@absolutejs/auth 0.27.0-beta.10 → 0.27.0-beta.12

package/dist/actions.d.ts

@@ -0,0 +1,27 @@
+export type AuthEventName = 'postLogin' | 'postLogout' | 'postMfa' | 'postOauthCallback' | 'postRegister' | 'preLogin' | 'preRegister';
+export type AuthActionContext<UserType> = {
+    email?: string;
+    event: AuthEventName;
+    ip?: string;
+    metadata?: Record<string, unknown>;
+    user?: UserType;
+    userAgent?: string;
+};
+export type AuthActionResult = {
+    kind: 'deny';
+    reason: string;
+} | {
+    kind: 'pass';
+} | {
+    kind: 'redirect';
+    url: string;
+};
+export type AuthAction<UserType> = {
+    event: AuthEventName | AuthEventName[];
+    handler: (context: AuthActionContext<UserType>) => AuthActionResult | Promise<AuthActionResult>;
+    name: string;
+};
+export type AuthPipeline<UserType> = {
+    run: (event: AuthEventName, context: Omit<AuthActionContext<UserType>, 'event'>) => Promise<AuthActionResult>;
+};
+export declare const createActionPipeline: <UserType>(actions: AuthAction<UserType>[]) => AuthPipeline<UserType>;

package/dist/client/createAuthClient.d.ts

@@ -0,0 +1,258 @@
+export type AuthClientError = {
+    body: unknown;
+    message: string;
+    status: number;
+};
+export type AuthClientResult<T> = {
+    data: null;
+    error: AuthClientError;
+} | {
+    data: T;
+    error: null;
+};
+export type AuthClientRoutes = {
+    emailVerify?: string;
+    emailVerifyRequest?: string;
+    login?: string;
+    magicLinkRequest?: string;
+    magicLinkVerify?: string;
+    mfaChallenge?: string;
+    mfaSetup?: string;
+    mfaVerifySetup?: string;
+    passkeyAuthenticateOptions?: string;
+    passkeyAuthenticateVerify?: string;
+    passkeyList?: string;
+    passkeyRegisterOptions?: string;
+    passkeyRegisterVerify?: string;
+    passkeyRemove?: string;
+    passwordReset?: string;
+    passwordResetRequest?: string;
+    register?: string;
+    sessions?: string;
+    signout?: string;
+};
+export type AuthClientConfig = {
+    baseUrl?: string;
+    credentials?: RequestCredentials;
+    fetch?: typeof fetch;
+    routes?: AuthClientRoutes;
+};
+export declare const createAuthClient: ({ baseUrl, credentials, fetch: fetchImpl, routes }?: AuthClientConfig) => {
+    emailVerification: {
+        request: (body: {
+            email: string;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                ok: true;
+            };
+            error: null;
+        }>;
+        verify: (body: {
+            token: string;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                ok: true;
+            };
+            error: null;
+        }>;
+    };
+    mfa: {
+        challenge: (body: {
+            code: string;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                status: "authenticated";
+            };
+            error: null;
+        }>;
+        setup: () => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                secret: string;
+                uri: string;
+            };
+            error: null;
+        }>;
+        verifySetup: (body: {
+            code: string;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                backupCodes: string[];
+            };
+            error: null;
+        }>;
+    };
+    passkeys: {
+        authenticateOptions: () => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        authenticateVerify: (response: unknown) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                status: "authenticated";
+            };
+            error: null;
+        }>;
+        list: () => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: unknown[];
+            error: null;
+        }>;
+        registerOptions: () => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        registerVerify: (response: unknown) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                ok: true;
+            };
+            error: null;
+        }>;
+        remove: (credentialId: string) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                ok: true;
+            };
+            error: null;
+        }>;
+    };
+    passwordless: {
+        requestMagicLink: (body: {
+            email: string;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                ok: true;
+            };
+            error: null;
+        }>;
+        verifyMagicLink: (body: {
+            token: string;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                status: "authenticated";
+            };
+            error: null;
+        }>;
+    };
+    passwordReset: {
+        confirm: (body: {
+            password: string;
+            token: string;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                ok: true;
+            };
+            error: null;
+        }>;
+        request: (body: {
+            email: string;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                ok: true;
+            };
+            error: null;
+        }>;
+    };
+    sessions: {
+        list: () => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: unknown[];
+            error: null;
+        }>;
+        revoke: (sessionId: string) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                ok: true;
+            };
+            error: null;
+        }>;
+    };
+    signIn: {
+        email: (body: {
+            email: string;
+            password: string;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                passwordCompromised?: boolean;
+                status: "authenticated" | "mfa_required";
+            };
+            error: null;
+        }>;
+    };
+    signUp: {
+        email: (body: {
+            email: string;
+            password: string;
+            [extra: string]: unknown;
+        }) => Promise<{
+            data: null;
+            error: AuthClientError;
+        } | {
+            data: {
+                status: "authenticated";
+            } | {
+                status: "verification_required";
+            };
+            error: null;
+        }>;
+    };
+    signOut: () => Promise<{
+        data: null;
+        error: AuthClientError;
+    } | {
+        data: {
+            ok: true;
+        } | null;
+        error: null;
+    }>;
+};
+export type AuthClient = ReturnType<typeof createAuthClient>;

