@authowl/core 0.11.0 → 0.12.0

package/dist/native.d.ts

@@ -0,0 +1,149 @@
+import { R as ResolvedAuthConfig, A as AuthConfig } from './organization-membership-B3m6PbmO.js';
+export { D as DecodedPublishableKey, H as HasParams, O as OrganizationMembership, c as createMembershipHas, d as decodePublishableKey, r as resolveConfig, s as sessionCookieName } from './organization-membership-B3m6PbmO.js';
+import { j as AuthOwlClient, aJ as SocialIdTokenOptions, bb as createAuthHttpClient, bc as AuthHttpClient, aj as PasskeySignInOptions, e as ActionFetchOptions, g as AuthActionResult, ai as PasskeyAuthData, f as AddPasskeyOptions, l as AuthPasskey } from './client-CzV2XWt6.js';
+export { h as AuthClientError, o as AuthSession, p as AuthUser, a2 as Organization, a3 as OrganizationClient, a4 as OrganizationDetails, aq as ProjectCapabilities, ar as PublicConfig, aC as SessionState, aD as SessionStore, aE as SetActiveOrganizationOptions, aI as SocialAuthData, b9 as getPublicConfig, ba as resolveProjectCapabilities } from './client-CzV2XWt6.js';
+import { startAuthentication, startRegistration } from '@simplewebauthn/browser';
+
+type AuthActionClient = Omit<AuthOwlClient, 'getToken' | 'getConsentStatus' | 'acceptConsent' | 'waitlist'>;
+/** Native social sign-in uses an ID token obtained from the provider SDK. */
+interface NativeSocialSignInOptions {
+    provider: string;
+    idToken: SocialIdTokenOptions;
+    requestSignUp?: boolean;
+}
+type NativeSignInClient = Omit<AuthActionClient['signIn'], 'social' | 'sso' | 'passkey'> & {
+    social(params: NativeSocialSignInOptions, fetchOptions?: Parameters<AuthActionClient['signIn']['social']>[1]): ReturnType<AuthActionClient['signIn']['social']>;
+};
+type NativePasskeyClient = Omit<AuthActionClient['passkey'], 'addPasskey'>;
+interface PasskeyCeremonyClient {
+    signIn: AuthActionClient['signIn']['passkey'];
+    add: AuthActionClient['passkey']['addPasskey'];
+}
+type PasskeyCeremonyClientFactory = (http: ReturnType<typeof createAuthHttpClient>, sessionChanged: () => void) => PasskeyCeremonyClient;
+/**
+ * Auth actions that can execute without browser navigation or WebAuthn.
+ *
+ * Social sign-in requires a provider ID token. Redirect OAuth, enterprise SSO,
+ * passkey sign-in, and passkey registration need browser state or WebAuthn and
+ * are deliberately absent from the native surface.
+ */
+type NativeAuthClient = Omit<AuthActionClient, 'signIn' | 'passkey'> & {
+    signIn: NativeSignInClient;
+    passkey: NativePasskeyClient;
+};
+/**
+ * A native client whose host supplied a platform passkey ceremony.
+ *
+ * The passkey methods appear in the TYPE only when an adapter is passed, so an
+ * app without one cannot call a ceremony that would fail at runtime.
+ */
+type NativePasskeyCapableClient = Omit<NativeAuthClient, 'passkey' | 'signIn'> & {
+    passkey: NativePasskeyClient & Pick<AuthActionClient['passkey'], 'addPasskey'>;
+    signIn: NativeSignInClient & Pick<AuthActionClient['signIn'], 'passkey'>;
+};
+/** Build the runtime-native subset without leaving browser-only methods reachable. */
+declare function createNativeAuthClient(config: ResolvedAuthConfig, onSessionMutation?: () => void): NativeAuthClient;
+declare function createNativeAuthClient(config: ResolvedAuthConfig, onSessionMutation: (() => void) | undefined, createPasskeys: PasskeyCeremonyClientFactory): NativePasskeyCapableClient;
+
+type AuthenticationOptions = Parameters<typeof startAuthentication>[0]['optionsJSON'];
+type RegistrationOptions = Parameters<typeof startRegistration>[0]['optionsJSON'];
+declare function decodeAuthenticationOptions(value: unknown): AuthenticationOptions;
+declare function decodeRegistrationOptions(value: unknown): RegistrationOptions;
+
+/**
+ * The two ceremony responses, as the server expects to receive them.
+ *
+ * Kept distinct: an assertion carries `authenticatorData`, an attestation
+ * carries `attestationObject`, and collapsing them into one type would let a
+ * registration response be posted to the authentication endpoint.
+ */
