);
+        expect(gateAdmin.can(() => false)).toBe(true);
+    });
+    it('respects allowAdminBypass = false', () => {
+        const gateAdminRestricted = useGate({
+            user: { id: 'admin-1', role: 'admin', plan: 'free' },
+            allowAdminBypass: false
+        });
+        expect(gateAdminRestricted.isAdmin).toBe(false);
+        expect(gateAdminRestricted.allowsPlan('pro')).toBe(false);
+    });
+    it('evaluates custom can() predicate correctly', () => {
+        const gate = useGate({
+            user: { id: 'custom-1', role: 'user', plan: 'pro' }
+        });
+        expect(gate.can((u) => u?.id === 'custom-1')).toBe(true);
+        expect(gate.can((u) => u?.id === 'other')).toBe(false);
+    });
+});

package/dist/index.d.ts

@@ -24,6 +24,7 @@ export type { CodeBlockProps } from './components/elements/CodeBlock.svelte';
 export { default as SortableList } from './components/elements/SortableList.svelte';
 export type { SortableListProps } from './components/elements/SortableList.svelte';
 export { default as Form } from './components/forms/Form.svelte';
+export type { FormSchema } from './components/forms/Form.svelte';
 export { default as FormField } from './components/forms/FormField.svelte';
 export { default as Input } from './components/forms/Input.svelte';
 export type { InputProps } from './components/forms/Input.svelte';
@@ -123,13 +124,10 @@ export { yaxa } from './vite/index';
 export type { YaxaPluginOptions } from './vite/index';
 export { default as Gate } from './components/saas/Gate.svelte';
 export type { GateProps } from './components/saas/Gate.svelte';
-export { default as AuthCard } from './components/saas/AuthCard.svelte';
 export { default as UserMenu } from './components/saas/UserMenu.svelte';
 export { default as PricingCard } from './components/saas/PricingCard.svelte';
 export { default as PricingTable } from './components/saas/PricingTable.svelte';
 export { default as SubscriptionCard } from './components/saas/SubscriptionCard.svelte';
-export { useAuth } from './composables/useAuth.svelte';
-export type { UseAuthOptions, SocialProvider } from './composables/useAuth.svelte';
 export { useGate } from './composables/useGate.svelte';
 export type { UseGateOptions } from './composables/useGate.svelte';
 export { useUpload } from './composables/useUpload.svelte';

package/dist/index.js

@@ -89,14 +89,12 @@ export { createManifestHandler } from './site/manifest';
 export { generateWebSiteSchema, generateOrganizationSchema, generateSoftwareApplicationSchema, generateSoftwareSourceCodeSchema, generatePersonSchema, generateArticleSchema, generateBreadcrumbSchema } from './site/schema';
 export { definePageSeo } from './site/seo-helpers';
 export { yaxa } from './vite/index';
-// SaaS Suite: UI Components & Composables
+// SaaS Suite: UI Components & Composables (Pure UI & Context Runes)
 export { default as Gate } from './components/saas/Gate.svelte';
-export { default as AuthCard } from './components/saas/AuthCard.svelte';
 export { default as UserMenu } from './components/saas/UserMenu.svelte';
 export { default as PricingCard } from './components/saas/PricingCard.svelte';
 export { default as PricingTable } from './components/saas/PricingTable.svelte';
 export { default as SubscriptionCard } from './components/saas/SubscriptionCard.svelte';
-export { useAuth } from './composables/useAuth.svelte';
 export { useGate } from './composables/useGate.svelte';
 export { useUpload } from './composables/useUpload.svelte';
 // Utilities

package/dist/server/auth/hook.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/hook.test.js