package/dist/client/index.d.ts

@@ -0,0 +1 @@
+export * from './createAuthClient';

package/dist/client/index.js

@@ -0,0 +1,127 @@
+// @bun
+// src/client/createAuthClient.ts
+var DEFAULT_ROUTES = {
+  emailVerify: "/auth/verify-email",
+  emailVerifyRequest: "/auth/verify-email/request",
+  login: "/auth/login",
+  magicLinkRequest: "/auth/passwordless/magic-link",
+  magicLinkVerify: "/auth/passwordless/magic-link/verify",
+  mfaChallenge: "/auth/mfa/totp/challenge",
+  mfaSetup: "/auth/mfa/totp/setup",
+  mfaVerifySetup: "/auth/mfa/totp/verify",
+  passkeyAuthenticateOptions: "/auth/webauthn/authenticate/options",
+  passkeyAuthenticateVerify: "/auth/webauthn/authenticate/verify",
+  passkeyList: "/auth/webauthn/credentials",
+  passkeyRegisterOptions: "/auth/webauthn/register/options",
+  passkeyRegisterVerify: "/auth/webauthn/register/verify",
+  passkeyRemove: "/auth/webauthn/credentials",
+  passwordReset: "/auth/reset-password",
+  passwordResetRequest: "/auth/reset-password/request",
+  register: "/auth/register",
+  sessions: "/auth/sessions",
+  signout: "/auth/signout"
+};
+var succeed = (data) => ({
+  data,
+  error: null
+});
+var fail = (error) => ({
+  data: null,
+  error
+});
+var errorFor = (response, body) => ({
+  body,
+  message: typeof body === "string" ? body : readMessage(body) ?? response.statusText,
+  status: response.status
+});
+var createAuthClient = ({
+  baseUrl = "",
+  credentials = "same-origin",
+  fetch: fetchImpl = fetch,
+  routes
+} = {}) => {
+  const resolvedRoutes = {
+    ...DEFAULT_ROUTES,
+    ...routes
+  };
+  const request = async (path, init) => {
+    try {
+      const response = await fetchImpl(`${baseUrl}${path}`, {
+        credentials,
+        ...init
+      });
+      const text = await response.text();
+      const body = text === "" ? null : safeJson(text);
+      if (!response.ok)
+        return fail(errorFor(response, body));
+      return succeed(body);
+    } catch (caught) {
+      const message = caught instanceof Error ? caught.message : "network";
+      return fail({ body: null, message, status: 0 });
+    }
+  };
+  const post = (path, body, method = "POST") => request(path, {
+    body: body === undefined ? undefined : JSON.stringify(body),
+    headers: body === undefined ? undefined : { "content-type": "application/json" },
+    method
+  });
+  const get = (path) => request(path, { method: "GET" });
+  const del = (path) => request(path, { method: "DELETE" });
+  return {
+    emailVerification: {
+      request: (body) => post(resolvedRoutes.emailVerifyRequest, body),
+      verify: (body) => post(resolvedRoutes.emailVerify, body)
+    },
+    mfa: {
+      challenge: (body) => post(resolvedRoutes.mfaChallenge, body),
+      setup: () => post(resolvedRoutes.mfaSetup),
+      verifySetup: (body) => post(resolvedRoutes.mfaVerifySetup, body)
+    },
+    passkeys: {
+      authenticateOptions: () => post(resolvedRoutes.passkeyAuthenticateOptions),
+      authenticateVerify: (response) => post(resolvedRoutes.passkeyAuthenticateVerify, response),
+      list: () => get(resolvedRoutes.passkeyList),
+      registerOptions: () => post(resolvedRoutes.passkeyRegisterOptions),
+      registerVerify: (response) => post(resolvedRoutes.passkeyRegisterVerify, response),
+      remove: (credentialId) => del(`${resolvedRoutes.passkeyRemove}/${encodeURIComponent(credentialId)}`)
+    },
+    passwordless: {
+      requestMagicLink: (body) => post(resolvedRoutes.magicLinkRequest, body),
+      verifyMagicLink: (body) => post(resolvedRoutes.magicLinkVerify, body)
+    },
+    passwordReset: {
+      confirm: (body) => post(resolvedRoutes.passwordReset, body),
+      request: (body) => post(resolvedRoutes.passwordResetRequest, body)
+    },
+    sessions: {
+      list: () => get(resolvedRoutes.sessions),