+type PasskeyRegistrationResponse = {
+    id: string;
+    rawId: string;
+    type: 'public-key';
+    response: {
+        clientDataJSON: string;
+        attestationObject: string;
+        transports?: string[];
+        publicKeyAlgorithm?: number;
+        publicKey?: string;
+    };
+    clientExtensionResults?: unknown;
+    authenticatorAttachment?: string;
+};
+type PasskeyAuthenticationResponse = {
+    id: string;
+    rawId: string;
+    type: 'public-key';
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string;
+    };
+    clientExtensionResults?: unknown;
+    authenticatorAttachment?: string;
+};
+/**
+ * Runs the platform's WebAuthn ceremonies.
+ *
+ * Injected so a non-browser runtime can supply its own. React Native has no
+ * `navigator.credentials`, but it does have platform passkey APIs
+ * (`ASAuthorization` on iOS, Credential Manager on Android) whose libraries
+ * speak the same WebAuthn JSON. Parameterizing only the ceremony lets those
+ * runtimes reuse every line of option decoding, response projection, and
+ * in-flight de-duplication below, instead of reimplementing the protocol.
+ */
+interface PasskeyCeremony {
+    authenticate(input: {
+        optionsJSON: ReturnType<typeof decodeAuthenticationOptions>;
+        useBrowserAutofill?: boolean;
+    }): Promise<PasskeyAuthenticationResponse>;
+    register(input: {
+        optionsJSON: ReturnType<typeof decodeRegistrationOptions>;
+    }): Promise<PasskeyRegistrationResponse>;
+    /**
+     * Classify a ceremony failure, returning the platform's error code.
+     *
+     * Supplied by the ceremony because only it knows its own error type. The
+     * browser implementation tests `instanceof WebAuthnError`; doing that here
+     * would require importing the browser helper into this module, and a
+     * structural stand-in cannot work - a real WebAuthnError takes its `name`
+     * from the underlying cause, not from the class.
+     */
+    errorCode?(error: unknown): string | undefined;
+}
+declare function createPasskeyClient(http: AuthHttpClient, sessionChanged: () => void, ceremony: PasskeyCeremony): {
+    signIn(options?: PasskeySignInOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<PasskeyAuthData>>;
+    add(options?: AddPasskeyOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AuthPasskey>>;
+};
+
+/**
+ * Native (React Native / Expo) entry point.
+ *
+ * The browser client relies on the browser's cookie jar, `BroadcastChannel`, and
+ * `window.location` redirects - none of which exist on a phone. This entry
+ * exposes the native-safe auth surface built on `createNativeAuthClient`, which
+ * drops browser navigation and WebAuthn ceremonies, and leaves session storage
+ * to the caller:
+ *
+ *   1. WHERE the session lives. Pass a `fetch` that persists and replays the
+ *      session cookie from secure storage (`@authowl/react-native` supplies one).
+ *
+ * Social providers are supported through ID tokens obtained from their native
+ * SDKs. Redirect OAuth cannot share state cookies with this client-side jar.
+ *
+ * Kept separate from `./index` so a React Native bundler never pulls the
+ * browser-only modules into an app that cannot use them.
+ */
+
+/**
+ * Build a native auth client from a publishable key and API URL.
+ *
+ * `config.fetch` is the seam a native app must use to persist its session:
+ * without one, requests fall back to whatever cookie behaviour the platform's
+ * `fetch` happens to have, which does not survive an app restart.
+ */
+declare function createNativeClient(config: AuthConfig, onSessionMutation?: () => void): NativeAuthClient;
+
+export { AddPasskeyOptions, AuthActionResult, AuthConfig, AuthOwlClient, AuthPasskey, type NativeAuthClient, type NativePasskeyCapableClient, type NativeSocialSignInOptions, PasskeyAuthData, type PasskeyAuthenticationResponse, type PasskeyCeremony, type PasskeyCeremonyClientFactory, type PasskeyRegistrationResponse, ResolvedAuthConfig, SocialIdTokenOptions, createNativeAuthClient, createNativeClient, createPasskeyClient };

