@absolutejs/auth 0.57.9 → 0.59.0

package/dist/types.d.ts

@@ -12,6 +12,7 @@ import type { AuthIdentityConflict } from './errors';
 import type { AuthHtmxConfig, AuthHtmxUser } from './htmx/types';
 import type { LockoutConfig } from './lockout/config';
 import type { MfaConfig } from './mfa/config';
+import type { VerificationProvider } from './verification/types';
 import type { OidcProviderConfig } from './oidc/config';
 import type { OrganizationsConfig } from './organizations/config';
 import type { PasswordlessConfig } from './passwordless/config';
@@ -286,7 +287,7 @@ export type AuthConfig<UserType> = {
      *  mounts register / verify-email / login / reset-password routes that produce the
      *  same `SessionData<UserType>` as OAuth, transparent to `protectRoute`. */
     credentials?: CredentialsConfig<NoInfer<UserType>>;
-    /** Passwordless login: magic links + email/SMS OTP. When present, mounts the magic-link flow
+    /** Passwordless login: magic links + email OTP. When present, mounts the magic-link flow
      *  (if `onSendMagicLink` is set) and/or the OTP flow (if `onSendOtp` is set) under
      *  `{passwordlessRoute}`; each verify route resolves the email to a user and mints the same
      *  `SessionData<UserType>` as every other flow. */
@@ -295,6 +296,9 @@ export type AuthConfig<UserType> = {
      *  `auth()` auto-wires the login MFA gate, mounts the enroll/challenge routes, and
      *  promotes the parked session once a factor is verified. */
     mfa?: MfaConfig<NoInfer<UserType>>;
+    /** Provider-managed phone verification (Twilio Verify, etc.). When absent,
+     * MFA can use the built-in locally generated code flow through onSendSmsCode. */
+    verificationProvider?: VerificationProvider;
     /** Per-identity attempt throttling + account lockout on the credential login route
      *  (progressive: locks after `maxAttempts` failures within `windowMs`). */
     lockout?: LockoutConfig;

package/dist/verification/types.d.ts

@@ -0,0 +1,58 @@
+/** Stable purposes let providers apply separate templates, limits, and audit policy. */
+export type VerificationPurpose = 'account_recovery' | 'mfa_challenge' | 'mfa_enrollment' | 'phone_change' | 'phone_signup' | 'step_up';
+export type VerificationChannel = 'call' | 'sms' | 'whatsapp';
+export type VerificationStartInput = {
+    channel: VerificationChannel;
+    /** Optional BCP-47 locale used for provider-managed message copy. */
+    locale?: string;
+    purpose: VerificationPurpose;
+    /** Provider-specific, non-secret rate-limit buckets (for example an IP hash). */
+    rateLimits?: Readonly<Record<string, string>>;
+    /** Stable application subject. Providers must not include it in message text. */
+    subject: string;
+    /** E.164 destination. */
+    to: string;
+    /** Stable tenant key used only for provider/service routing. */
+    tenant?: string;
+};
+export type VerificationStartResult = {
+    /** Provider reference safe for audit correlation (for example, a Twilio VE SID). */
+    reference: string;
+    /** Provider-authoritative expiry. Auth rejects checks after this time. */
+    expiresAt: number;
+};
+export type VerificationCheckStatus = 'approved' | 'canceled' | 'expired' | 'failed' | 'max_attempts_reached' | 'pending';
+export type VerificationCheckInput = VerificationStartInput & {
+    code: string;
+    /** Exact challenge reference returned by start(). */
+    reference: string;
+};
+export type VerificationCancelInput = VerificationStartInput & {
+    reference: string;
+};
+export type VerificationCheckResult = {
+    reference?: string;
+    status: VerificationCheckStatus;
+};
+export type VerificationProviderErrorKind = 'invalid_destination' | 'rate_limited' | 'unavailable';
+/** Normalized operational failures that auth routes can map safely to HTTP. */
+export declare class VerificationProviderError extends Error {
+    readonly kind: VerificationProviderErrorKind;
+    readonly provider: string;
+    constructor(input: {
+        cause?: unknown;
+        kind: VerificationProviderErrorKind;
+        message: string;
+        provider: string;
+    });
+}
+/**
+ * Provider-owned out-of-band challenge lifecycle. Implementations generate,
+ * deliver, rate-limit, and check codes; auth owns enrollment and session policy.
+ */
+export type VerificationProvider = {
+    readonly name: string;
+    cancel: (input: VerificationCancelInput) => Promise<void>;
+    check: (input: VerificationCheckInput) => Promise<VerificationCheckResult>;
+    start: (input: VerificationStartInput) => Promise<VerificationStartResult>;
+};