+      revoke: (sessionId) => del(`${resolvedRoutes.sessions}/${encodeURIComponent(sessionId)}`)
+    },
+    signIn: {
+      email: (body) => post(resolvedRoutes.login, body)
+    },
+    signUp: {
+      email: (body) => post(resolvedRoutes.register, body)
+    },
+    signOut: () => post(resolvedRoutes.signout)
+  };
+};
+var safeJson = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+};
+var readMessage = (body) => {
+  if (typeof body !== "object" || body === null)
+    return;
+  const message = Reflect.get(body, "message");
+  return typeof message === "string" ? message : undefined;
+};
+export {
+  createAuthClient
+};
+
+//# debugId=AA9996133C04E1BA64756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/client/createAuthClient.ts"],
+  "sourcesContent": [
+    "// Framework-agnostic client SDK over the auth endpoints. Thin fetch wrappers with\n// configurable routes, a uniform `{ data, error }` return, and same-origin cookies on by\n// default — the primitive the React hooks (`./react`) and future Vue/Solid composables wrap.\n// HTMX is the special case (declarative server fragments via `./htmx`); for every other UI\n// framework the natural primitive is this client + your framework's reactivity.\n\nexport type AuthClientError = {\n\tbody: unknown;\n\tmessage: string;\n\tstatus: number;\n};\n\nexport type AuthClientResult<T> =\n\t| { data: null; error: AuthClientError }\n\t| { data: T; error: null };\n\n// Each entry is the URL the consumer's auth() mounted that flow at. Defaults match the\n// package defaults; override to match your own custom routes.\nexport type AuthClientRoutes = {\n\temailVerify?: string;\n\temailVerifyRequest?: string;\n\tlogin?: string;\n\tmagicLinkRequest?: string;\n\tmagicLinkVerify?: string;\n\tmfaChallenge?: string;\n\tmfaSetup?: string;\n\tmfaVerifySetup?: string;\n\tpasskeyAuthenticateOptions?: string;\n\tpasskeyAuthenticateVerify?: string;\n\tpasskeyList?: string;\n\tpasskeyRegisterOptions?: string;\n\tpasskeyRegisterVerify?: string;\n\tpasskeyRemove?: string;\n\tpasswordReset?: string;\n\tpasswordResetRequest?: string;\n\tregister?: string;\n\tsessions?: string;\n\tsignout?: string;\n};\n\nconst DEFAULT_ROUTES: Required<AuthClientRoutes> = {\n\temailVerify: '/auth/verify-email',\n\temailVerifyRequest: '/auth/verify-email/request',\n\tlogin: '/auth/login',\n\tmagicLinkRequest: '/auth/passwordless/magic-link',\n\tmagicLinkVerify: '/auth/passwordless/magic-link/verify',\n\tmfaChallenge: '/auth/mfa/totp/challenge',\n\tmfaSetup: '/auth/mfa/totp/setup',\n\tmfaVerifySetup: '/auth/mfa/totp/verify',\n\tpasskeyAuthenticateOptions: '/auth/webauthn/authenticate/options',\n\tpasskeyAuthenticateVerify: '/auth/webauthn/authenticate/verify',\n\tpasskeyList: '/auth/webauthn/credentials',\n\tpasskeyRegisterOptions: '/auth/webauthn/register/options',\n\tpasskeyRegisterVerify: '/auth/webauthn/register/verify',\n\tpasskeyRemove: '/auth/webauthn/credentials',\n\tpasswordReset: '/auth/reset-password',\n\tpasswordResetRequest: '/auth/reset-password/request',\n\tregister: '/auth/register',\n\tsessions: '/auth/sessions',\n\tsignout: '/auth/signout'\n};\n\nexport type AuthClientConfig = {\n\tbaseUrl?: string;\n\tcredentials?: RequestCredentials;\n\tfetch?: typeof fetch;\n\troutes?: AuthClientRoutes;\n};\n\nconst succeed = <T>(data: T): AuthClientResult<T> => ({\n\tdata,\n\terror: null\n});\n\nconst fail = (error: AuthClientError): AuthClientResult<never> => ({\n\tdata: null,\n\terror\n});\n\nconst errorFor = (response: Response, body: unknown): AuthClientError => ({\n\tbody,\n\tmessage:\n\t\ttypeof body === 'string'\n\t\t\t? body\n\t\t\t: (readMessage(body) ?? response.statusText),\n\tstatus: response.status\n});\n\nexport const createAuthClient = ({\n\tbaseUrl = '',\n\tcredentials = 'same-origin',\n\tfetch: fetchImpl = fetch,\n\troutes\n}: AuthClientConfig = {}) => {\n\tconst resolvedRoutes: Required<AuthClientRoutes> = {\n\t\t...DEFAULT_ROUTES,\n\t\t...routes\n\t};\n\n\tconst request = async <T>(path: string, init: RequestInit) => {\n\t\ttry {\n\t\t\tconst response = await fetchImpl(`${baseUrl}${path}`, {\n\t\t\t\tcredentials,\n\t\t\t\t...init\n\t\t\t});\n\t\t\tconst text = await response.text();\n\t\t\tconst body: unknown = text === '' ? null : safeJson(text);\n\t\t\tif (!response.ok) return fail(errorFor(response, body));\n\n\t\t\t// Trust the caller's expectation at the deserialization boundary.