@authowl/core 0.14.0 → 0.15.0

package/dist/organization-membership-B3m6PbmO.d.ts

@@ -1,117 +0,0 @@
-type DecodedPublishableKey = {
-    prefix: 'pk_live' | 'pk_test';
-    env: 'live' | 'test';
-    projectId: string;
-};
-declare function decodePublishableKey(key: string): DecodedPublishableKey;
-
-/**
- * The exact session-cookie name the auth server sets for a given project.
- *
- * Single source of truth for the cookie name across the SDK. The server
- * (the AuthOwl server project factory) configures
- * `advanced.cookiePrefix = "p_" + <projectId without dashes>` and
- * `useSecureCookies` in production; the auth engine then names the session
- * cookie `${securePrefix}${cookiePrefix}.session_token`, where `securePrefix`
- * is `__Secure-` for secure cookies and empty otherwise:
- *
- *   dev  (http):  p_<idNoDashes>.session_token
- *   prod (https): __Secure-p_<idNoDashes>.session_token
- *
- * Verified 2026-07-06 against the auth engine's `getCookies()` with the server's
- * real config (see CONTRACTS section 5 and `cookie.test.ts`). Note the engine
- * joins the prefix and name with a dot (`.`), not an underscore, and uses the
- * `__Secure-` (not `__Host-`) prefix - both are easy to get wrong by hand, and
- * getting them wrong makes `auth()` forward a cookie the server never set. If an
- * auth-engine upgrade changes cookie naming, re-verify and update this function,
- * the `cookie.test.ts` fixtures, and CONTRACTS section 5 together.
- *
- * `secure` must reflect the SERVER's cookie mode: callers holding the auth API
- * URL derive it from the protocol (`https:` => secure). Callers that cannot
- * know it (the UX-only redirect middleware) should check both variants.
- */
-declare function sessionCookieName(projectId: string, opts?: {
-    secure?: boolean;
-}): string;
-
-type AuthConfig = {
-    publishableKey: string;
-    apiUrl: string;
-    /** Optional fetch override (e.g. for testing). */
-    fetch?: typeof fetch;
-};
-type ResolvedAuthConfig = AuthConfig & {
-    decoded: DecodedPublishableKey;
-    /** Fully-resolved base URL pointing at the per-project auth endpoint. */
-    projectBaseURL: string;
-};
-declare function resolveConfig(input: AuthConfig): ResolvedAuthConfig;
-
-/**
- * Pure, dependency-free evaluators for an organization membership's advisory
- * permission claim. Shared by the CLIENT `has()` (organization-client.ts, over
- * the browser session) and the SERVER `has()` (server.ts, over a verified JWT),
- * so the two paths can never disagree on what a membership grants.
- *
- * The membership carries the SAME `permissions` array AuthOwl emits into the
- * session and the JWT claim (plan §4/§5): the relabelled `org:sys_*` system ids
- * (plus their legacy bare forms during the dual-emit window) AND the operator's
- * custom `org:<feature>:<action>` ids. Evaluation is a pure array/string check
- * over that local claim - it NEVER calls a statement-only `/organization/has-
- * permission` route, which only knows the 14 static statements and would wrongly
- * report `false` for any custom permission.
- */
-/** The active-membership shape carried on the session / decoded from a token. */
-interface OrganizationMembership {
-    /** The member's canonical role key (built-in `owner`/`admin`/`member` or a project role). */
-    role: string;
-    /**
-     * The member's effective permission ids: `org:sys_*` system claims (with
-     * their legacy bare forms during dual-emit) plus custom `org:<feature>:<action>`
-     * ids. Advisory only - the real boundary is server-side over the verified token.
-     */
-    permissions: string[];
-    /**
-     * Team ids the member holds inside the ACTIVE organization, as emitted by
-     * AuthOwl into both the session and the JWT claim. Teams are pure grouping:
-     * belonging to one grants nothing on its own, so this is for the application's
-     * own gating, never an authority check.
-     *
-     * Optional because a token minted before teams shipped carries no `teams` claim.
-     * `has({ teamId })` then returns false rather than guessing - it can only ever
-     * confirm a team the claim actually proves.
-     */
-    teams?: string[];
-}
-/** Clerk-style `has()` query: match the role, the permission, the team, or a combination (AND). */
-interface HasParams {
-    role?: string;
-    permission?: string;
-    /** Require membership of this team within the active organization. */
-    teamId?: string;
-}
-/** True when the membership's permission claim includes `permission`. Pure. */
-declare function membershipHasPermission(membership: OrganizationMembership | null | undefined, permission: string): boolean;
-/**
- * True when the membership's team claim includes `teamId`. Pure.
- *
- * False when the claim carries no `teams` at all, which is what a token minted
- * before teams shipped looks like - an absent claim is never read as "any team".
- */
-declare function membershipHasTeam(membership: OrganizationMembership | null | undefined, teamId: string): boolean;
-/**
- * Clerk-style `has()`: true when the membership satisfies EVERY provided
- * criterion - the role matches AND the permission is included AND the team is
- * held. Returns false when there is no membership, or when no criterion at all is
- * given. Pure: no I/O, evaluated entirely against the local claim.
- */
-declare function membershipHas(membership: OrganizationMembership | null | undefined, params: HasParams): boolean;
-/** Bind the pure evaluators to one membership (drives the client / hook `has`). */
-declare function createMembershipHas(membership: OrganizationMembership | null | undefined): {
-    has: (params: HasParams) => boolean;
-    hasPermission: (params: {
-        permission: string;
-    }) => boolean;
-};
-
-export { type AuthConfig as A, type DecodedPublishableKey as D, type HasParams as H, type OrganizationMembership as O, type ResolvedAuthConfig as R, membershipHasPermission as a, membershipHasTeam as b, createMembershipHas as c, decodePublishableKey as d, membershipHas as m, resolveConfig as r, sessionCookieName as s };