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.57.9",
+	"version": "0.59.0",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {

package/dist/agents/index.d.ts

@@ -1,13 +0,0 @@
-export * from './config';
-export * from './types';
-export * from './registration';
-export * from './registrationClient';
-export * from './idJag';
-export * from './oauthGuide';
-export * from '../oidc/clientIdMetadata';
-export { createOidcAgentCredentialVerifier } from './oidcAdapter';
-export { agentHasScopes, resolveAgentPrincipal } from './principal';
-export { agentAuthChallenge, agentAuthContextPlugin } from './context';
-export { agentAuthPlugin } from './routes';
-export { createInMemoryAgentDelegationStore, createInMemoryAgentIdentityRegistrationStore, createInMemoryAgentRegistrationStore } from './inMemoryStores';
-export { agentDelegationsTable, agentDelegationsBunSqlTable, agentIdentityRegistrationsTable, agentIdentityRegistrationsBunSqlTable, agentRegistrationsTable, agentRegistrationsBunSqlTable, createBunSqlDrizzleAgentDelegationStore, createBunSqlDrizzleAgentIdentityRegistrationStore, createBunSqlDrizzleAgentRegistrationStore, createNeonAgentDelegationStore, createNeonAgentIdentityRegistrationStore, createNeonAgentRegistrationStore, createDrizzleAgentDelegationStore, createPostgresAgentDelegationStore, createPostgresAgentIdentityRegistrationStore, createPostgresAgentRegistrationStore } from './postgresStores';

package/dist/cli/import/auth0.d.ts

@@ -1,2 +0,0 @@
-import { type Importer } from './types';
-export declare const auth0Importer: Importer;

package/dist/cli/import/clerk.d.ts

@@ -1,2 +0,0 @@
-import { type Importer } from './types';
-export declare const clerkImporter: Importer;

package/dist/cli/import/index.d.ts

@@ -1,10 +0,0 @@
-import type { ImportResult, Importer } from './types';
-export declare const importers: Record<string, Importer>;
-export type ImportOptions = {
-    commit: boolean;
-    databaseUrl: string;
-};
-export declare const runImport: (result: ImportResult, options: ImportOptions) => Promise<{
-    identityCount: number;
-    userCount: number;
-}>;

package/dist/cli/import/lucia.d.ts

@@ -1,2 +0,0 @@
-import { type Importer } from './types';
-export declare const luciaImporter: Importer;

package/dist/cli/import/nextauth.d.ts

@@ -1,2 +0,0 @@
-import { type Importer } from './types';
-export declare const nextauthImporter: Importer;

package/dist/cli/import/supabase.d.ts

@@ -1,2 +0,0 @@
-import type { Importer } from './types';
-export declare const supabaseImporter: Importer;

package/dist/cli/import/types.d.ts

@@ -1,27 +0,0 @@
-export declare const detectPasswordHashAlgorithm: (hash?: string) => ImportedUser['passwordHashAlgo'];
-export type ImportedUser = {
-    createdAtMs: number;
-    email: string;
-    emailVerified: boolean;
-    externalId: string;
-    familyName?: string;
-    givenName?: string;
-    passwordHash?: string;
-    passwordHashAlgo?: 'argon2id' | 'bcrypt' | 'scrypt' | 'pbkdf2';
-};
-export type ImportedIdentity = {
-    authProvider: string;
-    createdAtMs: number;
-    metadata?: Record<string, unknown>;
-    providerSubject: string;
-    userExternalId: string;
-};
-export type ImportResult = {
-    identities: ImportedIdentity[];
-    source: string;
-    users: ImportedUser[];
-};
-export type Importer = {
-    parse: (path: string) => Promise<ImportResult>;
-    source: string;
-};

package/dist/cli/migrate.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env bun
-export {};

package/dist/client/components/react/SignIn.d.ts

@@ -1,32 +0,0 @@
-import { type FormEvent } from 'react';
-import type { AuthClient, AuthClientError } from '../../createAuthClient';
-type AuthnSuccess = {
-    passwordCompromised?: boolean;
-    status: 'authenticated' | 'mfa_required';
-};
-export type SignInProps = {
-    client: AuthClient;
-    classNames?: {
-        button?: string;
-        container?: string;
-        divider?: string;
-        error?: string;
-        field?: string;
-        input?: string;
-        label?: string;
-        oauthButton?: string;
-        oauthGrid?: string;
-    };
-    emailLabel?: string;
-    onError?: (error: AuthClientError) => void;
-    onSuccess?: (result: AuthnSuccess) => void;
-    passwordLabel?: string;
-    providers?: string[];
-    submitLabel?: string;
-};
-export declare const SignIn: ({ client, classNames, emailLabel, onError, onSuccess, passwordLabel, providers, submitLabel }: SignInProps) => import("react").ReactElement<{
-    className: string | undefined;
-    'data-abs-auth': string;
-    onSubmit: (event: FormEvent<HTMLFormElement>) => Promise<void>;
-}, string | import("react").JSXElementConstructor<any>>;
-export {};

package/dist/client/components/react/SignUp.d.ts

@@ -1,29 +0,0 @@
-import { type FormEvent } from 'react';
-import type { AuthClient, AuthClientError } from '../../createAuthClient';
-type SignUpSuccess = {
-    status: 'authenticated';
-} | {
-    status: 'verification_required';
-};
-export type SignUpProps = {
-    client: AuthClient;
-    classNames?: {
-        button?: string;
-        container?: string;
-        error?: string;
-        field?: string;
-        input?: string;
-        label?: string;
-    };
-    emailLabel?: string;
-    onError?: (error: AuthClientError) => void;
-    onSuccess?: (result: SignUpSuccess) => void;
-    passwordLabel?: string;
-    submitLabel?: string;
-};
-export declare const SignUp: ({ client, classNames, emailLabel, onError, onSuccess, passwordLabel, submitLabel }: SignUpProps) => import("react").ReactElement<{
-    className: string | undefined;
-    'data-abs-auth': string;
-    onSubmit: (event: FormEvent<HTMLFormElement>) => Promise<void>;
-}, string | import("react").JSXElementConstructor<any>>;
-export {};

package/dist/client/components/react/UserButton.d.ts

@@ -1,36 +0,0 @@
-import type { AuthClient } from '../../createAuthClient';
-export type UserButtonUser = {
-    avatarUrl?: string;
-    email?: string;
-    givenName?: string;
-};
-export type UserButtonItem = {
-    href: string;
-    label: string;
-};
-export type UserButtonProps = {
-    client: AuthClient;
-    classNames?: {
-        avatar?: string;
-        container?: string;
-        email?: string;
-        menu?: string;
-        menuItem?: string;
-        signOut?: string;
-        toggle?: string;
-    };
-    items?: UserButtonItem[];
-    onSignOut?: () => void;
-    signedOutHref?: string;
-    signOutLabel?: string;
-    user: UserButtonUser | null;
-};
-export declare const UserButton: ({ client, classNames, items, onSignOut, signedOutHref, signOutLabel, user }: UserButtonProps) => import("react").DetailedReactHTMLElement<{
-    className: string | undefined;
-    'data-abs-auth': string;
-    href: string;
-}, HTMLElement> | import("react").DetailedReactHTMLElement<{
-    className: string | undefined;
-    'data-abs-auth': string;
-    'data-abs-auth-open': string;
-}, HTMLElement>;