\n\t\t\t// eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- HTTP response is unknown until parsed; the call site declares the expected T\n\t\t\treturn succeed(body as T);\n\t\t} catch (caught) {\n\t\t\tconst message = caught instanceof Error ? caught.message : 'network';\n\n\t\t\treturn fail({ body: null, message, status: 0 });\n\t\t}\n\t};\n\n\tconst post = <T>(path: string, body?: unknown, method = 'POST') =>\n\t\trequest<T>(path, {\n\t\t\tbody: body === undefined ? undefined : JSON.stringify(body),\n\t\t\theaders:\n\t\t\t\tbody === undefined ? undefined : { 'content-type': 'application/json' },\n\t\t\tmethod\n\t\t});\n\n\tconst get = <T>(path: string) => request<T>(path, { method: 'GET' });\n\n\tconst del = <T>(path: string) => request<T>(path, { method: 'DELETE' });\n\n\treturn {\n\t\temailVerification: {\n\t\t\trequest: (body: { email: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.emailVerifyRequest, body),\n\t\t\tverify: (body: { token: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.emailVerify, body)\n\t\t},\n\t\tmfa: {\n\t\t\tchallenge: (body: { code: string }) =>\n\t\t\t\tpost<{ status: 'authenticated' }>(resolvedRoutes.mfaChallenge, body),\n\t\t\tsetup: () =>\n\t\t\t\tpost<{ secret: string; uri: string }>(resolvedRoutes.mfaSetup),\n\t\t\tverifySetup: (body: { code: string }) =>\n\t\t\t\tpost<{ backupCodes: string[] }>(\n\t\t\t\t\tresolvedRoutes.mfaVerifySetup,\n\t\t\t\t\tbody\n\t\t\t\t)\n\t\t},\n\t\tpasskeys: {\n\t\t\tauthenticateOptions: () =>\n\t\t\t\tpost<unknown>(resolvedRoutes.passkeyAuthenticateOptions),\n\t\t\tauthenticateVerify: (response: unknown) =>\n\t\t\t\tpost<{ status: 'authenticated' }>(\n\t\t\t\t\tresolvedRoutes.passkeyAuthenticateVerify,\n\t\t\t\t\tresponse\n\t\t\t\t),\n\t\t\tlist: () => get<unknown[]>(resolvedRoutes.passkeyList),\n\t\t\tregisterOptions: () =>\n\t\t\t\tpost<unknown>(resolvedRoutes.passkeyRegisterOptions),\n\t\t\tregisterVerify: (response: unknown) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.passkeyRegisterVerify, response),\n\t\t\tremove: (credentialId: string) =>\n\t\t\t\tdel<{ ok: true }>(\n\t\t\t\t\t`${resolvedRoutes.passkeyRemove}/${encodeURIComponent(credentialId)}`\n\t\t\t\t)\n\t\t},\n\t\tpasswordless: {\n\t\t\trequestMagicLink: (body: { email: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.magicLinkRequest, body),\n\t\t\tverifyMagicLink: (body: { token: string }) =>\n\t\t\t\tpost<{ status: 'authenticated' }>(\n\t\t\t\t\tresolvedRoutes.magicLinkVerify,\n\t\t\t\t\tbody\n\t\t\t\t)\n\t\t},\n\t\tpasswordReset: {\n\t\t\tconfirm: (body: { password: string; token: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.passwordReset, body),\n\t\t\trequest: (body: { email: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.passwordResetRequest, body)\n\t\t},\n\t\tsessions: {\n\t\t\tlist: () => get<unknown[]>(resolvedRoutes.sessions),\n\t\t\trevoke: (sessionId: string) =>\n\t\t\t\tdel<{ ok: true }>(\n\t\t\t\t\t`${resolvedRoutes.sessions}/${encodeURIComponent(sessionId)}`\n\t\t\t\t)\n\t\t},\n\t\tsignIn: {\n\t\t\temail: (body: { email: string; password: string }) =>\n\t\t\t\tpost<{\n\t\t\t\t\tpasswordCompromised?: boolean;\n\t\t\t\t\tstatus: 'authenticated' | 'mfa_required';\n\t\t\t\t}>(resolvedRoutes.login, body)\n\t\t},\n\t\tsignUp: {\n\t\t\temail: (body: {\n\t\t\t\temail: string;\n\t\t\t\tpassword: string;\n\t\t\t\t[extra: string]: unknown;\n\t\t\t}) =>\n\t\t\t\tpost<\n\t\t\t\t\t| { status: 'authenticated' }\n\t\t\t\t\t| { status: 'verification_required' }\n\t\t\t\t>(resolvedRoutes.register, body)\n\t\t},\n\t\tsignOut: () => post<{ ok: true } | null>(resolvedRoutes.signout)\n\t};\n};\n\nconst safeJson = (text: string) => {\n\ttry {\n\t\t// eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- deserialization boundary\n\t\treturn JSON.parse(text) as unknown;\n\t} catch {\n\t\treturn text;\n\t}\n};\n\nconst readMessage = (body: unknown) => {\n\tif (typeof body !== 'object' || body === null) return undefined;\n\tconst message: unknown = Reflect.get(body, 'message');\n\n\treturn typeof message === 'string' ? message : undefined;\n};\n\nexport type AuthClient = ReturnType<typeof createAuthClient>;\n"
+  ],
+  "mappings": ";;AAwCA,IAAM,iBAA6C;AAAA,EAClD,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,OAAO;AAAA,EACP,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,4BAA4B;AAAA,EAC5B,2BAA2B;AAAA,EAC3B,aAAa;AAAA,EACb,wBAAwB;AAAA,EACxB,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AACV;AASA,IAAM,UAAU,CAAI,UAAkC;AAAA,EACrD;AAAA,EACA,OAAO;AACR;AAEA,IAAM,OAAO,CAAC,WAAqD;AAAA,EAClE,MAAM;AAAA,EACN;AACD;AAEA,IAAM,WAAW,CAAC,UAAoB,UAAoC;AAAA,EACzE;AAAA,EACA,SACC,OAAO,SAAS,WACb,OACC,YAAY,IAAI,KAAK,SAAS;AAAA,EACnC,QAAQ,SAAS;AAClB;AAEO,IAAM,mBAAmB;AAAA,EAC/B,UAAU;AAAA,EACV,cAAc;AAAA,EACd,OAAO,YAAY;AAAA,EACnB;AAAA,IACqB,CAAC,MAAM;AAAA,EAC5B,MAAM,iBAA6C;AAAA,OAC/C;AAAA,OACA;AAAA,EACJ;AAAA,EAEA,MAAM,UAAU,OAAU,MAAc,SAAsB;AAAA,IAC7D,IAAI;AAAA,MACH,MAAM,WAAW,MAAM,UAAU,GAAG,UAAU,QAAQ;AAAA,QACrD;AAAA,WACG;AAAA,MACJ,CAAC;AAAA,MACD,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,MACjC,MAAM,OAAgB,SAAS,KAAK,OAAO,SAAS,IAAI;AAAA,MACxD,IAAI,CAAC,SAAS;AAAA,QAAI,OAAO,KAAK,SAAS,UAAU,IAAI,CAAC;AAAA,MAItD,OAAO,QAAQ,IAAS;AAAA,MACvB,OAAO,QAAQ;AAAA,MAChB,MAAM,UAAU,kBAAkB,QAAQ,OAAO,UAAU;AAAA,MAE3D,OAAO,KAAK,EAAE,MAAM,MAAM,SAAS,QAAQ,EAAE,CAAC;AAAA;AAAA;AAAA,EAIhD,MAAM,OAAO,CAAI,MAAc,MAAgB,SAAS,WACvD,QAAW,MAAM;AAAA,IAChB,MAAM,SAAS,YAAY,YAAY,KAAK,UAAU,IAAI;AAAA,IAC1D,SACC,SAAS,YAAY,YAAY,EAAE,gBAAgB,mBAAmB;AAAA,IACvE;AAAA,EACD,CAAC;AAAA,EAEF,MAAM,MAAM,CAAI,SAAiB,QAAW,MAAM,EAAE,QAAQ,MAAM,CAAC;AAAA,EAEnE,MAAM,MAAM,CAAI,SAAiB,QAAW,MAAM,EAAE,QAAQ,SAAS,CAAC;AAAA,EAEtE,OAAO;AAAA,IACN,mBAAmB;AAAA,MAClB,SAAS,CAAC,SACT,KAAmB,eAAe,oBAAoB,IAAI;AAAA,MAC3D,QAAQ,CAAC,SACR,KAAmB,eAAe,aAAa,IAAI;AAAA,IACrD;AAAA,IACA,KAAK;AAAA,MACJ,WAAW,CAAC,SACX,KAAkC,eAAe,cAAc,IAAI;AAAA,MACpE,OAAO,MACN,KAAsC,eAAe,QAAQ;AAAA,MAC9D,aAAa,CAAC,SACb,KACC,eAAe,gBACf,IACD;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACT,qBAAqB,MACpB,KAAc,eAAe,0BAA0B;AAAA,MACxD,oBAAoB,CAAC,aACpB,KACC,eAAe,2BACf,QACD;AAAA,MACD,MAAM,MAAM,IAAe,eAAe,WAAW;AAAA,MACrD,iBAAiB,MAChB,KAAc,eAAe,sBAAsB;AAAA,MACpD,gBAAgB,CAAC,aAChB,KAAmB,eAAe,uBAAuB,QAAQ;AAAA,MAClE,QAAQ,CAAC,iBACR,IACC,GAAG,eAAe,iBAAiB,mBAAmB,YAAY,GACnE;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACb,kBAAkB,CAAC,SAClB,KAAmB,eAAe,kBAAkB,IAAI;AAAA,MACzD,iBAAiB,CAAC,SACjB,KACC,eAAe,iBACf,IACD;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACd,SAAS,CAAC,SACT,KAAmB,eAAe,eAAe,IAAI;AAAA,MACtD,SAAS,CAAC,SACT,KAAmB,eAAe,sBAAsB,IAAI;AAAA,IAC9D;AAAA,IACA,UAAU;AAAA,MACT,MAAM,MAAM,IAAe,eAAe,QAAQ;AAAA,MAClD,QAAQ,CAAC,cACR,IACC,GAAG,eAAe,YAAY,mBAAmB,SAAS,GAC3D;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACP,OAAO,CAAC,SACP,KAGG,eAAe,OAAO,IAAI;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,MACP,OAAO,CAAC,SAKP,KAGE,eAAe,UAAU,IAAI;AAAA,IACjC;AAAA,IACA,SAAS,MAAM,KAA0B,eAAe,OAAO;AAAA,EAChE;AAAA;AAGD,IAAM,WAAW,CAAC,SAAiB;AAAA,EAClC,IAAI;AAAA,IAEH,OAAO,KAAK,MAAM,IAAI;AAAA,IACrB,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAIT,IAAM,cAAc,CAAC,SAAkB;AAAA,EACtC,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,UAAmB,QAAQ,IAAI,MAAM,SAAS;AAAA,EAEpD,OAAO,OAAO,YAAY,WAAW,UAAU;AAAA;",
+  "debugId": "AA9996133C04E1BA64756E2164756E21",
+  "names": []
+}

package/dist/client/react.d.ts

@@ -0,0 +1,62 @@
+import type { AuthClient, AuthClientError } from './createAuthClient';
+type Mutator<Args, Data> = (args: Args) => Promise<{
+    data: Data | null;
+    error: AuthClientError | null;
+}>;
+type MutationState<Args, Data> = {
+    data: Data | null;
+    error: AuthClientError | null;
+    isPending: boolean;
+    mutate: Mutator<Args, Data>;
+    reset: () => void;
+};
+export declare const useMagicLink: (client: AuthClient) => MutationState<{
+    email: string;
+}, {
+    ok: true;
+}>;
+export declare const useMfaChallenge: (client: AuthClient) => MutationState<{
+    code: string;
+}, {
+    status: "authenticated";
+}>;
+export declare const usePasswordReset: (client: AuthClient) => MutationState<{
+    email: string;
+}, {
+    ok: true;
+}>;
+export declare const useSessions: (client: AuthClient) => {
+    data: unknown[] | null;
+    error: AuthClientError | null;
+    isPending: boolean;
+    refetch: () => Promise<void>;
+    revoke: (sessionId: string) => Promise<{
+        data: null;
+        error: AuthClientError;
+    } | {
+        data: {
+            ok: true;
+        };
+        error: null;
+    }>;
+};
+export declare const useSignIn: (client: AuthClient) => MutationState<{
+    email: string;
+    password: string;
+}, {
+    passwordCompromised?: boolean;
+    status: "authenticated" | "mfa_required";
+}>;
+export declare const useSignOut: (client: AuthClient) => MutationState<unknown, {
+    ok: true;
+}>;
+export declare const useSignUp: (client: AuthClient) => MutationState<{
+    [extra: string]: unknown;
+    email: string;
+    password: string;
+}, {
+    status: "authenticated";
+} | {
+    status: "verification_required";
+}>;
+export {};

package/dist/client/react.js

@@ -0,0 +1,75 @@
+// @bun
+// src/client/react.ts
+import { useCallback, useEffect, useRef, useState } from "react";
+var useMutation = (run) => {
+  const [data, setData] = useState(null);
+  const [error, setError] = useState(null);
+  const [isPending, setIsPending] = useState(false);
+  const mountedRef = useRef(true);
+  useEffect(() => () => {
+    mountedRef.current = false;
+  }, []);
+  const mutate = useCallback(async (args) => {
+    setIsPending(true);
+    setError(null);
+    const result = await run(args);
+    if (mountedRef.current) {
+      setData(result.data);
+      setError(result.error);
+      setIsPending(false);
+    }
+    return result;
+  }, [run]);
+  const reset = useCallback(() => {
+    setData(null);
+    setError(null);
+    setIsPending(false);
+  }, []);
+  return { data, error, isPending, mutate, reset };
+};
+var useMagicLink = (client) => useMutation(client.passwordless.requestMagicLink);
+var useMfaChallenge = (client) => useMutation(client.mfa.challenge);
+var usePasswordReset = (client) => useMutation(client.passwordReset.request);
+var useSessions = (client) => {
+  const [data, setData] = useState(null);
+  const [error, setError] = useState(null);
+  const [isPending, setIsPending] = useState(true);
+  const mountedRef = useRef(true);
+  useEffect(() => () => {
+    mountedRef.current = false;
+  }, []);
+  const refetch = useCallback(async () => {
+    setIsPending(true);
+    const result = await client.sessions.list();
+    if (mountedRef.current) {
+      setData(result.data);
+      setError(result.error);
+      setIsPending(false);
+    }
+  }, [client]);
+  useEffect(() => {
+    refetch();
+  }, [refetch]);
+  const revoke = useCallback(async (sessionId) => {
+    const result = await client.sessions.revoke(sessionId);
+    if (result.error === null)
+      await refetch();
+    return result;
+  }, [client, refetch]);
+  return { data, error, isPending, refetch, revoke };
+};
+var useSignIn = (client) => useMutation(client.signIn.email);
+var useSignOut = (client) => useMutation(client.signOut);
+var useSignUp = (client) => useMutation(client.signUp.email);
+export {
+  useSignUp,
+  useSignOut,
+  useSignIn,
+  useSessions,
+  usePasswordReset,
+  useMfaChallenge,
+  useMagicLink
+};
+
+//# debugId=6E80ACAADF4D834764756E2164756E21
+//# sourceMappingURL=react.js.map