@@ -0,0 +1,82 @@
+import { describe, it, expect, vi } from 'vitest';
+import { createYaxaAuthHook } from './hook';
+describe('createYaxaAuthHook', () => {
+    const mockAuth = {
+        handler: vi.fn(() => new Response('auth handler response')),
+        api: {
+            getSession: vi.fn()
+        }
+    };
+    it('routes /api/auth/* requests directly to Better-Auth handler', async () => {
+        const hook = createYaxaAuthHook({ auth: mockAuth });
+        const event = {
+            url: new URL('https://example.com/api/auth/sign-in'),
+            request: new Request('https://example.com/api/auth/sign-in'),
+            locals: {}
+        };
+        const resolve = vi.fn();
+        const response = await hook({ event: event, resolve });
+        expect(mockAuth.handler).toHaveBeenCalledWith(event.request);
+        expect(await response.text()).toBe('auth handler response');
+        expect(resolve).not.toHaveBeenCalled();
+    });
+    it('allows public routes and resolves successfully', async () => {
+        mockAuth.api.getSession.mockResolvedValueOnce(null);
+        const hook = createYaxaAuthHook({ auth: mockAuth });
+        const event = {
+            url: new URL('https://example.com/'),
+            request: new Request('https://example.com/'),
+            locals: {}
+        };
+        const resolve = vi.fn().mockResolvedValue(new Response('home page'));
+        const response = await hook({ event: event, resolve });
+        expect(resolve).toHaveBeenCalledWith(event);
+        expect(event.locals.user).toBeNull();
+        expect(await response.text()).toBe('home page');
+    });
+    it('throws 303 redirect when unauthenticated user accesses protected path', async () => {
+        mockAuth.api.getSession.mockResolvedValueOnce(null);
+        const hook = createYaxaAuthHook({
+            auth: mockAuth,
+            protectedPaths: ['/dashboard'],
+            loginPath: '/auth/login'
+        });
+        const event = {
+            url: new URL('https://example.com/dashboard/billing?tab=invoices'),
+            request: new Request('https://example.com/dashboard/billing?tab=invoices'),
+            locals: {}
+        };
+        const resolve = vi.fn();
+        try {
+            await hook({ event: event, resolve });
+            expect.unreachable('Should have thrown redirect');
+        }
+        catch (err) {
+            expect(err.status).toBe(303);
+            expect(err.location).toBe('/auth/login?returnTo=%2Fdashboard%2Fbilling%3Ftab%3Dinvoices');
+        }
+    });
+    it('allows access to protected path when user is authenticated', async () => {
+        const mockUser = { id: 'user-123', email: 'user@example.com' };
+        const mockSession = { id: 'session-456' };
+        mockAuth.api.getSession.mockResolvedValueOnce({
+            user: mockUser,
+            session: mockSession
+        });
+        const hook = createYaxaAuthHook({
+            auth: mockAuth,
+            protectedPaths: ['/dashboard']
+        });
+        const event = {
+            url: new URL('https://example.com/dashboard'),
+            request: new Request('https://example.com/dashboard'),
+            locals: {}
+        };
+        const resolve = vi.fn().mockResolvedValue(new Response('dashboard content'));
+        const response = await hook({ event: event, resolve });
+        expect(event.locals.user).toEqual(mockUser);
+        expect(event.locals.session).toEqual(mockSession);
+        expect(resolve).toHaveBeenCalled();
+        expect(await response.text()).toBe('dashboard content');
+    });
+});