package/dist/client/createAuthClient.d.ts

@@ -1,285 +0,0 @@
-import type { PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/browser';
-export type AuthClientError = {
-    body: unknown;
-    message: string;
-    status: number;
-};
-export type AuthClientResult<T> = {
-    data: null;
-    error: AuthClientError;
-} | {
-    data: T;
-    error: null;
-};
-export type AuthClientRoutes = {
-    emailVerify?: string;
-    emailVerifyRequest?: string;
-    login?: string;
-    magicLinkRequest?: string;
-    magicLinkVerify?: string;
-    mfaChallenge?: string;
-    mfaManagement?: string;
-    mfaSetup?: string;
-    mfaVerifySetup?: string;
-    passkeyAuthenticateOptions?: string;
-    passkeyAuthenticateVerify?: string;
-    passkeyList?: string;
-    passkeyRegisterOptions?: string;
-    passkeyRegisterVerify?: string;
-    passkeyRemove?: string;
-    passwordReset?: string;
-    passwordResetRequest?: string;
-    register?: string;
-    sessions?: string;
-    signout?: string;
-    status?: string;
-};
-export type AuthClientConfig = {
-    baseUrl?: string;
-    credentials?: RequestCredentials;
-    fetch?: typeof fetch;
-    routes?: AuthClientRoutes;
-};
-export declare const createAuthClient: ({ baseUrl, credentials, fetch: fetchImpl, routes }?: AuthClientConfig) => {
-    emailVerification: {
-        request: (body: {
-            email: string;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                ok: true;
-            };
-            error: null;
-        }>;
-        verify: (body: {
-            token: string;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                ok: true;
-            };
-            error: null;
-        }>;
-    };
-    mfa: {
-        challenge: (body: {
-            code: string;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                status: "authenticated";
-            };
-            error: null;
-        }>;
-        disable: () => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                status: "disabled";
-            };
-            error: null;
-        }>;
-        setup: () => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                secret: string;
-                uri: string;
-            };
-            error: null;
-        }>;
-        status: () => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: import("..").MfaStatus;
-            error: null;
-        }>;
-        verifySetup: (body: {
-            code: string;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                backupCodes: string[];
-            };
-            error: null;
-        }>;
-    };
-    passkeys: {
-        authenticateOptions: () => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: PublicKeyCredentialRequestOptionsJSON;
-            error: null;
-        }>;
-        authenticateVerify: (response: unknown) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                status: "authenticated";
-            };
-            error: null;
-        }>;
-        list: () => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: unknown[];
-            error: null;
-        }>;
-        registerOptions: () => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: PublicKeyCredentialCreationOptionsJSON;
-            error: null;
-        }>;
-        registerVerify: (response: unknown) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                ok: true;
-            };
-            error: null;
-        }>;
-        remove: (credentialId: string) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                ok: true;
-            };
-            error: null;
-        }>;
-    };
-    passwordless: {
-        requestMagicLink: (body: {
-            email: string;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                ok: true;
-            };
-            error: null;
-        }>;
-        verifyMagicLink: (body: {
-            token: string;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                status: "authenticated";
-            };
-            error: null;
-        }>;
-    };
-    passwordReset: {
-        confirm: (body: {
-            password: string;
-            token: string;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                ok: true;
-            };
-            error: null;
-        }>;
-        request: (body: {
-            email: string;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                ok: true;
-            };
-            error: null;
-        }>;
-    };
-    sessions: {
-        list: () => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: unknown[];
-            error: null;
-        }>;
-        revoke: (sessionId: string) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                ok: true;
-            };
-            error: null;
-        }>;
-    };
-    signIn: {
-        email: (body: {
-            email: string;
-            password: string;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                passwordCompromised?: boolean;
-                status: "authenticated" | "mfa_required";
-            };
-            error: null;
-        }>;
-    };
-    signUp: {
-        email: (body: {
-            email: string;
-            password: string;
-            [extra: string]: unknown;
-        }) => Promise<{
-            data: null;
-            error: AuthClientError;
-        } | {
-            data: {
-                status: "authenticated";
-            } | {
-                status: "verification_required";
-            };
-            error: null;
-        }>;
-    };
-    signOut: () => Promise<{
-        data: null;
-        error: AuthClientError;
-    } | {
-        data: null;
-        error: null;
-    }>;
-    status: () => Promise<{
-        data: null;
-        error: AuthClientError;
-    } | {
-        data: {
-            impersonator?: unknown;
-            user: unknown | null;
-        };
-        error: null;
-    }>;
-};
-export type AuthClient = ReturnType<typeof createAuthClient>;