package/dist/session-handoff-6B5KZXQV.js

@@ -1,2 +0,0 @@
-import {a as a$1}from'./chunk-T5SH3ZZP.js';var u="authowl_handoff_verifier",a="authowl_code",g=32,S=900,m=["email","providerId","domain","organizationSlug"];function f(n){let e="";for(let i of n)e+=String.fromCharCode(i);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function w(n){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(n));return f(new Uint8Array(e))}function h(){return f(crypto.getRandomValues(new Uint8Array(g)))}function p(n,e){let i=window.location.protocol==="https:"?"; Secure":"";document.cookie=`${u}=${n}; Path=/; Max-Age=${e}; SameSite=Lax${i}`;}function R(){for(let n of document.cookie.split(";")){let e=n.indexOf("=");if(!(e<0)&&n.slice(0,e).trim()===u)return n.slice(e+1).trim()||null}return null}function y(){p("",0);}function l(n){return new URL(n,window.location.href).toString()}async function b(n,e){let i=e.callbackURL?l(e.callbackURL):null;if(i&&new URL(i).origin!==window.location.origin)return null;let t=h(),o=new URL(`${n.projectBaseURL}/session/start`);if(o.searchParams.set("pk",n.publishableKey),o.searchParams.set("kind",e.kind),e.kind==="social")o.searchParams.set("provider",e.provider),e.scopes?.length&&o.searchParams.set("scopes",e.scopes.join(",")),e.loginHint&&o.searchParams.set("loginHint",e.loginHint),e.requestSignUp!==void 0&&o.searchParams.set("requestSignUp",e.requestSignUp?"1":"0");else for(let s of m){let r=e[s];r&&o.searchParams.set(s,r);}let d=`${window.location.origin}${window.location.pathname}${window.location.search}`;o.searchParams.set("cb",i??d);for(let[s,r]of [["err",e.errorCallbackURL],["new",e.newUserCallbackURL]])r&&o.searchParams.set(s,l(r));return o.searchParams.set("challenge",await w(t)),p(t,S),o.toString()}function U(){if(typeof window>"u")return null;let n=window.location.hash;if(!n.includes(a))return null;let e=new URLSearchParams(n.replace(/^#/,"")),i=e.get(a);if(!i)return null;e.delete(a);let t=e.toString();return window.history.replaceState(window.history.state,"",`${window.location.pathname}${window.location.search}${t?`#${t}`:""}`),i}async function k(n){if(!a$1())return  false;let e=U();if(!e)return  false;let i=R();if(y(),!i)return  false;let{error:t}=await n.request("/session/exchange",{method:"POST",body:{code:e,verifier:i}});return t===null}
-export{b as beginCrossSiteSignIn,w as challengeFor,k as completeCrossSiteSignIn,U as takeHandoffCode};

package/dist/transport-DcWDTRd4.d.cts

@@ -1,15 +0,0 @@
-type TransportErrorKind = 'aborted' | 'timeout' | 'network' | 'response_too_large' | 'invalid_response';
-/**
- * Stable, secret-safe failure from the shared HTTP boundary.
- *
- * Deliberately does not retain the request URL, headers, body, or underlying
- * error. Server clients may carry secret authorization headers and hostile
- * fetch implementations may echo those values in their error messages.
- */
-declare class TransportError extends Error {
-    readonly kind: TransportErrorKind;
-    readonly requestId?: string;
-    constructor(kind: TransportErrorKind, requestId?: string);
-}
-
-export { TransportError as T, type TransportErrorKind as a };

package/dist/transport-DcWDTRd4.d.ts

@@ -1,15 +0,0 @@
-type TransportErrorKind = 'aborted' | 'timeout' | 'network' | 'response_too_large' | 'invalid_response';
-/**
- * Stable, secret-safe failure from the shared HTTP boundary.
- *
- * Deliberately does not retain the request URL, headers, body, or underlying
- * error. Server clients may carry secret authorization headers and hostile
- * fetch implementations may echo those values in their error messages.
- */
-declare class TransportError extends Error {
-    readonly kind: TransportErrorKind;
-    readonly requestId?: string;
-    constructor(kind: TransportErrorKind, requestId?: string);
-}
-
-export { TransportError as T, type TransportErrorKind as a };