package/dist/server/polar/webhook.js

@@ -1,4 +1,5 @@
 import { json } from '@sveltejs/kit';
+import { validateEvent } from '@polar-sh/sdk/webhooks';
 import { eq } from 'drizzle-orm';
 import { getDb, schemaPg, schemaSqlite } from '../db';
 /**
@@ -19,20 +20,35 @@ export function createPolarWebhookHandler(options = {}) {
             return new Response('Method Not Allowed', { status: 405 });
         }
         let rawBody;
-        let payload;
         try {
             rawBody = await event.request.text();
-            payload = JSON.parse(rawBody);
         }
         catch {
-            return new Response('Invalid JSON payload', { status: 400 });
+            return new Response('Failed to read request body', { status: 400 });
         }
-        // Verify signature if secret provided
+        let payload;
+        // Cryptographically verify signature if secret provided
         if (secret) {
-            const signature = event.request.headers.get('webhook-signature') ||
-                event.request.headers.get('polar-signature');
-            if (!signature) {
-                return new Response('Missing webhook signature', { status: 401 });
+            try {
+                const headersObj = {};
+                event.request.headers.forEach((val, key) => {
+                    headersObj[key.toLowerCase()] = val;
+                });
+                if (headersObj['polar-signature'] && !headersObj['webhook-signature']) {
+                    headersObj['webhook-signature'] = headersObj['polar-signature'];
+                }
+                payload = validateEvent(rawBody, headersObj, secret);
+            }
+            catch {
+                return new Response('Invalid or missing webhook signature', { status: 401 });
+            }
+        }
+        else {
+            try {
+                payload = JSON.parse(rawBody);
+            }
+            catch {
+                return new Response('Invalid JSON payload', { status: 400 });
             }
         }
         const eventType = payload.type;
@@ -112,7 +128,7 @@ export function createPolarWebhookHandler(options = {}) {
         }
         catch (err) {
             console.error('[Polar Webhook Error]', err);
-            return new Response(`Webhook handling error: ${err.message}`, { status: 500 });
+            return new Response('Internal Server Error', { status: 500 });
         }
     };
 }

package/dist/server/polar/webhook.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/polar/webhook.test.js

@@ -0,0 +1,90 @@
+import { describe, it, expect, vi } from 'vitest';
+import { createPolarWebhookHandler } from './webhook';
+describe('createPolarWebhookHandler', () => {
+    it('rejects non-POST requests with 405 Method Not Allowed', async () => {
+        const handler = createPolarWebhookHandler();
+        const response = await handler({
+            request: new Request('https://example.com/api/webhooks/polar', {
+                method: 'GET'
+            })
+        });
+        expect(response.status).toBe(405);
+        expect(await response.text()).toBe('Method Not Allowed');
+    });
+    it('rejects invalid JSON payloads with 400 when unauthenticated', async () => {
+        const handler = createPolarWebhookHandler();
+        const response = await handler({
+            request: new Request('https://example.com/api/webhooks/polar', {
+                method: 'POST',
+                body: 'not-json-content'
+            })
+        });
+        expect(response.status).toBe(400);
+        expect(await response.text()).toBe('Invalid JSON payload');
+    });
+    it('rejects requests with missing or forged signature when secret is configured', async () => {
+        const handler = createPolarWebhookHandler({
+            webhookSecret: 'whsec_test_secret_key_12345'
+        });
+        // 1. Missing signature
+        const resMissing = await handler({
+            request: new Request('https://example.com/api/webhooks/polar', {
+                method: 'POST',
+                body: JSON.stringify({ type: 'subscription.created', data: {} })
+            })
+        });
+        expect(resMissing.status).toBe(401);
+        expect(await resMissing.text()).toBe('Invalid or missing webhook signature');
+        // 2. Forged/invalid signature
+        const resForged = await handler({
+            request: new Request('https://example.com/api/webhooks/polar', {
+                method: 'POST',
+                headers: {
+                    'webhook-id': 'msg_123',
+                    'webhook-timestamp': `${Math.floor(Date.now() / 1000)}`,
+                    'webhook-signature': 'v1,forged_invalid_signature'
+                },
+                body: JSON.stringify({ type: 'subscription.created', data: {} })
+            })
+        });
+        expect(resForged.status).toBe(401);
+        expect(await resForged.text()).toBe('Invalid or missing webhook signature');
+    });
+    it('invokes onOrderCreated callback and responds with received: true', async () => {
+        const onOrderCreated = vi.fn();
+        const handler = createPolarWebhookHandler({
+            onOrderCreated
+        });
+        const payload = {
+            type: 'order.created',
+            data: { id: 'order_123', amount: 4900 }
+        };
+        const response = await handler({
+            request: new Request('https://example.com/api/webhooks/polar', {
+                method: 'POST',
+                body: JSON.stringify(payload)
+            })
+        });
+        expect(response.status).toBe(200);
+        const json = await response.json();
+        expect(json).toEqual({ received: true });
+        expect(onOrderCreated).toHaveBeenCalledWith(payload);
+    });
+    it('sanitizes internal errors and returns 500 without leaking exception messages', async () => {
+        const handler = createPolarWebhookHandler({
+            onSubscriptionCreated: () => {
+                throw new Error('Sensitive DB connection string exposed: postgres://user:pass@host/db');
+            }
+        });
+        const response = await handler({
+            request: new Request('https://example.com/api/webhooks/polar', {
+                method: 'POST',
+                body: JSON.stringify({ type: 'subscription.created', data: {} })
+            })
+        });
+        expect(response.status).toBe(500);
+        const text = await response.text();
+        expect(text).toBe('Internal Server Error');
+        expect(text).not.toContain('postgres://');
+    });
+});

