@auth-link/web 0.0.0-stage → 0.0.2

package/CHANGELOG.md

@@ -0,0 +1,62 @@
+# Changelog
+
+## 0.0.2 — 2026-10-30
+
+- Support explicitly allowed cross-origin application backends with configurable fetch credentials, per-request Bearer tokens, extra headers and framework CSRF header names. Same-origin session clients remain the default.
+- Require CSRF when cookies may be sent, validate backend destinations before reading credentials, protect managed headers, and include credential-provider waits in cancellation and timeout handling.
+- Replace the rejected-origin error `CMS_ORIGIN_REQUIRED` with `BACKEND_ORIGIN_NOT_ALLOWED` and export `ClientOptions`.
+- Explain the session CSRF token source, backend validation and concrete client helper in all three integration guides.
+- Provide complete React binding/confirmation handlers and a Vue example, including request creation and dialog cleanup.
+- Fix Vue refresh callbacks retaining old parent state; update refresh-button availability when the handler is added or removed.
+- Apply the declared Vue `className` prop alongside Vue string, array and object `class` attributes.
+- Release the web package under the MIT license, including the license text in the npm archive.
+
+## 0.0.1 — 2026-10-30
+
+- Start the new `@auth-link/web` package under the `auth-link` npm organization.
+- Keep each refresh period on a fixed monotonic deadline so rounded server timestamps and network delays cannot make the bar jump; ignore stale periods.
+
+### Included changes from earlier local builds
+
+- Animate the refresh bar continuously using animation frames and monotonic server timing, reset immediately at code rollover, and stop animation when the dialog closes or reduced motion is enabled.
+
+- Replace dual countdowns with a thin refresh bar and static caption; show request expiry only in the final 30 seconds, with a subdued warning and reduced-motion-aware code transitions in all three layouts.
+
+- Close rejected dialogs automatically; return typed `Rejection` payloads (`code: REJECTED`) through JavaScript, React and Vue callbacks without a rejection/retry panel or user-close event.
+
+- Add A (default minimal), B (split) and C (compact / mobile sheet) via `variant`, including reactive React/Vue updates and `modal.setVariant()`.
+- Replace the oversized close control with a small icon and 44px target; add translated footer cancellation to B/C.
+
+- Default dialogs to Simplified Chinese; keep all explicit language selections.
+
+- Automatically dismiss confirmed dialogs while delivering the success callback once.
+- Open responsive native dialogs with openAuthLinkBind / openAuthLinkConfirm from any framework.
+- React / Vue components now open dialogs on mount; use onClose / @close to unmount. SSR renders no dialog.
+- Add localized close controls, Escape handling, focus/scroll restoration and abort-on-close.
+- Move the client package and mobile app into the c_auth_link repository.
+
+
+## Historical local builds (not npm releases)
+
+The versions below predate the `@auth-link/web` npm package. Their applicable features were included in 0.0.1; they are not pending npm releases. Later changes above supersede historical defaults.
+
+### Local 0.1.2
+
+- Use the single `device-presence.v1` protocol: original-phone hardware proof and in-app approval. Remove legacy authentication policy support.
+- Update English, Chinese and Japanese guides for mobile protocol 7.
+
+
+### Local 0.1.1
+
+- Add Bengali, Spanish, Filipino, Hindi, Indonesian, Malay, Portuguese, Thai and Vietnamese panel translations; retain English, Simplified/Traditional Chinese and Japanese.
+- Default both React and Vue panels to English, including unsupported-locale fallback and accessible language attributes.
+- Add English (default), Chinese and Japanese integration guides and language links.
+- Use platform-neutral package metadata; remove local paths and maintainer publishing instructions from public documentation.
+- Export `supportedLocales` for host language pickers.
+
+### Local 0.1.0
+
+- React/Vue 绑定二维码、30 秒动态核对码、请求/数字双倒计时。
+- 同源 application 客户端、CSRF、创建幂等键、取消与组件生命周期管理。
+- 确认/拒绝/过期/错误事件，消费后才确认，卸载后屏蔽迟到响应。
+- TypeScript、四种语言、独立 CSS、无浏览器 seed 或租户密钥。

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 auth-link
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.