package/dist/client/index.d.ts

@@ -1,3 +0,0 @@
-export * from './createAuthClient';
-export * from './sessionExpiry';
-export { runConditionalAuthentication, runPasskeyRegistration } from './passkeyHelpers';

package/dist/client/passkeyHelpers.d.ts

@@ -1,19 +0,0 @@
-import type { AuthClient, AuthClientError } from './createAuthClient';
-export declare const runConditionalAuthentication: (client: AuthClient) => Promise<{
-    data: null;
-    error: AuthClientError;
-} | {
-    data: {
-        status: "authenticated";
-    };
-    error: null;
-}>;
-export declare const runPasskeyRegistration: (client: AuthClient) => Promise<{
-    data: null;
-    error: AuthClientError;
-} | {
-    data: {
-        ok: true;
-    };
-    error: null;
-}>;

package/dist/client/react.d.ts

@@ -1,87 +0,0 @@
-import type { AuthClient, AuthClientError } from './createAuthClient';
-type Mutator<Args, Data> = (args: Args) => Promise<{
-    data: Data | null;
-    error: AuthClientError | null;
-}>;
-type MutationState<Args, Data> = {
-    data: Data | null;
-    error: AuthClientError | null;
-    isPending: boolean;
-    mutate: Mutator<Args, Data>;
-    reset: () => void;
-};
-export declare const useMagicLink: (client: AuthClient) => MutationState<{
-    email: string;
-}, {
-    ok: true;
-}>;
-export declare const useMfaChallenge: (client: AuthClient) => MutationState<{
-    code: string;
-}, {
-    status: "authenticated";
-}>;
-export declare const usePasskeyAutofill: (client: AuthClient) => {
-    cancel: () => void;
-    data: {
-        status: "authenticated";
-    } | null;
-    error: AuthClientError | null;
-    isPending: boolean;
-    start: () => Promise<void>;
-};
-export declare const usePasswordReset: (client: AuthClient) => MutationState<{
-    email: string;
-}, {
-    ok: true;
-}>;
-export declare const useSessions: (client: AuthClient) => {
-    data: unknown[] | null;
-    error: AuthClientError | null;
-    isPending: boolean;
-    refetch: () => Promise<void>;
-    revoke: (sessionId: string) => Promise<{
-        data: null;
-        error: AuthClientError;
-    } | {
-        data: {
-            ok: true;
-        };
-        error: null;
-    }>;
-};
-export declare const useSignIn: (client: AuthClient) => MutationState<{
-    email: string;
-    password: string;
-}, {
-    passwordCompromised?: boolean;
-    status: "authenticated" | "mfa_required";
-}>;
-export declare const useSignOut: (client: AuthClient) => MutationState<unknown, null>;
-export declare const useSignUp: (client: AuthClient) => MutationState<{
-    [extra: string]: unknown;
-    email: string;
-    password: string;
-}, {
-    status: "authenticated";
-} | {
-    status: "verification_required";
-}>;
-export declare const useUpgradeToPasskey: (client: AuthClient) => {
-    error: AuthClientError | null;
-    isPending: boolean;
-    passkeys: unknown[] | null;
-    refetch: () => Promise<void>;
-    register: () => Promise<{
-        data: null;
-        error: AuthClientError;
-    } | {
-        data: {
-            ok: true;
-        };
-        error: null;
-    }>;
-    shouldPrompt: boolean;
-};
-export { SignIn, type SignInProps } from './components/react/SignIn';
-export { SignUp, type SignUpProps } from './components/react/SignUp';
-export { UserButton, type UserButtonItem, type UserButtonProps, type UserButtonUser } from './components/react/UserButton';