package/dist/site/config.js

@@ -56,7 +56,8 @@ export function defineSiteConfig(config) {
         ...config.project
     };
     return {
-        defaultLocale: 'en',
+        ...config,
+        defaultLocale: config.defaultLocale || 'en',
         email: primaryEmail,
         theme: {
             defaultMode: 'system',
@@ -93,8 +94,7 @@ export function defineSiteConfig(config) {
             priority: 0.8,
             exclude: ['/api/*'],
             ...config.sitemap
-        },
-        ...config
+        }
     };
 }
 export const DEFAULT_SITE_CONFIG = defineSiteConfig({

package/dist/site/config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/site/config.test.js

@@ -0,0 +1,39 @@
+import { describe, it, expect } from 'vitest';
+import { defineSiteConfig, computeProjectBadge } from './config';
+describe('computeProjectBadge', () => {
+    it('returns fallback badge when no project is provided', () => {
+        expect(computeProjectBadge(undefined)).toBe('Web Application');
+    });
+    it('respects explicit custom badge', () => {
+        expect(computeProjectBadge({ badge: 'Custom Pro SaaS' })).toBe('Custom Pro SaaS');
+    });
+    it('computes open-source badge with license', () => {
+        expect(computeProjectBadge({ type: 'open-source', license: 'MIT' })).toBe('MIT Open Source');
+        expect(computeProjectBadge({ type: 'open-source' })).toBe('Open Source');
+    });
+    it('computes commercial-saas and freemium badges', () => {
+        expect(computeProjectBadge({ type: 'commercial-saas' })).toBe('Commercial SaaS');
+        expect(computeProjectBadge({ type: 'freemium' })).toBe('Freemium SaaS');
+    });
+});
+describe('defineSiteConfig', () => {
+    it('computes primary email and fallback notice', () => {
+        const config = defineSiteConfig({
+            name: 'Test App',
+            title: 'Test App Title',
+            description: 'Test Description',
+            url: 'https://testapp.com',
+            legal: {
+                paymentProcessor: 'polar'
+            },
+            project: {
+                type: 'open-source',
+                license: 'MIT'
+            }
+        });
+        expect(config.name).toBe('Test App');
+        expect(config.email).toBe('contact@testapp.com');
+        expect(config.legal?.morNotice).toBe('Payments securely processed by Polar.sh (Merchant of Record)');
+        expect(config.project?.badge).toBe('MIT Open Source');
+    });
+});

package/dist/site/og.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/site/og.test.js

@@ -0,0 +1,41 @@
+import { describe, it, expect } from 'vitest';
+import { generateOgSvg } from './og';
+describe('generateOgSvg', () => {
+    it('generates a valid 1200x630 SVG element', () => {
+        const svg = generateOgSvg({
+            title: 'Welcome to Yaxa',
+            description: 'A Next-Gen UI library for Svelte 5',
+            siteName: 'Yaxa',
+            badge: 'v1.5.1'
+        });
+        expect(svg).toContain('<svg width="1200" height="630" viewBox="0 0 1200 630"');
+        expect(svg).toContain('Welcome to Yaxa');
+        expect(svg).toContain('A Next-Gen UI library for Svelte 5');
+        expect(svg).toContain('v1.5.1');
+        expect(svg).toContain('</svg>');
+    });
+    it('escapes dangerous XML characters in titles and descriptions', () => {
+        const svg = generateOgSvg({
+            title: 'Tom & Jerry <Script> "Quotes" \'Single\'',
+            description: 'Symbols: < > & " \'',
+            siteName: 'Yaxa & Co'
+        });
+        expect(svg).not.toContain('<Script>');
+        expect(svg).toContain('&lt;Script&gt;');
+        expect(svg).toContain('&amp;');
+        expect(svg).toContain('&quot;');
+        expect(svg).toContain('&apos;');
+    });
+    it('handles light mode and dark mode color palettes', () => {
+        const darkSvg = generateOgSvg({
+            title: 'Dark Mode',
+            theme: 'dark'
+        });
+        const lightSvg = generateOgSvg({
+            title: 'Light Mode',
+            theme: 'light'
+        });
+        expect(darkSvg).toContain('#09090b');
+        expect(lightSvg).toContain('#fafafa');
+    });
+});

package/dist/site/robots.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/site/robots.test.js

@@ -0,0 +1,53 @@
+import { describe, it, expect } from 'vitest';
+import { createRobotsHandler } from './robots';
+import { defineSiteConfig } from './config';
+const config = defineSiteConfig({
+    name: 'Yaxa',
+    title: 'Yaxa UI',
+    description: 'UI toolkit',
+    url: 'https://yaxa.dev'
+});
+describe('createRobotsHandler', () => {
+    it('disallows indexing in non-production environments', async () => {
+        const handler = createRobotsHandler({
+            config,
+            isProduction: false
+        });
+        const response = (await handler({
+            url: new URL('http://localhost:5173/robots.txt')
+        }));
+        const body = await response.text();
+        expect(response.headers.get('Content-Type')).toContain('text/plain');
+        expect(body).toContain('User-agent: *');
+        expect(body).toContain('Disallow: /');
+        expect(body).toContain('# Non-production environment');
+    });
+    it('allows indexing and provides sitemap in production', async () => {
+        const handler = createRobotsHandler({
+            config,
+            isProduction: true
+        });
+        const response = (await handler({
+            url: new URL('https://yaxa.dev/robots.txt')
+        }));
+        const body = await response.text();
+        expect(body).toContain('User-agent: *');
+        expect(body).toContain('Allow: /');
+        expect(body).toContain('Disallow: /admin/');
+        expect(body).toContain('Sitemap: https://yaxa.dev/sitemap.xml');
+    });
+    it('blocks AI web crawlers when aiCrawlers: disallow', async () => {
+        const handler = createRobotsHandler({
+            config,
+            isProduction: true,
+            aiCrawlers: 'disallow'
+        });
+        const response = (await handler({
+            url: new URL('https://yaxa.dev/robots.txt')
+        }));
+        const body = await response.text();
+        expect(body).toContain('User-agent: GPTBot');
+        expect(body).toContain('User-agent: ClaudeBot');
+        expect(body).toContain('User-agent: PerplexityBot');
+    });
+});

package/dist/site/schema.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/site/schema.test.js

@@ -0,0 +1,95 @@
+import { describe, it, expect } from 'vitest';
+import { generateWebSiteSchema, generatePersonSchema, generateOrganizationSchema, generateSoftwareApplicationSchema, generateSoftwareSourceCodeSchema, generateArticleSchema, generateBreadcrumbSchema } from './schema';
+import { defineSiteConfig } from './config';
+const testConfig = defineSiteConfig({
+    name: 'Yaxa App',
+    title: 'Yaxa App Title',
+    description: 'Test application description',
+    url: 'https://yaxa.test',
+    author: {
+        name: 'John Doe',
+        url: 'https://johndoe.me',
+        twitter: 'johndoe',
+        github: 'johndoe'
+    },
+    company: {
+        legalName: 'Yaxa Technologies Inc',
+        contactEmail: 'support@yaxa.test',
+        country: 'US'
+    },
+    project: {
+        license: 'MIT',
+        licenseUrl: 'https://yaxa.test/license',
+        type: 'open-source',
+        pricingModel: 'free',
+        repositoryUrl: 'https://github.com/yaxa/app',
+        isAccessibleForFree: true
+    }
+});
+describe('SEO Schema Generators', () => {
+    it('generates valid WebSite schema', () => {
+        const schema = generateWebSiteSchema(testConfig);
+        expect(schema['@context']).toBe('https://schema.org');
+        expect(schema['@type']).toBe('WebSite');
+        expect(schema.name).toBe('Yaxa App');
+        expect(schema.url).toBe('https://yaxa.test');
+        expect(schema.license).toBe('https://yaxa.test/license');
+        expect(schema.isAccessibleForFree).toBe(true);
+        expect(schema.author?.name).toBe('John Doe');
+    });
+    it('generates valid Person schema', () => {
+        const schema = generatePersonSchema(testConfig);
+        expect(schema['@type']).toBe('Person');
+        expect(schema.name).toBe('John Doe');
+        expect(schema.sameAs).toContain('https://twitter.com/johndoe');
+        expect(schema.sameAs).toContain('https://github.com/johndoe');
+    });
+    it('generates valid Organization schema', () => {
+        const schema = generateOrganizationSchema(testConfig);
+        expect(schema['@type']).toBe('Organization');
+        expect(schema.name).toBe('Yaxa App');
+        expect(schema.legalName).toBe('Yaxa Technologies Inc');
+        expect(schema.email).toBe('support@yaxa.test');
+    });
+    it('generates valid SoftwareApplication schema', () => {
+        const schema = generateSoftwareApplicationSchema(testConfig);
+        expect(schema['@type']).toBe('SoftwareApplication');
+        expect(schema.applicationCategory).toBe('DeveloperApplication');
+        expect(schema.offers?.price).toBe('0');
+    });
+    it('generates valid SoftwareSourceCode schema', () => {
+        const schema = generateSoftwareSourceCodeSchema(testConfig);
+        expect(schema['@type']).toBe('SoftwareSourceCode');
+        expect(schema.codeRepository).toBe('https://github.com/yaxa/app');
+        expect(schema.programmingLanguage).toBe('Svelte');
+    });
+    it('generates valid Article schema', () => {
+        const schema = generateArticleSchema(testConfig, {
+            title: 'Building with Svelte 5',
+            description: 'Guide to runes in Svelte 5',
+            url: 'https://yaxa.test/blog/svelte-5',
+            datePublished: '2026-01-01T00:00:00Z',
+            authorName: 'John Doe'
+        });
+        expect(schema['@type']).toBe('Article');
+        expect(schema.headline).toBe('Building with Svelte 5');
+        expect(schema.author?.name).toBe('John Doe');
+        expect(schema.publisher?.name).toBe('Yaxa App');
+    });
+    it('generates valid BreadcrumbList schema', () => {
+        const schema = generateBreadcrumbSchema(testConfig, [
+            { name: 'Home', url: '/' },
+            { name: 'Docs', url: '/docs' },
+            { name: 'Components', url: '/docs/components' }
+        ]);
+        expect(schema['@type']).toBe('BreadcrumbList');
+        expect(schema.itemListElement).toHaveLength(3);
+        expect(schema.itemListElement[0]).toEqual({
+            '@type': 'ListItem',
+            position: 1,
+            name: 'Home',
+            item: 'https://yaxa.test/'
+        });
+        expect(schema.itemListElement[2].position).toBe(3);
+    });
+});

package/dist/site/seo-helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/site/seo-helpers.test.js

@@ -0,0 +1,51 @@
+import { describe, it, expect } from 'vitest';
+import { definePageSeo } from './seo-helpers';
+describe('definePageSeo', () => {
+    it('returns the exact SEO configuration object passed to it', () => {
+        const seo = definePageSeo({
+            title: 'Test Page',
+            description: 'A test page description',
+            badge: 'Documentation'
+        });
+        expect(seo).toEqual({
+            title: 'Test Page',
+            description: 'A test page description',
+            badge: 'Documentation'
+        });
+    });
+    it('supports structured OpenGraph configuration', () => {
+        const seo = definePageSeo({
+            title: 'Analytics',
+            ogImage: {
+                title: 'Custom OG Title',
+                description: 'Custom OG Description',
+                badge: 'SaaS',
+                theme: 'dark'
+            },
+            twitterCard: 'summary_large_image'
+        });
+        expect(seo.ogImage).toEqual({
+            title: 'Custom OG Title',
+            description: 'Custom OG Description',
+            badge: 'SaaS',
+            theme: 'dark'
+        });
+        expect(seo.twitterCard).toBe('summary_large_image');
+    });
+    it('supports robots directives and schema markup', () => {
+        const schema = {
+            '@context': 'https://schema.org',
+            '@type': 'WebSite',
+            name: 'Yaxa'
+        };
+        const seo = definePageSeo({
+            title: 'Secret Page',
+            noindex: true,
+            nofollow: true,
+            schema
+        });
+        expect(seo.noindex).toBe(true);
+        expect(seo.nofollow).toBe(true);
+        expect(seo.schema).toBe(schema);
+    });
+});

package/dist/theme/theme.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/theme/theme.test.js

@@ -0,0 +1,53 @@
+import { describe, it, expect } from 'vitest';
+import { ACCENT_PALETTES, NEUTRAL_PALETTES, FONT_PRESETS, RADIUS_PRESETS, theme } from './theme.svelte';
+describe('Theme Palettes & Engine', () => {
+    const requiredShades = [50, 100, 200, 300, 400, 500, 600, 700, 800, 900, 950];
+    it('includes all 7 standard accent palettes with complete shades and ring tokens', () => {
+        const expectedAccents = [
+            'svelte',
+            'amber',
+            'emerald',
+            'sky',
+            'violet',
+            'rose',
+            'indigo'
+        ];
+        for (const accent of expectedAccents) {
+            const palette = ACCENT_PALETTES[accent];
+            expect(palette).toBeDefined();
+            expect(palette.id).toBe(accent);
+            expect(palette.color).toMatch(/^#[0-9a-fA-F]{6}$/);
+            expect(palette.shades.ring).toBeDefined();
+            for (const shade of requiredShades) {
+                expect(palette.shades[shade]).toBeDefined();
+            }
+        }
+    });
+    it('includes all 4 standard neutral palettes', () => {
+        const expectedNeutrals = ['zinc', 'slate', 'stone', 'neutral'];
+        for (const neutral of expectedNeutrals) {
+            const palette = NEUTRAL_PALETTES[neutral];
+            expect(palette).toBeDefined();
+            expect(palette.name).toBeDefined();
+            for (const shade of requiredShades) {
+                expect(palette.shades[shade]).toBeDefined();
+            }
+        }
+    });
+    it('provides font presets and radius presets', () => {
+        expect(FONT_PRESETS.sans.value).toBeDefined();
+        expect(FONT_PRESETS.serif.value).toBeDefined();
+        expect(FONT_PRESETS.mono.value).toBeDefined();
+        expect(RADIUS_PRESETS.sharp.value).toBe('0px');
+        expect(RADIUS_PRESETS.rounded.value).toBe('0.75rem');
+        expect(RADIUS_PRESETS.pill.value).toBe('1.25rem');
+    });
+    it('updates theme state reactively via theme methods', () => {
+        theme.setAccent('emerald');
+        expect(theme.accent).toBe('emerald');
+        theme.setNeutral('stone');
+        expect(theme.neutral).toBe('stone');
+        theme.setMode('dark');
+        expect(theme.mode).toBe('dark');
+    });
+});

package/dist/utils/cn.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/cn.test.js