package/dist/client/react.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/client/react.ts"],
+  "sourcesContent": [
+    "// Thin React hooks over `createAuthClient`. Same `{ data, error }` shape; the hook adds\n// `isPending` state and a stable mutator. Bring your own form/UI — these are primitives, not\n// components. Composables (Vue/Solid/Svelte) will follow the same pattern over the same client.\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport type { AuthClient, AuthClientError } from './createAuthClient';\n\ntype Mutator<Args, Data> = (\n\targs: Args\n) => Promise<{ data: Data | null; error: AuthClientError | null }>;\n\ntype MutationState<Args, Data> = {\n\tdata: Data | null;\n\terror: AuthClientError | null;\n\tisPending: boolean;\n\tmutate: Mutator<Args, Data>;\n\treset: () => void;\n};\n\n// Generic mutation hook. The other hooks are 1–2 line specializations of this — kept private\n// here so consumers see the cohesive named API and don't depend on this shape.\nconst useMutation = <Args, Data>(\n\trun: Mutator<Args, Data>\n): MutationState<Args, Data> => {\n\tconst [data, setData] = useState<Data | null>(null);\n\tconst [error, setError] = useState<AuthClientError | null>(null);\n\tconst [isPending, setIsPending] = useState(false);\n\tconst mountedRef = useRef(true);\n\tuseEffect(\n\t\t() => () => {\n\t\t\tmountedRef.current = false;\n\t\t},\n\t\t[]\n\t);\n\n\tconst mutate: Mutator<Args, Data> = useCallback(\n\t\tasync (args) => {\n\t\t\tsetIsPending(true);\n\t\t\tsetError(null);\n\t\t\tconst result = await run(args);\n\t\t\tif (mountedRef.current) {\n\t\t\t\tsetData(result.data);\n\t\t\t\tsetError(result.error);\n\t\t\t\tsetIsPending(false);\n\t\t\t}\n\n\t\t\treturn result;\n\t\t},\n\t\t[run]\n\t);\n\n\tconst reset = useCallback(() => {\n\t\tsetData(null);\n\t\tsetError(null);\n\t\tsetIsPending(false);\n\t}, []);\n\n\treturn { data, error, isPending, mutate, reset };\n};\n\nexport const useMagicLink = (client: AuthClient) =>\n\tuseMutation(client.passwordless.requestMagicLink);\n\nexport const useMfaChallenge = (client: AuthClient) =>\n\tuseMutation(client.mfa.challenge);\n\nexport const usePasswordReset = (client: AuthClient) =>\n\tuseMutation(client.passwordReset.request);\n\n// Query hook for the user's active sessions; refetch() reruns it. The shape matches the\n// mutation hooks closely (isPending/error/data) so the consumer can render one way.\nexport const useSessions = (client: AuthClient) => {\n\tconst [data, setData] = useState<unknown[] | null>(null);\n\tconst [error, setError] = useState<AuthClientError | null>(null);\n\tconst [isPending, setIsPending] = useState(true);\n\tconst mountedRef = useRef(true);\n\tuseEffect(\n\t\t() => () => {\n\t\t\tmountedRef.current = false;\n\t\t},\n\t\t[]\n\t);\n\n\tconst refetch = useCallback(async () => {\n\t\tsetIsPending(true);\n\t\tconst result = await client.sessions.list();\n\t\tif (mountedRef.current) {\n\t\t\tsetData(result.data);\n\t\t\tsetError(result.error);\n\t\t\tsetIsPending(false);\n\t\t}\n\t}, [client]);\n\n\tuseEffect(() => {\n\t\tvoid refetch();\n\t}, [refetch]);\n\n\tconst revoke = useCallback(\n\t\tasync (sessionId: string) => {\n\t\t\tconst result = await client.sessions.revoke(sessionId);\n\t\t\tif (result.error === null) await refetch();\n\n\t\t\treturn result;\n\t\t},\n\t\t[client, refetch]\n\t);\n\n\treturn { data, error, isPending, refetch, revoke };\n};\n\nexport const useSignIn = (client: AuthClient) =>\n\tuseMutation(client.signIn.email);\n\nexport const useSignOut = (client: AuthClient) => useMutation(client.signOut);\n\nexport const useSignUp = (client: AuthClient) =>\n\tuseMutation(client.signUp.email);\n"