package/dist/native.js

@@ -0,0 +1 @@
+import {f}from'./chunk-SM5LS47O.js';export{f as createNativeAuthClient,g as createPasskeyClient,k as getPublicConfig,a as resolveProjectCapabilities}from'./chunk-SM5LS47O.js';import {e}from'./chunk-KPXCQZUX.js';export{v as createMembershipHas,a as decodePublishableKey,e as resolveConfig,b as sessionCookieName}from'./chunk-KPXCQZUX.js';function u(i,o){return f(e(i),o)}export{u as createNativeClient};

package/dist/{transport-BObDKlIh.d.cts → organization-membership-B3m6PbmO.d.cts}

@@ -114,18 +114,4 @@ declare function createMembershipHas(membership: OrganizationMembership | null |
     }) => boolean;
 };
 
-type TransportErrorKind = 'aborted' | 'timeout' | 'network' | 'response_too_large' | 'invalid_response';
-/**
- * Stable, secret-safe failure from the shared HTTP boundary.
- *
- * Deliberately does not retain the request URL, headers, body, or underlying
- * error. Server clients may carry secret authorization headers and hostile
- * fetch implementations may echo those values in their error messages.
- */
-declare class TransportError extends Error {
-    readonly kind: TransportErrorKind;
-    readonly requestId?: string;
-    constructor(kind: TransportErrorKind, requestId?: string);
-}
-
-export { type AuthConfig as A, type DecodedPublishableKey as D, type HasParams as H, type OrganizationMembership as O, type ResolvedAuthConfig as R, TransportError as T, type TransportErrorKind as a, membershipHasPermission as b, createMembershipHas as c, decodePublishableKey as d, membershipHasTeam as e, membershipHas as m, resolveConfig as r, sessionCookieName as s };
+export { type AuthConfig as A, type DecodedPublishableKey as D, type HasParams as H, type OrganizationMembership as O, type ResolvedAuthConfig as R, membershipHasPermission as a, membershipHasTeam as b, createMembershipHas as c, decodePublishableKey as d, membershipHas as m, resolveConfig as r, sessionCookieName as s };

package/dist/{transport-BObDKlIh.d.ts → organization-membership-B3m6PbmO.d.ts}

@@ -114,18 +114,4 @@ declare function createMembershipHas(membership: OrganizationMembership | null |
     }) => boolean;
 };
 
-type TransportErrorKind = 'aborted' | 'timeout' | 'network' | 'response_too_large' | 'invalid_response';
-/**
- * Stable, secret-safe failure from the shared HTTP boundary.
- *
- * Deliberately does not retain the request URL, headers, body, or underlying
- * error. Server clients may carry secret authorization headers and hostile
- * fetch implementations may echo those values in their error messages.
- */
-declare class TransportError extends Error {
-    readonly kind: TransportErrorKind;
-    readonly requestId?: string;
-    constructor(kind: TransportErrorKind, requestId?: string);
-}
-
-export { type AuthConfig as A, type DecodedPublishableKey as D, type HasParams as H, type OrganizationMembership as O, type ResolvedAuthConfig as R, TransportError as T, type TransportErrorKind as a, membershipHasPermission as b, createMembershipHas as c, decodePublishableKey as d, membershipHasTeam as e, membershipHas as m, resolveConfig as r, sessionCookieName as s };
+export { type AuthConfig as A, type DecodedPublishableKey as D, type HasParams as H, type OrganizationMembership as O, type ResolvedAuthConfig as R, membershipHasPermission as a, membershipHasTeam as b, createMembershipHas as c, decodePublishableKey as d, membershipHas as m, resolveConfig as r, sessionCookieName as s };

package/dist/server.d.cts

@@ -1,5 +1,6 @@
-import { O as OrganizationMembership, a as TransportErrorKind, H as HasParams } from './transport-BObDKlIh.cjs';
-export { A as AuthConfig, R as ResolvedAuthConfig, r as resolveConfig, s as sessionCookieName } from './transport-BObDKlIh.cjs';
+import { O as OrganizationMembership, H as HasParams } from './organization-membership-B3m6PbmO.cjs';
+export { A as AuthConfig, R as ResolvedAuthConfig, r as resolveConfig, s as sessionCookieName } from './organization-membership-B3m6PbmO.cjs';
+import { a as TransportErrorKind } from './transport-DcWDTRd4.cjs';
 