@@ -0,0 +1,37 @@
+import { describe, it, expect } from 'vitest';
+import { cn, tv } from './cn';
+describe('cn utility', () => {
+    it('merges class names and handles conditional classes', () => {
+        const isEnabled = true;
+        const isDisabled = false;
+        const result = cn('px-4 py-2', isEnabled && 'bg-red-500', isDisabled && 'text-white', null, undefined);
+        expect(result).toBe('px-4 py-2 bg-red-500');
+    });
+    it('resolves conflicting Tailwind CSS classes correctly', () => {
+        const result = cn('px-4 px-8 text-sm text-lg');
+        expect(result).toBe('px-8 text-lg');
+    });
+});
+describe('tv utility', () => {
+    it('generates variant classes accurately', () => {
+        const button = tv({
+            base: 'rounded font-bold',
+            variants: {
+                color: {
+                    primary: 'bg-blue-500 text-white',
+                    secondary: 'bg-gray-500 text-black'
+                },
+                size: {
+                    sm: 'text-sm p-1',
+                    md: 'text-base p-2'
+                }
+            },
+            defaultVariants: {
+                color: 'primary',
+                size: 'md'
+            }
+        });
+        expect(button()).toContain('rounded font-bold bg-blue-500 text-white text-base p-2');
+        expect(button({ color: 'secondary', size: 'sm' })).toContain('rounded font-bold bg-gray-500 text-black text-sm p-1');
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaxa-svelte",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "The Intuitive Svelte UI Library — Nuxt UI v4 equivalent for SvelteKit 2.7+ & Svelte 5 with automated SEO, dynamic OpenGraph cards, sitemaps, robots.txt, and Tailwind CSS v4.",
   "license": "MIT",
   "homepage": "https://yaxa.vercel.app",
@@ -54,8 +54,9 @@
       "default": "./dist/server/index.js"
     },
     "./auth": {
-      "types": "./dist/server/auth/index.d.ts",
-      "default": "./dist/server/auth/index.js"
+      "types": "./dist/auth/index.d.ts",
+      "svelte": "./dist/auth/index.js",
+      "default": "./dist/auth/index.js"
     },
     "./db": {
       "types": "./dist/server/db/index.d.ts",
@@ -114,17 +115,16 @@
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.60.1",
     "unplugin-icons": "^23.0.1",
-    "vite": "^8.0.16"
+    "vite": "^8.0.16",
+    "vitest": "^5.0.0",
+    "zod": "^4.5.4"
   },
   "dependencies": {
     "bits-ui": "^2.19.0",
-    "formsnap": "^2.0.1",
     "mode-watcher": "^1.1.0",
     "runed": "^0.37.1",
     "svelte-sonner": "^1.2.1",
-    "sveltekit-superforms": "^2.30.2",
-    "tailwind-variants": "^3.3.1",
-    "zod": "^4.5.4"
+    "tailwind-variants": "^3.3.1"
   },
   "peerDependencies": {
     "@aws-sdk/client-s3": ">=3.0.0",
@@ -137,7 +137,8 @@
     "better-auth": ">=1.7.0",
     "drizzle-orm": ">=0.45.0",
     "resend": ">=6.27.0",
-    "svelte": "^5.0.0"
+    "svelte": "^5.0.0",
+    "zod": ">=4.0.0"
   },
   "peerDependenciesMeta": {
     "@aws-sdk/client-s3": {
@@ -166,6 +167,9 @@
     },
     "resend": {
       "optional": true
+    },
+    "zod": {
+      "optional": true
     }
   },
   "scripts": {
@@ -175,7 +179,9 @@
     "preview": "vite preview",
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
     "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "lint": "prettier --check . && eslint .",
-    "format": "prettier --write ."
+    "format": "eslint --fix . && prettier --write ."
   }
 }