+  ],
+  "mappings": ";;AAIA;AAiBA,IAAM,cAAc,CACnB,QAC+B;AAAA,EAC/B,OAAO,MAAM,WAAW,SAAsB,IAAI;AAAA,EAClD,OAAO,OAAO,YAAY,SAAiC,IAAI;AAAA,EAC/D,OAAO,WAAW,gBAAgB,SAAS,KAAK;AAAA,EAChD,MAAM,aAAa,OAAO,IAAI;AAAA,EAC9B,UACC,MAAM,MAAM;AAAA,IACX,WAAW,UAAU;AAAA,KAEtB,CAAC,CACF;AAAA,EAEA,MAAM,SAA8B,YACnC,OAAO,SAAS;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,SAAS,IAAI;AAAA,IACb,MAAM,SAAS,MAAM,IAAI,IAAI;AAAA,IAC7B,IAAI,WAAW,SAAS;AAAA,MACvB,QAAQ,OAAO,IAAI;AAAA,MACnB,SAAS,OAAO,KAAK;AAAA,MACrB,aAAa,KAAK;AAAA,IACnB;AAAA,IAEA,OAAO;AAAA,KAER,CAAC,GAAG,CACL;AAAA,EAEA,MAAM,QAAQ,YAAY,MAAM;AAAA,IAC/B,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI;AAAA,IACb,aAAa,KAAK;AAAA,KAChB,CAAC,CAAC;AAAA,EAEL,OAAO,EAAE,MAAM,OAAO,WAAW,QAAQ,MAAM;AAAA;AAGzC,IAAM,eAAe,CAAC,WAC5B,YAAY,OAAO,aAAa,gBAAgB;AAE1C,IAAM,kBAAkB,CAAC,WAC/B,YAAY,OAAO,IAAI,SAAS;AAE1B,IAAM,mBAAmB,CAAC,WAChC,YAAY,OAAO,cAAc,OAAO;AAIlC,IAAM,cAAc,CAAC,WAAuB;AAAA,EAClD,OAAO,MAAM,WAAW,SAA2B,IAAI;AAAA,EACvD,OAAO,OAAO,YAAY,SAAiC,IAAI;AAAA,EAC/D,OAAO,WAAW,gBAAgB,SAAS,IAAI;AAAA,EAC/C,MAAM,aAAa,OAAO,IAAI;AAAA,EAC9B,UACC,MAAM,MAAM;AAAA,IACX,WAAW,UAAU;AAAA,KAEtB,CAAC,CACF;AAAA,EAEA,MAAM,UAAU,YAAY,YAAY;AAAA,IACvC,aAAa,IAAI;AAAA,IACjB,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK;AAAA,IAC1C,IAAI,WAAW,SAAS;AAAA,MACvB,QAAQ,OAAO,IAAI;AAAA,MACnB,SAAS,OAAO,KAAK;AAAA,MACrB,aAAa,KAAK;AAAA,IACnB;AAAA,KACE,CAAC,MAAM,CAAC;AAAA,EAEX,UAAU,MAAM;AAAA,IACV,QAAQ;AAAA,KACX,CAAC,OAAO,CAAC;AAAA,EAEZ,MAAM,SAAS,YACd,OAAO,cAAsB;AAAA,IAC5B,MAAM,SAAS,MAAM,OAAO,SAAS,OAAO,SAAS;AAAA,IACrD,IAAI,OAAO,UAAU;AAAA,MAAM,MAAM,QAAQ;AAAA,IAEzC,OAAO;AAAA,KAER,CAAC,QAAQ,OAAO,CACjB;AAAA,EAEA,OAAO,EAAE,MAAM,OAAO,WAAW,SAAS,OAAO;AAAA;AAG3C,IAAM,YAAY,CAAC,WACzB,YAAY,OAAO,OAAO,KAAK;AAEzB,IAAM,aAAa,CAAC,WAAuB,YAAY,OAAO,OAAO;AAErE,IAAM,YAAY,CAAC,WACzB,YAAY,OAAO,OAAO,KAAK;",
+  "debugId": "6E80ACAADF4D834764756E2164756E21",
+  "names": []
+}

package/dist/index.d.ts

@@ -13450,9 +13450,9 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
             body: unknown;
             params: {};
             query: {
-                nonce?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
+                nonce?: string | undefined;
                 code_challenge?: string | undefined;
                 code_challenge_method?: string | undefined;
                 redirect_uri?: string | undefined;
@@ -13478,10 +13478,10 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
     [x: string]: {
         post: {
             body: {
-                audience?: string | undefined;
-                resource?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
+                audience?: string | undefined;
+                resource?: string | undefined;
                 refresh_token?: string | undefined;
                 client_secret?: string | undefined;
                 grant_type?: string | undefined;
@@ -14635,8 +14635,13 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
     standaloneSchema: {};
     response: {};
 }>>;
+export * from './actions';
 export * from './types';
 export * from './typebox';
+export * from './vault/config';
+export * from './vault/types';
+export { createInMemoryVaultStore } from './vault/inMemoryVaultStore';
+export { createNeonVaultStore, createPostgresVaultStore, vaultEntriesTable } from './vault/postgresVaultStore';
 export type { AuthSessionStore } from './session/types';
 export { isAuthIntent, isUserSessionId, isValidUser } from './typeGuards';
 export { AuthIdentityConflictError } from './errors';