 /**
  * Stateless verification of an AuthOwl project JWT for SERVER-side authorization

package/dist/server.d.ts

@@ -1,5 +1,6 @@
-import { O as OrganizationMembership, a as TransportErrorKind, H as HasParams } from './transport-BObDKlIh.js';
-export { A as AuthConfig, R as ResolvedAuthConfig, r as resolveConfig, s as sessionCookieName } from './transport-BObDKlIh.js';
+import { O as OrganizationMembership, H as HasParams } from './organization-membership-B3m6PbmO.js';
+export { A as AuthConfig, R as ResolvedAuthConfig, r as resolveConfig, s as sessionCookieName } from './organization-membership-B3m6PbmO.js';
+import { a as TransportErrorKind } from './transport-DcWDTRd4.js';
 
 /**
  * Stateless verification of an AuthOwl project JWT for SERVER-side authorization

package/dist/transport-DcWDTRd4.d.cts

@@ -0,0 +1,15 @@
+type TransportErrorKind = 'aborted' | 'timeout' | 'network' | 'response_too_large' | 'invalid_response';
+/**
+ * Stable, secret-safe failure from the shared HTTP boundary.
+ *
+ * Deliberately does not retain the request URL, headers, body, or underlying
+ * error. Server clients may carry secret authorization headers and hostile
+ * fetch implementations may echo those values in their error messages.
+ */
+declare class TransportError extends Error {
+    readonly kind: TransportErrorKind;
+    readonly requestId?: string;
+    constructor(kind: TransportErrorKind, requestId?: string);
+}
+
+export { TransportError as T, type TransportErrorKind as a };

package/dist/transport-DcWDTRd4.d.ts

@@ -0,0 +1,15 @@
+type TransportErrorKind = 'aborted' | 'timeout' | 'network' | 'response_too_large' | 'invalid_response';
+/**
+ * Stable, secret-safe failure from the shared HTTP boundary.
+ *
+ * Deliberately does not retain the request URL, headers, body, or underlying
+ * error. Server clients may carry secret authorization headers and hostile
+ * fetch implementations may echo those values in their error messages.
+ */
+declare class TransportError extends Error {
+    readonly kind: TransportErrorKind;
+    readonly requestId?: string;
+    constructor(kind: TransportErrorKind, requestId?: string);
+}
+
+export { TransportError as T, type TransportErrorKind as a };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authowl/core",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Framework-agnostic client for AuthOwl, the multi-tenant auth SaaS.",
   "license": "MIT",
   "publishConfig": {
@@ -42,6 +42,26 @@
         "types": "./dist/server.d.cts",
         "default": "./dist/server.cjs"
       }
+    },
+    "./native": {
+      "import": {
+        "types": "./dist/native.d.ts",
+        "default": "./dist/native.js"
+      },
+      "require": {
+        "types": "./dist/native.d.cts",
+        "default": "./dist/native.cjs"
+      }
+    },
+    "./i18n": {
+      "import": {
+        "types": "./dist/messages.d.ts",
+        "default": "./dist/messages.js"
+      },
+      "require": {
+        "types": "./dist/messages.d.cts",
+        "default": "./dist/messages.cjs"
+      }
     }
   },
   "main": "./dist/index.cjs",
@@ -58,7 +78,7 @@
     "vitest": "^4.1.10"
   },
   "scripts": {
-    "build": "tsup && node ../../scripts/gen-notices.mjs src/index.ts src/server.ts",
+    "build": "tsup && node ../../scripts/gen-notices.mjs src/index.ts src/server.ts src/native.ts src/messages.ts",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests"